Topic starter
21/08/2026 4:51 pm
TL;DR: Its 2025 red-team findings exposed five LLM weaknesses, including reasoning prompt injection, hidden tool execution, indirect prompt injection, malformed-token image abuse, and email identity spoofing, according to ActiveFence. The wider lesson is that AI apps inherit trust assumptions they cannot verify, so governance must cover model behaviour, tool use, and identity signals together.
Editorial analysis by NHI Mgmt Group, based on content published by ActiveFence: “The 5 Most Shocking LLM Weaknesses We Uncovered in 2025”.
Key questions
Q: How should security teams handle prompt injection in production LLM applications?
A: Security teams should treat prompt injection as a runtime control issue, not a content-moderation problem.
Q: Why do AI assistant platforms create new fraud risks for identity teams?
A: AI assistant platforms can be abused as infrastructure for phishing, impersonation and prompt harvesting.
Q: What do teams get wrong about indirect prompt injection?
A: Teams often treat retrieved documents as safe because they are business content, not code.
Practitioner guidance
- Separate reasoning from user content Prevent user-supplied text from influencing hidden reasoning channels, tool directives, or internal control tags.
- Audit every tool invocation Log the initiating context, the model rationale, and the downstream effect for every external action an AI system takes.
- Validate identity signals outside the model Use SPF, DKIM, DMARC, and related provenance checks before an AI assistant summarises or acts on email content.
Bottom line: ActiveFence’s 2025 red-team findings show that LLM risk is not limited to bad outputs. The deeper issue is that hidden reasoning, tool calls, and trusted-looking content can all be manipulated.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
21/08/2026 5:09 pm
LLM governance now fails at the boundary between instruction, reasoning, and action. ActiveFence’s findings show that many AI controls still assume the model can reliably tell user intent from attacker intent. That assumption breaks once hidden reasoning, indirect prompt injection, or invisible tool calls enter the workflow. Practitioners should treat the AI request path as a governed decision chain, not a single prompt-response exchange.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How do organisations decide when an LLM should be allowed to call external tools?
A: Allow tool use only when the action is consistent with the model’s own controlled reasoning and the request has passed provenance, policy, and context checks. If a tool call is triggered directly by user content or cannot be explained in the execution trace, it should be blocked or reviewed before it reaches production systems.
👉 Read our full editorial: Five LLM weaknesses exposing AI safety and security gaps in 2025