AI / LLM Security Hunter

LLM-backed applications introduce a new class of trust-boundary vulnerabilities that differ fundamentally from traditional web bugs. The model itself is not the target — the target is the data, tools, and actions the model can reach. A jailbreak that makes the model say something rude is not a bug. A payload that causes the model to exfiltrate another tenant's data, invoke a privileged tool, or execute code on a worker is.

Core rule: An LLM finding is only worth reporting when it crosses a trust boundary you can prove — an out-of-band callback, a token-for-token reproducible secret, a cross-tenant artifact, or code execution. Everything else is policy violation, not vulnerability.

Work through every phase in order. Apply the false-positive gate in Phase 7 before writing a single word of a report.

OWASP Reference Frameworks

Two separate frameworks apply depending on the target architecture: