AI and LLM Security
Prompt Injection Assessment
We test whether an instruction typed by a user or hidden in a document can steer your assistant. We measure which data and actions that instruction can access.
What it is
Prompt injection occurs when input to a model overrides system instructions. In direct injection, the user types the instruction. In indirect injection, it is hidden in an email, document, or web page the model reads. According to OWASP, it is unclear whether any method can fully prevent this risk.
Scope
- Direct instructions typed by users
- Indirect instructions hidden in emails, documents, and web pages
- Instructions from tool outputs and file metadata
- Data exfiltration via a link or image in the response
- What input and output filters actually stop
The need
When organizations need it
- When your assistant summarizes emails or support tickets from customers.
- When the model can read content from the internet or shared folders.
- When you have purchased a prompt injection filter and do not know what it actually stops.
Method
How we work
-
Entry routes
We list every content source through which an instruction can enter the system.
-
Targets
For each route, we define the most harmful outcome that can be reached, such as exposing another customer's data.
-
Attempts
We test scenarios repeatedly in different forms. We record the success rate of each scenario.
-
Limiting impact
We recommend permission, approval, and output controls that can stop actions even if the model is steered.
Outcome
What you have at the end
You see which sources can deliver instructions that steer your system and what data they reach. You have controls to limit damage even if the model is misdirected.
Frequently asked questions
Can prompt injection be fully prevented?
No method is known to prevent it with certainty. The goal is to limit the data and actions an injected instruction can access.
Is it enough to add rules to the system prompt?
No. The system prompt is also text the model reads and can be overridden in the same way. The main controls are the permission and approval layers outside the model.
We use a filter. Is testing still necessary?
Yes. Filters catch known patterns but may miss instructions written differently. Testing shows what the filter actually stops.
AI and LLM Security
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting