building-attack-pattern-library-from-cti-reports

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Outsider free text can enter the LLM context via Step 1 “Parse CTI Reports and Extract Behaviors,” where the runtime parse_report(text, ...) consumes CTI report body text (PDF/HTML/text) authored by external vendors/third parties and then propagates extracted sentences into later generated STIX descriptions/templates.