How companies get breached today.

Direct prompt injection

A user talks the model out of its instructions and guardrails.

Indirect prompt injection

Instructions hidden in content the model reads, such as a page, a file or an email, take over its goal.

System prompt leakage

The model reveals its instructions, internal notes or the secrets placed in them.

Cross-user data in answers

Answers carry other users’ data, pulled in through retrieval, memory or shared context.

Improper output handling

Model output is rendered or executed without checks, which turns it into XSS, SQL or commands.

Excessive agency

The agent has more tools and permissions than its task needs, so a manipulated agent can do real damage.

Confused deputy

The agent acts with its own privileges on behalf of a user who does not have them.

Memory and context poisoning

Planted content persists in an agent’s memory and steers later sessions.

Code execution through the agent

Code the agent writes or runs escapes the sandbox it was meant to stay in.

Malicious tools and MCP servers

A tool or MCP server the agent trusts carries instructions or behavior it should not.

Insecure agent-to-agent messages

Messages between agents can be spoofed, replayed or read in transit.

Denial of wallet

Requests crafted to make every model call as long and expensive as possible.

BOLA / IDOR

Change an object ID, get someone else’s record, including across tenants.

BFLA

Admin functions reachable with an ordinary user’s session.

Missing authentication

Endpoints that answer without any login at all.

Mass assignment

Fields the user should never set, such as a role or a price, accepted from the request.

Excessive data exposure

Responses carry more fields than the client shows, and the client filters them out.

Credential stuffing and brute force

Leaked passwords and guesses tried at scale, with nothing slowing them down.

Account enumeration

Login, signup or reset responses reveal which accounts exist.

JWT flaws

Unverified signatures, weak secrets, algorithm confusion, tokens that never expire.

OAuth and OIDC flaws

Loose redirect URIs, missing state, accounts linked by an unverified email.

SAML flaws

Signature wrapping and unchecked assertions that let someone sign in as anyone.

Password reset flaws

Reset tokens that can be guessed, reused, or are leaked in the response.

MFA bypass

A second factor that one of the login paths does not ask for.

Session management flaws

Sessions that survive logout, password change or role change, or can be fixed in advance.

SQL injection

Input becomes part of a database query.

NoSQL injection

Operators smuggled into document database queries.

OS command injection

Input reaches a shell on the server.

Server-side template injection

Input is rendered as a template and runs on the server.

Cross-site scripting

Script that runs in another user’s browser: stored, reflected or DOM-based.

XML external entities

XML parsers that fetch files or URLs named in the document.

LDAP injection

Input changes the meaning of a directory query.

Header and CRLF injection

Line breaks in input that add headers or split responses.

Prototype pollution

Input that changes the base objects of a JavaScript application.

Server-side request forgery

The server fetches a URL you choose, including internal and metadata addresses.

Path traversal

File paths that walk out of the folder they should stay in.

Unrestricted file upload

Uploads that execute, overwrite or land where they should not.

Insecure deserialization

Objects rebuilt from data an attacker controls.

HTTP request smuggling

Front end and back end disagree where one request ends and the next begins.

Web cache poisoning

A harmful response gets cached and served to everyone.

Web cache deception

A private page gets cached as if it were public.

Fail-open error handling

An error in a check lets the request through instead of stopping it.

Exposed source and config files

.git folders, .env files and backups served from the web root.

Debug mode in production

Debug consoles, stack traces and test routes left on.

Default credentials

Systems still using the password they shipped with.

Directory listing

Folders that list their own contents.

Verbose error messages

Errors that reveal paths, versions, queries or internals.

Permissive CORS

Other sites may read your API with the user’s session.

Public cloud storage

Buckets readable or listable by anyone.

Missing row-level security

A public database key plus a missing policy is a public database.

Over-permissive cloud roles

Service accounts and keys that can do far more than their job.

Secrets in client code

Keys and tokens shipped to every browser, often through source maps.

Secrets in repos and logs

Credentials in git history, CI output and logs, long after the fix.

Predictable tokens and IDs

Tokens, links or IDs that can be guessed.

Weak transport security

Old TLS, missing HSTS, or plain HTTP where it matters.

Unrestricted resource consumption

No limits on size, rate or cost, so a few requests exhaust the service.

Shadow and zombie APIs

Undocumented and outdated API versions still answering.

Unsafe consumption of third-party APIs

Data from partner APIs trusted more than user input.

GraphQL abuse

Introspection, batching and deep queries left open in production.

Components with known vulnerabilities

Libraries and services running versions with published exploits.

Unsigned webhooks

Incoming events that are accepted without checking who sent them.

Third-party scripts without integrity

Scripts loaded from other hosts that could change at any time.

Cross-site request forgery

Another site makes the user’s browser act on your app.

Clickjacking

Your page framed invisibly so users click what they cannot see.

postMessage abuse

Messages between windows accepted from any origin.

Open redirect

Links on your domain that send users anywhere.