PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Special Token Injection (STI) Attack Guide

blog.sentry.security | blog | #ai-security | #pentesting | #prompt-injection | #llm | #special-token-injection | #chatml
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A pentester's guide to Special Token Injection (STI): reserved tokens and chat templates, when poorly escaped, let attackers override system prompts, forge roles, and hijack tool calls in LLMs.
Published
Collected

Related coverage

blog · blog.sentry.security
PIChef. A tool for Prompt Injection inspired by CyberChef
# PIChef. A tool for Prompt Injection inspired by CyberChef #### Sentry 08 Oct 2026 — 6 min read Share Baba Yaga represents PIChef as a keeper of dangerous recipes, mixing strange prompt-injection...
blog · blog.sentry.security
ChatML Role Injection (CRI)
Attackers can inject system roles into ChatML message arrays to override developer instructions, invoke hidden tools, and pad payloads for denial-of-wallet DoS; strict schema validation is key.
blog · aikido.dev
Aikido launches external network pentesting
TL;DR: Aikido now pentests your external network. Attackers already test your perimeter every day, and with AI agents doing the grunt work, they're faster than ever. Now you can run the same test first. Give our agents one domain and they'll map the internet-facing systems you run and attack them from the outside, exactly like a malicious actor would.
blog · aikido.dev
Adding Aikido AI pentesting to your existing security stack
How to add Aikido's AI pentesting on top of the SAST, SCA and cloud tools you already run, from your first pentest through whitebox testing, continuous testing and remediation.
research · projectdiscovery.io
How abliterated models can get you pwned
# How abliterated models can get you pwned Oct 6, 2026 · Prince Chaddha Any open model whose weights have been edited can carry a backdoor, whether it's a task-specific fine-tune, a merged adapter...
blog · blog.sentry.security
Exploiting Tool and Function Calling in LLM Agents
Exploiting tool and function calling in LLM agents: exposed messages[], privileged roles, and unescaped control tokens let attackers steer agent actions, echoing OWASP LLM06 Excessive Agency.
Back