LLM features
Instructions in user content steer the model
Text inside a document, message or web page the model reads changes what the model does.
TermsLLM feature (a product feature that calls a large language model, such as an assistant or a summariser) · golden set (a fixed list of model inputs with recorded expectations, re-run on every model or prompt change) · fault injection (making a dependency fail on purpose in staging to see what the user and the logs show)
criticalseverity if found in a releasesources verified 2026-09-21
Why AI-assisted code produces it
OWASP ranks prompt injection first (LLM01) in 2025. Retrieval and summarisation features concatenate untrusted text into the prompt by construction.
The OWASP Top 10 for LLM Applications 2025 lists prompt injection (LLM01), sensitive information disclosure (LLM02), improper output handling (LLM05), excessive agency (LLM06), system prompt leakage (LLM07) and unbounded consumption (LLM10) among the ten risks.
Source: OWASP GenAI Security Project, 2025-03-12 · verified 2026-09-21
How we detect it
Place instruction text in every input the model reads and observe outputs and tool calls.
Most associated with
Tools: Cursor, GitHub Copilot, Claude Code, Windsurf, Lovable, Bolt
Checklist items that catch it
User content cannot trigger tool actions without checks
manual Place instruction text in every user-controlled input the model reads (messages, documents, page titles, retrieved records) and observe tool calls.
No tool action executes from injected instructions; every tool call passes the same authorization as a direct request.
Dots: Starter, Growth, Scale. The item runs on every release for the plans marked.
Check your codebase for this pattern
The coverage audit lists which catalogue patterns apply to your critical flows. 5 business days, $1,200, credited to a first month.