Module 09 Summary

What this module established

The attacker does not need access to your prompt - they need a document your crawler will index. Marker matching catches the crude version; the real defences are structural: delimit retrieved content, declare it as data, and gate tool execution outside the model.

Carry forward

• Audit every path data can leave by. Caches, traces, logs, error messages and model-composed URLs are all exfiltration paths built by people solving other problems.
• Most harm comes from reasonable misuse, not attacks. State scope in the interface and make refusals redirect.
• Report what you did not test and what you accept. Those two sections are what distinguish a finding from a reassurance.

Before moving on

Move on when the injection test has been run against an indexed document, all six exfiltration paths are checked, and your report has all four sections.

Mark complete