The Context Guard blog
Field notes from defending production LLM applications - prompt injection, context poisoning, OWASP LLM Top 10 coverage, and the engineering behind the proxy.
Featured · Threat researchAI Agent Swarm Attacks: How Coordinated Multi-Agent Exploitation Bypasses Every Safety Layer
Swarm attacks spawn sub-agents to bypass safety filters. Subagent memory inheritance plants malicious rules in child agents as authorized directives. SkillCloak hides exfiltration payloads inside helpful skill descriptions. Skill compliance hijacking frames data theft as mandatory operational protocol. Evidence-grounding defects trick agents into trusting forged logs that claim safety controls are disabled. Five attack families, documented in 2026 academic research and production detection rules, exploit the trust boundaries between agents, between skills, and between an agent and its environment. Here are the attacks, the payloads, and the six-layer defense architecture.
All posts
Agent Interface Hijacking: How Attackers Turn Login Forms, IDE Configs, Permission Dialogs, and Approval Workflows Into Attack Vectors
Five new attack families target the interfaces AI agents interact with, not the model itself. LoginTrap phishes credentials from browsing agents through fake authentication forms. IDE workspace config manipulation injects persistent backdoors into coding agents. GUI permission dialogs get clicked by invisible hands. State-semantic injection fabricates deployment approvals. Fabricated approval precedent plants false authorization histories in agent memory. Each attack exploits a trust surface that prompt injection filters were never designed to inspect. Here are the attacks, the payloads, and the five-layer defense architecture.
AI Coding Assistant Supply Chain Attacks: ChainDrop, SessionStart Hooks, and the Five Attack Vectors Targeting Your Developer Machine
The ChainDrop npm worm uses preinstall scripts to maintain persistence across installs and editor sessions. Claude Code SessionStart hooks execute attacker code every time you open a project. VS Code tasks.json runs malicious commands on folder open. Slopsquatting attacks trick AI assistants into installing hallucinated packages. These five attack vectors target the developer tools themselves, not the code they produce. Here are the real payloads, the detection rules, and the three-layer defense architecture that stops them.
Ghostjacking: How Attackers Poison Observability Logs to Hijack AI Agents
The Ghostjacking attack, demonstrated at DEF CON 34 with a 90% success rate against Claude Code, poisons Cloudflare WAF logs, Datadog alerts, Sentry error reports, and Grafana dashboards to inject malicious instructions that AI agents treat as trusted operational data. The attack exploits the trust agents place in infrastructure logs and bypasses every prompt injection filter because the injection vector is observability, not content. Here are the four attack paths, the real research behind them, and the five-layer defense architecture that stops poisoned logs from becoming agent directives.
IDOR and BOLA in LLM Platforms: The Most Common Vulnerability Nobody Is Talking About
Open WebUI has 29 security advisories in 2026. More than half are IDOR or unauthorized access. Flowise, Langflow, and a dozen other platforms show the same pattern. Attackers change a UUID in a URL and read another tenant's chats, exfiltrate their knowledge base, steal their API credentials, or manipulate their agents. This is not a prompt injection problem. It is an API authorization problem. This post maps the five IDOR attack classes in LLM platforms, walks through the real CVEs, and explains the five-layer defense architecture that closes the gaps.
AI Hallucination in Production Systems: The Six Classes You Are Not Detecting
Hallucinations are the costliest LLM failures in production: fabricated citations, false customer balances, system prompt extraction. Most teams scan only the user-facing output and never inspect the full prompt as the model sees it. This post maps the six hallucination classes observed in production traffic, walks through the detection architecture that catches them before they reach users, and gives a ten-point checklist for shipping reliable LLM systems.
Oracle Poisoning: How False Knowledge Turns AI Agents Into Confidently Wrong Operators
Oracle Poisoning against production knowledge graphs and Poisoned Playbooks against security write-ups showed the same 2026 pattern: AI agents can reason correctly from false retrieved facts and still take harmful actions. Here are the four oracle poisoning attack families, the Verification Boundary model, and the five-layer defense architecture that stops poisoned knowledge from becoming authoritative action.
