If you are adding an AI assistant, copilot or agent to your product, you have opened an attack surface most security testing never touches. The most common way in is also the simplest: prompt injection.
What it is
A large language model cannot reliably tell the difference between your instructions and the content it is processing. If an attacker can get text in front of the model, a support ticket, a web page it summarises, a document it reads, that text can carry instructions the model may follow.
Why traditional testing misses it
Classic vulnerabilities live in code. Prompt injection lives in language and behaviour. A scanner looking for SQL injection will walk straight past a model that can be talked into leaking its system prompt or calling a tool it should not.
What to do about it
- Treat all model input as untrusted, including content the model retrieves itself.
- Constrain what the model can do, least-privilege for tools, actions and data.
- Separate instructions from data as much as the platform allows.
- Test it like an attacker would, against the OWASP Top 10 for LLM applications.
AI features ship fast. Security has to keep pace, because the failure modes are new even if the lesson, never trust untrusted input, is very old.