Notifications
Clear all
Topic starter
18/08/2026 2:18 pm
TL;DR: Testing 1,000-plus payloads against GPT-5, Gemini 2.5 Flash, Claude Sonnet 4 and Llama 4 Maverick found persistent weakness in prompt injection, input leakage and over-reliance scenarios, according to Pangea. The results show that model resilience varies sharply, and that governance must move beyond generic safety claims to measurable control failure.
NHIMG editorial — based on content published by Pangea: LLM attack surface testing across GPT-5, Gemini 2.5 Flash, Claude Sonnet 4, and Llama 4 Maverick
By the numbers:
- Llama 4 Maverick recorded 76% fail rates for both over-reliance on AI and explainability and interpretability, indicating broad weakness in those scenarios.
- GPT-5's prompt injection fail rate was 4%, while indirect prompt injection was 6%, showing that even stronger models still need external controls.
Questions worth separating out
Q: What breaks when prompt injection defenses are not in place for LLMs?
A: When prompt injection defenses are weak, attacker-controlled text can override the model's intended instructions, especially when the text arrives through retrieved content or external documents.
Q: Why does clean core matter for identity and access governance?
A: Clean core matters because it changes where controls can live.
Q: How do security teams know whether an LLM is operating safely?
A: Look for evidence that the model’s read scope, tool scope, and output handling are all bounded and reviewed.
Practitioner guidance
- Test against adversarial prompt classes Run red-team scenarios that cover direct prompt injection, indirect prompt injection, input leakage, and over-reliance cases before any production rollout.
- Remove secrets from model context Review every LLM integration for secrets, tokens, internal prompts, and privileged business data that are being passed into the context window.
- Gate AI outputs before they affect access Require human approval or policy validation for any AI output that can influence identity decisions, privilege changes, ticket closure, or workflow execution.
What's in the full report
Pangea's full research covers the operational detail this post intentionally leaves for the source:
- Raw test results by model and attack category for teams that want to compare failure patterns directly.
- Judge LLM methodology and scoring notes for practitioners assessing how the fail rates were derived.
- Category-by-category discussion of specific OWASP AITG-APP scenarios and where each model struggled most.
- Repository access for the underlying results data, useful for internal validation or reproduction.
👉 Read Pangea's analysis of LLM attack surface testing across four models →
LLM attack testing: are prompt injection defenses keeping up?
Explore further
18/08/2026 3:11 pm
Prompt injection is now an access-control problem, not just a content-safety problem. Once a model can be steered through untrusted text or indirect context, the issue becomes enforcement of boundaries between trusted policy and attacker-supplied instructions. That is why LLM security has to sit alongside IAM, PAM, and data governance, not only inside model tuning. Practitioners need to treat instruction paths as controlled surfaces, not as advisory text.
A question worth separating out:
Q: Who is accountable when an AI system makes a harmful decision?
A: Accountability should follow the identity chain that authorized, configured, or triggered the action, including the human owner, the platform team, and any delegated agent or tool account. If the organisation cannot name that chain, the governance model is too weak for regulated AI use.
👉 Read our full editorial: LLM attack testing shows prompt injection still breaks model guardrails
