AI Security Center — attacks, defences, India compliance.

The defining vulnerability class of the LLM era. An attacker inserts instructions — directly into user input, or indirectly through content the model ingests — that override the system prompt and weaponise the model against its operator.

LLMs leak. Training data leaks, system prompts leak, retrieved documents leak, conversation history leaks across users. Sensitive disclosure is the breach class that turns "interesting demo" into "DPDP incident."

The LLM supply chain is fragile. Pretrained weights from Hugging Face, pickle files that execute on load, poisoned datasets, dependency hijacks in agent libraries — the surface is enormous and most teams have never thought about it.

Poisoning attacks corrupt training data, fine-tuning data, or RAG indices to bias model behaviour. The attacker influences what the model learns — quietly, persistently, and often without detection until the trigger phrase is hit in production.

Treating LLM output as trusted input to downstream systems. Render LLM output as HTML and you get XSS. Pass it to a shell and you get RCE. Insert it into SQL and you get injection. The LLM is an untrusted source; act accordingly.

The "agent" pattern hands the LLM tools — read email, send email, run code, post to Slack, query a database. Excessive agency is what happens when those tools are too powerful, too unconstrained, or scoped to the wrong principal. Prompt injection becomes wire-transfer fraud.

When your system prompt leaks, attackers learn your business logic, your data access scopes, your guardrails, and your moat. System prompts contain secrets they should not — and even when they do not, leaking the prompt reveals exactly how to bypass it.

RAG put vector databases everywhere. Most teams trust their similarity-search results without realising they are a wide-open attack surface — for retrieval hijack, embedding inversion, and tenant boundary failures.

LLMs confidently state false things. When the output drives a decision, the false thing becomes a bug, a liability, or a breach. Misinformation in the LLM Top 10 is about output you trusted that was wrong.

LLM API calls cost money and consume rate-limited capacity. Unbounded consumption is the class of attacks that drives those costs out of control — and includes model-extraction attacks that copy your model by querying it enough.