MCP Vulnerability Explosion: 84 CVEs, 147 Detection Rules, and Eight Attack Classes That Every AI Infrastructure Team Needs to Know
The Model Context Protocol was designed for interoperability, not security. 84 CVEs, 16 GHSA advisories, and 147 detection rules later, MCP servers are being deployed into production with unauthenticated endpoints, default-empty secrets, and shell-injection-prone STDIO configurations. Remote code execution through environment variable injection, SSRF via DNS rebinding, session hijacking through unverified principals, path traversal through tool parameters, and credential exfiltration through link unfurling are not hypothetical. They are disclosed, they are being exploited, and they are in your infrastructure. Here are the eight vulnerability classes, the real CVEs, and the five-layer defense architecture that stops them.
Context Window Overflow: How Attackers Drown Your Safety Instructions in Noise
Repetition flooding pushes system prompts past the truncation boundary. Token stuffing buries malicious instructions in 90,000 tokens of irrelevant content. Attention dilution makes safety instructions statistically invisible. Multi-channel overflow distributes the flood across RAG, tools, and memory so no single channel looks suspicious. Here are the five context overflow techniques hitting production LLM applications in 2026, the detection rules that catch them, and the three-layer defense architecture that keeps your safety instructions intact.
LLM Output Manipulation: How Attackers Control What Your AI Says
Content injection, response modification, promotional embeds, phishing links, encoded exfiltration, and language switching are six attack families that manipulate LLM output rather than stealing data through it. Input-side defenses miss these because the input looks clean. Here are the detection rules, the research behind them, and the three-layer defense architecture that catches output manipulation before it reaches the user.
LLM Rendering Attacks: XSS, DoS, SSRF, and Code Injection Below the Model Layer
The most damaging attacks on AI applications in 2026 do not target the model. DOMPurify custom element bypasses, Mistune quadratic parsing DoS, vLLM M-RoPE crashes, DNS rebinding SSRF, empty HMAC key authentication bypass, CORS wildcard with credentials, template migration RCE, and guardrail fail-open are seven vulnerability classes that exploit the application layer around the LLM. Prompt injection defenses catch what goes into the model. These attacks go around it. Backed by 40+ disclosed CVEs and GHSA advisories, here are the seven attack families and the five-layer defense architecture that closes the gaps.
LLM Tool Result Injection: How Poisoned Tool Outputs Hijack AI Agents
SOC log contamination achieves 88.2% attack success rates (arXiv:2607.14493). MCP API response injection hijacks agent behavior. CVE-2026-15746 exposes credentials through LLM-controllable tool parameters. The prefill jailbreak (arXiv:2607.14147) shows why tool result attacks bypass refusal. Here are the four attack families, the research behind them, and the five-layer defense architecture that stops poisoned tool outputs.
Guardrail Reconnaissance: How Attackers Map Your LLM Defenses Before They Bypass Them
The most dangerous attack is not the one that breaks through your guardrail. It is the one that maps your defenses first, learns exactly what they block, and then crafts a surgical bypass. Research from Refusal and kNNGuard proved guardrail recon works at scale. Here are the five reconnaissance techniques we see in production, the detection rules that catch them, and the defense architecture that makes recon irrelevant.
AI Coding Agent Attacks: How Developer Tools Became the New Attack Surface
Seven CVEs in one week target AI coding agents through repository name injection, shell bypass, path traversal, markdown exfiltration, and SQL injection. Here are the six attack classes, the real vulnerabilities, and the defense architecture that stops them.
LLM Social Engineering: Authority Impersonation, Fabricated Consensus, and Trust Exploitation Against AI Systems
LLMs are trained to be helpful, respect authority, and follow instructions. Attackers exploit all three. Authority impersonation, fabricated consensus, trust manipulation, and authorization bypass are four social engineering attack families that bypass technical defenses by exploiting how LLMs make trust decisions. Backed by TensorTrust, PCAP, and Byzantine adversary research, here are 27 detection patterns and the defense architecture that stops social engineering against production LLMs.
Prompt Fuzzing at Scale: How Automated Attack Campaigns Target Production LLM Applications
Encoding mutation chains, multilingual fuzzing, output coercion, multi-turn campaigns, context injection across channels, and tool abuse at scale are the seven attack chains we see in production fuzzing campaigns. Here is how each one works, why 1,085 rules are necessary but not sufficient, and the decode-detect-judge pipeline that stops automated attacks before they find a gap.
LLM Tool Abuse Attacks: Shell Injection, SSRF, Credential Theft, and 252 Other Ways Your Agent Can Be Turned Against You
AI agents call tools on your behalf. When an attacker controls the arguments, the agent becomes a weapon aimed at your infrastructure. Tool abuse is the largest attack category in production LLM deployments with 252 detection rules covering shell injection, SQL injection, path traversal, SSRF, credential harvesting, sandbox escapes, MCP exploitation, deserialization RCE, and mass assignment. Here are the nine attack families, the real payloads, and the four-layer defense architecture that stops tool-call attacks before they execute.
LLM Authentication Attacks: OAuth Token Theft, Session Hijacking, and Identity Bypass in AI Platforms
OAuth token replay, CSRF bypass, scope escalation, IDOR in agent workspaces, and cross-user identity hijacking are the authentication attack classes that compromise AI platforms at the identity layer. The model is the entry point; the identity system is the prize. Backed by disclosed vulnerabilities in MCP OAuth flows, Langflow IDOR, and Open WebUI authorization bypasses, here is the full threat map and the defense architecture that closes the gaps.
Email and Communication Channel Injection: How Attackers Hijack AI Assistants Through Slack, Email, and Shared Docs
CVE-2026-33654, CVE-2025-32711 (EchoLeak), CVE-2025-46059, and GitHub comment hijacking demonstrate that email bodies, HTML hidden content, AGENTS.md files, and Slack messages are all live injection channels. The attacker never touches the user prompt. Here are the six attack vectors, the CVEs behind them, and the defense architecture that secures every channel.
LLM Sandbox Escapes: How AI Agents Break Out of Containment
From unsandboxed Python execution disguised as isolation, to Docker socket privilege escalation, to managed identity token theft from cloud MCP servers, sandbox escapes in LLM agents are well-documented and growing. Here are the six attack families, the CVEs that prove them real, and the defense architecture that stops them.
LLM Platform Vulnerabilities: IDOR, BOLA, GPU Leaks, and the Seven Attack Classes That Bypass Prompt Security
IDOR, BOLA, GPU memory leaks, OAuth bypass, postMessage confirmation bypass, decompression bombs, and metadata manipulation are seven platform-level vulnerability classes that no prompt injection filter will catch. Backed by 30+ real security advisories from Open WebUI, vLLM, and Langflow, here is the full threat map and the defense architecture that closes the gaps.
Conditional Trigger Attacks: How Delayed-Action Injections Bypass Every Filter
Conditional trigger attacks plant dormant instructions in an LLM's context that only activate when a future condition is met. The attack is invisible to single-request inspection, and the breach request is clean. Here are the five attack patterns, the two detection rules that catch them, and the defense architecture that stops time-bomb injections before they fire.
MCP Supply Chain Attacks: 30 CVEs, Rug Pulls, and the Trust Model That Broke
Thirty CVEs in 60 days, the first malicious MCP server hitting 300 organizations, and a design-level RCE baked into Anthropic's SDK. The MCP supply chain is under active attack. Here is the full incident map and the defense architecture that stops it.
Agentic Web Attacks: How Attackers Exploit AI Browsers That Browse the Internet
AI agents that browse the web are under active attack. Hidden instructions in web pages, browser manipulation, UI deception, credential harvesting, data exfiltration through forms, and MCP tool hijacking are six attack classes that exploit the trust agents place in web content. Backed by the WAAA research and production attack patterns, here is the full threat map and the five-layer defense architecture.
LLM Template Injection: How Template Engines Become Prompt Injection Vectors
Jinja2, Django templates, and Python format strings are the plumbing of every LLM pipeline. When attackers inject template syntax into that plumbing, they bypass every prompt filter and achieve data exfiltration from the application server. CVE-2025-65106 proved it in LangChain. Here are the five attack vectors and the defense architecture that stops them.
LLM Code Execution Attacks: How Sandbox Escapes Turn AI Assistants Into Attack Platforms
Sandbox escapes, pickle deserialization RCE, trust_remote_code execution, MCP server command injection, and self-propagating agent worms are the five code execution attack classes we see in production. Backed by CVEs, GitHub advisories, and published research, here is the full threat map and the defense architecture that stops your AI assistant from becoming an attack platform.
Agent Memory Poisoning: How Attackers Plant Persistent Backdoors in LLM Memory
When an attacker poisons an agent's persistent memory, the compromise survives restarts, persists across sessions, and spreads to child agents through inheritance. Here are the five memory poisoning attack classes we detect in production and the defense architecture that stops poisoned memories from becoming persistent backdoors.
