PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

LLM API Misconfigurations

blog.sentry.security | blog | #ai-security | #prompt-injection | #api-security | #llm | #owasp | #misconfiguration
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

How LLM API misconfigurations break trust boundaries: exposed messages[], privileged roles, model choice, or generation parameters enable role injection, parameter tampering, and runaway token usage.
Published
Collected

Related coverage

blog · blog.sentry.security
PIChef. A tool for Prompt Injection inspired by CyberChef
# PIChef. A tool for Prompt Injection inspired by CyberChef #### Sentry 08 Oct 2026 — 6 min read Share Baba Yaga represents PIChef as a keeper of dangerous recipes, mixing strange prompt-injection...
blog · blog.sentry.security
Exploiting Tool and Function Calling in LLM Agents
Exploiting tool and function calling in LLM agents: exposed messages[], privileged roles, and unescaped control tokens let attackers steer agent actions, echoing OWASP LLM06 Excessive Agency.
blog · blog.sentry.security
Semantic vs. Token-Based LLM Injections
Contrasting two LLM injection classes: semantic attacks use natural language to override instructions; token-based attacks exploit tokenizer quirks like reserved delimiters and adversarial suffixes.
blog · blog.sentry.security
ChatML Role Injection (CRI)
Attackers can inject system roles into ChatML message arrays to override developer instructions, invoke hidden tools, and pad payloads for denial-of-wallet DoS; strict schema validation is key.
blog · netspi.com
How Secure Are Your SaaS Applications? Pentesting for SaaS Providers
SaaS providers face rising API and multi-tenant threats; regular pentesting aligned to OWASP and PTES across the SDLC reduces breach risk and supports SOC 2, ISO 27001, GDPR, and HIPAA.
blog · netspi.com
API Security Testing: The Overlooked Frontline in Application Penetration Testing
APIs expose backend logic and sensitive data directly; targeted API security testing uncovers broken authentication, excessive data exposure, and access control flaws that traditional pentests miss.
Back