LLM attack surface

The set of ways a large language model can be manipulated, misused, or chained into other systems. This includes prompt injection, context poisoning, data leakage, tool misuse, and hidden control flows, all of which can turn model interaction into broader security impact.

Expanded Definition

LLM attack surface refers to every place a large language model can be influenced, observed, redirected, or chained into downstream actions. In security terms, that surface extends well beyond the prompt box. It includes system prompts, retrieved documents, conversation history, tool calls, plugin inputs, function outputs, memory stores, and any surrounding application logic that decides what the model can see or do. The term is increasingly used in agentic AI and enterprise integration contexts, where the model is not just generating text but participating in workflows with execution authority.

Definitions vary across vendors, but the strongest guidance is to treat the attack surface as an end to end interaction boundary, not a model-only problem. That aligns with the way OWASP Agentic AI Top 10 and NIST AI Risk Management Framework frame AI risk as a system property, not a model feature. The most common misapplication is assuming only direct prompt injection matters, which occurs when teams ignore retrieved content, tool outputs, and hidden orchestration paths.

Examples and Use Cases

Implementing LLM protections rigorously often introduces latency, workflow friction, and stricter approval steps, requiring organisations to weigh user convenience against the risk of unintended model action.

• Prompt injection in a customer support assistant causes the model to ignore policy and expose internal troubleshooting steps, especially when the assistant can retrieve untrusted web content.
• Context poisoning in a retrieval augmented generation workflow allows malicious or stale documents to shape answers, which is why NIST and OWASP guidance emphasize controlling what enters the context window.
• Tool misuse occurs when an AI agent can send email, update tickets, or trigger code execution without sufficient guardrails, creating a bridge from text generation to operational impact.
• Hidden control flows emerge when a model inherits instructions from system prompts, memory, or chained agents, making the real decision path difficult to inspect after a MITRE ATLAS adversarial AI threat matrix style review.
• Data leakage can happen when a model is exposed to secrets, customer records, or privileged context, especially in environments where AI-orchestrated cyber espionage shows how attackers chain language systems with social engineering and automation.

Why It Matters for Security Teams

For security teams, LLM attack surface is the practical way to think about where AI becomes exploitable, not just inaccurate. It connects directly to identity and privilege because an AI agent that can act on behalf of a user, service account, or workflow inherits that identity’s blast radius. If the model can call tools, access secrets, or read sensitive context, then prompt safety alone is insufficient. Teams need to govern what the model can consume, what it can emit, and what it is allowed to trigger.

This is why the term sits at the intersection of application security, data governance, and non-human identity control. A compromised AI workflow can become a privileged execution path even when the underlying model is functioning as designed. The same logic appears in NIST AI 600-1 Generative AI Profile and the CSA MAESTRO agentic AI threat modeling framework, both of which encourage threat modeling across inputs, outputs, tools, and orchestration. Organisations typically encounter the real consequence only after an assistant leaks data, sends an unauthorized action, or becomes the entry point for abuse, at which point LLM attack surface becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• Why do LLM applications create a larger attack surface than traditional software?
• Why does Agentic AI make NHI attack surface expand so significantly?
• What is the difference between attack surface management and NHI governance?
• Why do NHIs create a larger attack surface than human users?