LLM Supply Chain Attacks: How Compromised Models, Plugins, and Dependencies Subvert Your AI Stack
Compromised model weights, malicious MCP servers, template injection, sandbox escapes, SSRF, and framework vulnerabilities give attackers a path into your LLM stack that no prompt filter can close. Here are the six supply chain attack classes we see in production, the CVEs and advisories behind them, and the defense architecture that stops them.
LLM Denial of Service: How Resource Exhaustion Attacks Drain Your AI Budget
LoopTrap termination poisoning, ThinkTrap infinite reasoning, RECUR recursive reflection abuse, and tool-chain cost amplification are four distinct attack classes that exploit the fact that LLMs keep working if nobody tells them to stop. Here is how each one works, why token limits do not help, and the five-layer defense that caps costs before they spiral.
Invisible Prompt Injection: How Hidden Unicode Characters Bypass LLM Security
Zero-width characters, Unicode tag sequences, bidirectional overrides, and homoglyphs let attackers smuggle malicious instructions past every keyword filter and human reviewer. The text you see is not the text the model sees. Here is how each invisible injection technique works and the normalize-decode-detect pipeline that stops them.
System Prompt Leakage: Why Your AI's Hidden Instructions Are Not Hidden
Every LLM application has a system prompt. Most teams treat it as a secret. It is not. System prompt leakage (OWASP LLM07) is one of the most exploited vulnerability classes in production LLM applications, and the extraction techniques range from trivially simple to sophisticated multi-turn probing campaigns. Here is the full threat map, the seven detection rules that catch every extraction method, and why treating your system prompt as a security boundary is a losing strategy.
Multilingual Prompt Injection: How Non-English Attacks Bypass Your Defenses
Most LLM security filters are built for English. But models speak dozens of languages, and attackers use German, Spanish, Korean, and Russian to walk right past English-only defenses. Here is how multilingual injection works and how to build a defense that does not stop at the language border.
LLM Output Exfiltration: How Attackers Steal Data Through Your Model's Response
Markdown images, base64 coercion, cipher output, emoji substitution, and tool-call exfiltration are the seven output-side attack techniques that bypass traditional DLP. Here is how each one works and the multi-layer defense that stops them.
AI Governance Crisis: Why Most Companies Are Deploying AI Without Authority
A deep dive into the governance vacuum behind enterprise AI adoption, from shadow AI and procurement failures to PII leakage, regulatory exposure, and the technical controls companies need before they scale.
CI/CD Pipeline Injection: When Your Build Bot Has an LLM Inside
LLM-powered CI/CD workflows are a new attack surface that traditional pipeline security cannot defend. The Heimdallr research, CVE-2025-65106, and real-world attack patterns show how PR descriptions, commit messages, and template injection can compromise your build pipeline from the inside.
RAG Data Exfiltration: How Attackers Steal Your Knowledge Base
RAG systems give LLMs access to proprietary data. Attackers have figured out how to pull it all out through the model itself. Here is how the LeakDojo attack works, how enumeration probes map your knowledge base, and how to lock it down.
Securing Autonomous AI Agents: Attack Surfaces, Threats, and Defense Patterns
Autonomous AI agents can browse the web, call APIs, and send emails on your behalf. Here are the seven attack classes we see in production and the six-layer defense architecture that stops them.
Why We Built a Hybrid Detection Engine
Per-dataset benchmark results for the Context Guard hybrid pipeline (rules plus ML judge), where each layer wins, the AdvBench ceiling, and why we run both.
MCP Security Attacks: How Attackers Hijack AI Tool Calls in 2026
Three CVEs, multiple GitHub advisories, and growing academic research expose MCP tool hijacking, SSE injection, LoopTrap, and agentic browser attacks. Here is the full threat map and how to defend against it.
AI Security Best Practices for Production LLM Applications
An end-to-end practical guide to shipping production LLM applications safely: input validation, output filtering, agent controls, monitoring, and compliance.
OWASP LLM Top 10 2025: Every Risk Explained with Mitigations
Walk through every item in the OWASP LLM Top 10 with practical mitigations and a coverage map for runtime defense layers.
10 Real Prompt Injection Attacks & How to Stop Them
A practical tour of ten prompt injection techniques observed in production traffic, with payloads and the detection logic that stops each one.
What Is Context Poisoning? The Complete Guide for 2026
Context poisoning is the next-generation cousin of prompt injection. Learn what it is, how it differs, real-world attack scenarios, and how to defend against it.