Notifications
Clear all
Topic starter
10/06/2026 11:41 pm
TL;DR: LLM security incidents are rising as models move into production, with one source estimate putting AI-related security incidents at 73% of enterprises in the last 12 months, while red teaming is shifting from single-prompt testing to multi-step chained attacks according to ZioSec. That shift means conventional evaluation programmes are no longer enough when agents can combine prompts, tools, and integrations across one attack path.
NHIMG editorial — based on content published by ZioSec: LLM Red Teaming: Evaluations, Attacks, & Deep Chained Methods - Ziosec, Mindgard, Promptfoo Compared
By the numbers:
- 73% of enterprises experienced at least one AI-related security incident within 12 months.
- Organizations that use AI and automation extensively for security experienced average breach costs of $3.84 million, while those that do not use AI saw costs surge to $5.72 million.
Questions worth separating out
Q: How should security teams test LLMs for chained attack paths?
A: Security teams should test the full interaction chain, not just isolated jailbreak prompts.
Q: Why do tool-connected LLMs create governance risk for IAM teams?
A: Tool-connected LLMs create governance risk because they can turn language into action across permissioned systems.
Q: What breaks when organisations rely on single-prompt red teaming alone?
A: Single-prompt red teaming misses cumulative abuse.
Practitioner guidance
- Map model-to-tool authority chains Inventory every place the model can retrieve data, invoke tools, or trigger downstream workflows.
- Test for chained prompt injection Build red-team cases that combine multiple prompts, retrieval inputs, and context updates instead of only single-shot jailbreaks.
- Limit blast radius by design Separate read-only model interactions from state-changing workflows.
What's in the full article
ZioSec's full guide covers the operational detail this post intentionally leaves for the source:
- Side-by-side comparison of Promptfoo, Mindgard, and ZioSec testing approaches for different maturity stages
- Examples of red-team test design for jailbreaks, prompt injection, and chained multi-step exploits
- Workflow guidance for integrating evaluation into CI/CD and agent testing pipelines
- Practical discussion of where offensive AI security fits alongside broader remediation and compliance work
👉 Read ZioSec's guide to LLM red teaming, attacks, and chained methods →
Deep chained LLM attacks: are your red team controls keeping up?
Explore further
12/06/2026 6:00 am
Deep chained LLM abuse exposes a control-plane problem, not just a content-safety problem. Once a model can influence tools, memory, or downstream workflows, the failure mode moves beyond unsafe text generation. The real issue is that decision paths become programmable through language, which means normal application testing underestimates the blast radius. Practitioners should treat model-connected workflows as governed execution surfaces, not chat interfaces.
A few things that frame the scale:
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to the Ultimate Guide to NHIs.
- Also from our research: Only 20% of organisations have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should teams decide when an LLM needs approval before acting?
A: Teams should require approval whenever the model can change state, move data, or trigger an external workflow that cannot be safely reversed. If the action would be sensitive when performed by a human operator or service account, the same standard should apply to the model. Approval gates should follow impact, not prompt length.
👉 Read our full editorial: LLM red teaming for deep chained attacks: what practitioners need
