Topics
Browse posts by category and tag — every topic we cover, with the latest pieces under each.
Tags
- #llm-security 16
- #red-team 15
- #jailbreaks 11
- #prompt-injection 8
- #guardrails 3
- #tooling 3
- #agents 2
- #encoding-attacks 2
- #indirect-injection 2
- #advbench 1
- #agent-security 1
- #ai-safety 1
- #ai-security 1
- #alignment 1
- #alignment-bypass 1
- #artprompt 1
- #ascii-art 1
- #attack-techniques 1
- #audio-attacks 1
- #automated-jailbreaks 1
- #catalog 1
- #cipher 1
- #competing-objectives 1
- #consulting 1
- #content-filtering 1
- #copilot 1
- #crescendo 1
- #current-techniques 1
- #cursor 1
- #dan 1
- #defense 1
- #defense-in-depth 1
- #drattack 1
- #engagement-design 1
- #evaluation 1
- #fingerprinting 1
- #frameworks 1
- #garak 1
- #gcg 1
- #generalization 1
- #harmbench 1
- #ide-agents 1
- #jailbreak-benchmarks 1
- #jailbreakbench 1
- #many-shot 1
- #methodology 1
- #model-identification 1
- #multi-turn 1
- #multimodal 1
- #obfuscation 1
- #open-source 1
- #owasp-llm-top-10 1
- #pair 1
- #payload-splitting 1
- #persona-injection 1
- #post-mortem 1
- #prompt-extraction 1
- #rag 1
- #reconnaissance 1
- #safety-training 1
- #scoping 1
- #strongreject 1
- #supply-chain 1
- #system-prompt-leak 1
- #tap 1
- #tool-use 1
- #vision-attacks 1
Categories
Techniques 7 posts
- Payload Splitting and Encoding Jailbreaks ExplainedHow payload splitting and encoding jailbreaks evade input filters: fragmentation, ciphers, low-resource translation, decomposition, and what still lands.
- DAN Prompt Jailbreak Explained: How 'Do Anything Now' WorksDAN (Do Anything Now) is the most replicated persona-injection jailbreak in LLM history. Here is the mechanism, why it worked, and how versions evolved.
- ArtPrompt Post-Mortem: Why ASCII-Art Bypasses WorkedA walkthrough of the ArtPrompt ASCII-art jailbreak: where it slipped past safety training, how model families patched it, and which encodings still land.
- Multi-Turn Role-Play Attacks: Why One Safe Turn Gets UnsafeCrescendo, many-shot and gradual context manipulation: how multi-turn jailbreaks evade single-turn classifiers, and what still lands against defenses.
- Multimodal jailbreaks: image and audio attack surfaces in 2026Vision and audio inputs are a separate attack channel from text. A survey of the multimodal jailbreaks that still land, from typographic to audio carriers.
- System prompt extraction: the techniques that still leak in 2026How system prompts get exfiltrated from production LLM apps: direct extraction, indirect inference, behavioral fingerprinting, and what actually works.
Tooling 5 posts
- Open Source LLM Security Tools: Licensing and CostOpen source LLM security testing tools compared on license and self-hosting cost: garak, PyRIT, promptfoo, and Meta's Purple Llama safeguards.
- Jailbreak Benchmarks: AdvBench, HarmBench, JailbreakBenchHow the main jailbreak benchmarks differ: AdvBench, HarmBench, JailbreakBench, and StrongREJECT on behavior sets, scoring, and reported success rates.
- Best AI Red Teaming Tools for LLMs: A Practitioner's ComparisonCompare the best AI red teaming tools for LLMs: Garak, PyRIT, Promptfoo, and Giskard, on probe coverage, CI/CD fit, and OWASP LLM Top 10 mapping.
- Garak in 2026: what it's actually good for, what it isn'tAn honest review of NVIDIA's Garak LLM vulnerability scanner: what its probes catch, where the noise is, and where it fits in a real testing pipeline.
- PAIR vs GCG vs TAP: Which Automated Jailbreak Framework to RunA practitioner comparison of the automated jailbreak frameworks PAIR, GCG, and TAP: threat model fit, compute cost, transferability, and when to run each.
Attack Surfaces 3 posts
- Indirect Prompt Injection in LLM Agents: Shipped FailuresTool-using LLM agents amplify every indirect prompt injection vector. A walkthrough of the exploit classes that have landed against production systems.
- Prompt Injection in IDE Coding Agents: Copilot and CursorCoding assistants read everything in your repo and increasingly act on it. A walkthrough of the prompt-injection variants that have shipped against them.
- Prompt Injection via Retrieved Documents: The RAG Attack SurfaceHow attacker-controlled content reaches the model through retrieval, the prompt injection variants that still land on production RAG stacks, and the real fixes.
Defense 3 posts
- Lethal Trifecta and CaMeL: Containing Agent InjectionThe lethal trifecta explains why agents get exfiltrated, and CaMeL shows what containment by construction looks like. Both are architecture, not prompting.
- Best LLM Guardrail Tools 2026: A Practitioner's ComparisonA technical comparison of the best LLM guardrail tools 2026: NeMo Guardrails, LLM Guard, Lakera, Guardrails AI, and Azure Content Safety, with benchmarks.
- LLM Defense Stack: Guardrails, Tool Scoping, and EgressJailbreaks and prompt injection need defenses at different layers. The controls that work for each: guardrail models, action-space limits, and egress control.
Foundations 2 posts
- How LLM Jailbreaks Work: Techniques and Success RatesA practitioner's breakdown of how LLM jailbreaks work, from roleplay conditioning to multi-turn manipulation, with attack success rates from research.
- Why Jailbreaks Work: Competing Objectives and GeneralizationJailbreaks are not a grab-bag of tricks. They exploit two structural failure modes of safety training: competing objectives and mismatched generalization.
Red Team Practice 2 posts
- Model Behavior Fingerprinting: Identifying a Wrapped LLMBefore attacking an LLM app you need to know which model is under the hood. A walkthrough of behavioral fingerprinting and what each signal reveals.
- Scoping an AI Red-Team Engagement: The Questions That MatterA working methodology for scoping LLM red-team engagements: the threat-model conversation, surface inventory, success criteria, and the scoping traps.