hunt-llm-ai

Test direct injection with phrases like 'ignore previous instructions' in user input, and indirect injection by uploading documents containing hidden instructions. Confirm impact by demonstrating data exfiltration, IDOR, or unauthorized tool use rather than injection alone.

IDOR-via-AI occurs when a chatbot accesses all user data without per-session scoping. Test by asking the bot to show messages or data belonging to another user ID; a successful response demonstrates cross-tenant data exposure.

ASCII smuggling hides malicious instructions using Unicode tag block characters U+E0000 through U+E007F, which are invisible to humans but readable by the model. Attackers embed these in documents or web pages the LLM processes.

A system prompt leak alone is rated informational under the triage rule. To qualify for bounty, chain the finding to demonstrated cross-user data leaks, tool-use exfiltration to an attacker host, or remote code execution.

ASI01-ASI10 catalog agentic AI threats including goal hijacking, tool misuse, privilege abuse, supply chain compromise, unsafe code execution, memory poisoning, inter-agent spoofing, cascading failures, trust exploitation, and rogue agents.

Chain SSRF when the LLM has a fetch_url tool that can reach internal endpoints like cloud metadata services. Chain XSS when LLM output renders as markdown or HTML, allowing injected image tags to exfiltrate session data to attacker servers.