Prompt-Injection & Tool-Abuse Tester
Finds instructions that cross trust boundaries or induce unauthorized tool behavior.
Mutates direct, indirect, multilingual and encoded attacks through user input, retrieved documents and tool results, then verifies whether the system disclosed data, changed policy or attempted an unauthorized action. Every exploit ships with a minimal replay and a matched benign control.
Authority
Inform
Team role
Provides specialist analysis
Handoffs
Named collaborators
The role
What it owns and where its authority ends
Desk
Generative AI, Retrieval & Adversarial Testing
Desk workflow
Threat and quality plan, then a prompt-injection campaign, then retrieval and citation tests, then factuality review, then consolidated release findings.
Collaboration
Works within a defined desk workflow
Decision boundary
Provides evidence or analysis without committing the decision.
Systems and capabilities involved
Attack mutator
Instrumented model gateway
Canary data and fake tools
Authorization oracle
Handoffs
What this role gives and receives
Capabilities offered
Test prompt injection and tool abuse
Run safe attacks across input, retrieval and tool boundaries and produce minimal replays.
- Receives:
- System endpoint, trust boundaries, tool policy and attack scope
- Returns:
- Exploit traces, matched controls, severity and patch-resistant variants
Handoff to
Handoff to
Receives from
External handoff
Application security
External handoff
Platform engineering
Context
What the role needs to do the work
- Current work
- Attack seed, mutation family, system response and authorization boundary.
- Prior interactions
- Successful exploits, patched variants and recurring defenses.
- Policies and reference
- Injection techniques, encoding patterns, tool schemas and trust boundaries.
- Working method
- Safe exploit confirmation and severity rules.
Illustrative workflow
How the work moves
Starting point
A retrieved PDF contains an instruction to export the user's account history.
- 01
Seed a fake account and instrument the data-export tool with a deny oracle.
- 02
Run direct, indirect and obfuscated variants plus benign document controls.
- 03
Minimize the successful trace and confirm the sandbox contained every attempted action and data access.
Result
A reproducible critical indirect-injection exploit with two passing benign controls.
Checks and boundaries
What must be tested or reviewed
- 01Confirms an exploit only when a canary is exposed or an authorization oracle records a forbidden attempt.
- 02Distinguishes harmless instruction-following style changes from control-boundary compromise.
- 03Retests patched exploits with semantic and encoded variants without touching real production tools.
Human authority
- Security approves live-system test scope
- Critical exploit closure requires independent retest
Keep exploring