Security Weekly Podcast Network (Audio) Security Weekly Podcast Network (Audio)

Understanding Prompt Injection In Order to Contain It - Julie Brunias - ASW #401

Sep 22, 2026 · 1h 0m

Summary

In this episode of Application Security Weekly, hosts Mike Shima, John Kinsella, and Tyler Shields discuss prompt injection with guest Julie Brunius, an AI security architect. They explore how natural language vulnerabilities differ from traditional code injection and why securing all data ingested by AI agents is critical. The conversation covers mitigation strategies, including LLM gateways, output filtering, and deterministic controls, while emphasizing that prompt injection remains an unsolvable problem requiring layered defenses.

Topics discussed

Intro: Evolution of injection attacks from SQL to Prompt Guest introductions and HTTP status code theme Defining prompt injection and its dual nature Techniques: Direct, role-play, and encoding styles The challenge of securing natural language inputs Why parameterization fails for LLM prompts The impossibility of securing all ingested data Attack surface: Images, emails, and external systems Example: Injecting instructions into a resume Consequences: Data corruption and permission abuse Varying impacts based on LLM tool permissions Open source risks and the need for sanitization Layered security and zero trust in enterprises Trusted apps and drift lockdown strategies Countering injection: LLM intent detection Monitoring outputs and multi-session correlation EDR tools detecting malicious prompt patterns Third-party vectors: HTML, email, and documents The need for deterministic security controls LLM and MCP gateways for API call monitoring Adversary behavior: Deterrence and delayed attacks Information disclosure and user-facing leaks Frustration: Is prompt injection solvable? The limits of semantic detection by LLMs Daisy chaining and the cost of LLM validation Doctrine: Never let the last defense be a guess Classic non-LLM security controls and service accounts Process, governance, and data classification Identity tracking and agent permission borrowing Open source tools: MCP Shield and whitelisting LightLLM and the need for proper pipelines AppSec introspection: The difficulty of asset lists Data sensitivity classification challenges Automated classification and data alignment Julie's 3-word summary: Do not trust Sponsor break: GuardSquare mobile security Return to show: News of the week Anthropic alignment assessment of cyber incidents Agent uploading malicious PyPI packages Cynical take: Security vendors as honeypots Living in a glass house with tin panes Agent decision paths and lack of guardrails The impossibility of enumerating all bad actions The 'write secure code' prompt paradox Context window economics and alignment traps Architectural separation of code and data Measuring LLM coding quality vs security VMware breach: Cost of rebuilding systems Empty vs null key logic bypass Artifactory vulns and Hugging Face hack Wiz article: Auth bypasses in LightLLM Anthropic Glasswing: 26,000 findings report Signal vs noise: Exploitable vs quality bugs Open source vs corporate access to Glasswing The funnel: From findings to active exploits Holistic risk mitigation vs fixing every line Consumer vs enterprise perspective on bugs Balancing offensive security and detection Machine speed vs immovable firewall controls Defenders in space: Reducing attack surface Hugging Face probes: Need for automated monitoring Proactive activities and leading indicators Refactoring parsing into Rust for safety Benchmarking: Comparison vs ideal baseline Management metrics for security teams Removing weasel words for real data points Outrunning peers vs outcome-based metrics Shifting from bug ops to architecture Open source vs commercial tools for data sets Closing remarks and call to action
Listen ad-free on Castria

Episode summaries and topics are generated from the audio by Castria — a free podcast app that skips ads automatically. IP Geolocation by DB-IP