PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

ChatML Role Injection (CRI)

blog.sentry.security | blog | #ai-security | #prompt-injection | #llm-security | #owasp | #excessive-agency | #chatml | #denial-of-wallet
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Attackers can inject system roles into ChatML message arrays to override developer instructions, invoke hidden tools, and pad payloads for denial-of-wallet DoS; strict schema validation is key.
Published
Collected

Related coverage

blog · blog.sentry.security
Exploiting Tool and Function Calling in LLM Agents
Exploiting tool and function calling in LLM agents: exposed messages[], privileged roles, and unescaped control tokens let attackers steer agent actions, echoing OWASP LLM06 Excessive Agency.
blog · blog.sentry.security
Semantic vs. Token-Based LLM Injections
Contrasting two LLM injection classes: semantic attacks use natural language to override instructions; token-based attacks exploit tokenizer quirks like reserved delimiters and adversarial suffixes.
blog · blog.sentry.security
LLM API Misconfigurations
How LLM API misconfigurations break trust boundaries: exposed messages[], privileged roles, model choice, or generation parameters enable role injection, parameter tampering, and runaway token usage.
blog · blog.sentry.security
Special Token Injection (STI) Attack Guide
A pentester's guide to Special Token Injection (STI): reserved tokens and chat templates, when poorly escaped, let attackers override system prompts, forge roles, and hijack tool calls in LLMs.
blog · wiz.io
Introducing the Prompt Airlines CTF: Test Your AI Security Skills
Wiz launched Prompt Airlines, a chatbot-based CTF where players exploit AI logic flaws to win a free flight ticket, teaching real LLM security risks; open to all skill levels.
research · wiz.io
Inside 90 days of attacks on AI infrastructure
This research provides real-world threat telemetry on how attackers target modern AI deployments and MCP interfaces.
Back