Include Security Research Blog - Team Research blog

At Include Security we spend a good amount of time extending public techniques and creating new ones. In particular, when we are testing Ruby applications for our clients, we come across scenarios where there are no publicly documented Ruby deserialization...

Summary of Key Points
This is part two of the series of blog posts on prompt injection. In this blog post we go into more depth on the LLM’s internal components to understand how and why prompt injection occurs.
LLM-based AI chatbots have emerged as surprisingly useful tools for professionals and novices alike to get comprehensible, text-based answers to a wide variety of questions. Chatbots receive a prompt from the user to which they respond with the most...

By Abraham Kang, Managing Consultant, Include Security
Summary
Prompt Injection is the Achilles Heel that could bring all LLM apps crashing down from their lofty heights. Therefore, addressing this problem is an important topic worthy of significant focus by LLM application developers....

Guest Post: Neil Jacobs (deals with cyber law stuff)
Many companies engage their pen testing companies through their lawyers, ie, the lawyers themselves actually engage the pentester (and not the client), and the lawyers provide the pen test results to the client usually via a report. The thinking behind...