Bradley Cassada

Red-teaming LLMs & AI agents @Mindgard. Prompt injection, jailbreaks, agentic kill chains — how AI breaks & how to stop it. Offensive security for AI.

[Bradley Cassada @bcassada]

I red-team AI for a living. Prompt injections, jailbreaks, agents tricked into doing things they shouldn't. This account is where I'll share how AI systems actually break — and how to stop it.

[Bradley Cassada @bcassada]

Your AI gateway: one proxy for all your models, and one handy door for attackers. Let them command-inject LiteLLM, now on CISA's exploited list. Centralize traffic, centralize the headache.
https://t.co/v2Uh9hqy5E
#AISecurity #PromptInjection #LLMSecurity

[Bradley Cassada @bcassada]

Prompt-to-RCE: when an agent can run code, a prompt injection becomes remote code execution.

CVE-2026-26030 turned one crafted prompt into a shell. It can execute... whats the defense?
https://t.co/wzrH8tuhRC
#AISecurity #PromptInjection #LLMSecurity

[Bradley Cassada @bcassada]

The Lethal Trifecta: private data + untrusted content + an outbound channel in one agent.
Any one is safe; all three let one poisoned page exfiltrate your secrets. Design to break the Trifecta... not out prompt the flaw.
https://t.co/VLpakEIG0n
#AISecurity #PromptInjection #LLMSecurity

[Bradley Cassada @bcassada]

Allowlist bypass via shell built-ins: Cursor checked external commands but not built-ins. CVE-2026-22708 let prompt injection poison PATH so "git" ran attacker code.
https://t.co/ZvhmLEWg11
#AISecurity #PromptInjection #LLMSecurity

[Bradley Cassada @bcassada]

Data poisoning is the AI attack that doesn't trip an alarm.

Model trains fine. Passes eval. Ships. Then months later it does something it learned from a poisoned source, at the worst possible moment.

And your training pipeline is just one door. Third-party checkpoints, RAG indexes, public datasets, agent-to-agent. Every one's a way in.

Mindgard's guide on it: https://t.co/tinscWk0Ma

#LLMSecurity

[Bradley Cassada @bcassada]

Parameter-to-Prompt Injection (P2P): the attacker controls a parameter that flows into the prompt. SearchLeak turned one Copilot link into 1-click data theft.
If a value can reach the prompt, treat it as hostile.
https://t.co/8WBFzquWK3
#AISecurity #PromptInjection #LLMSecurity

[Bradley Cassada @bcassada]

None of these were "hacks." People just typed the right words into a live system nobody stress-tested first.
That's the whole job: find the moment in a safe environment...not in a screenshot with 4M views.
#AISecurity #PromptInjection

[Bradley Cassada @bcassada]

Doing some research on chat bots gone wild...
A short thread of chatbots that went very public

[Bradley Cassada @bcassada]

NYC's own MyCity bot told business owners they could take workers' tips and refuse Section 8 tenants.
An official government bot, confidently handing out illegal advice.
https://t.co/dNFrvu80KY

[Bradley Cassada @bcassada]

If you build, secure, or just worry about AI systems — follow along. And reply, push back, ask things. The sharpest conversations in this field happen here.

[Bradley Cassada @bcassada]

I red-team AI for a living. Prompt injections, jailbreaks, agents tricked into doing things they shouldn't. This account is where I'll share how AI systems actually break — and how to stop it.

[Bradley Cassada @bcassada]

Why it matters: most AppSec wasn't built for AI. Agents that plan, call tools, and act turn a single bad output into a real kill chain. That gap is what I work in every day.

[Ohio State Football @OhioStateFB]

.@LtGovJimTressel taking it all in for the Ohio Stadium Ring of Honor Surprise 🌰 🥹

[Bradley Cassada @bcassada]

@rod_bridgers @TriHoopsNet @coachwhitfaye New year… new cast… same ending. He does a great job.

[Bradley Cassada @bcassada]

@NosytLabs @Jpgs_eth @AskVenice Fair point. The question is how does the dashboard reflect tokens being unstaked.