5 LLM Security Threats- The Future of Hacking?

Large language models are vulnerable to attacks that manipulate what they follow—especially when prompts can be smuggled through websites, images, or encoded text. Prompt injection is the clearest example: attackers craft inputs that cause an LLM to ignore earlier instructions and instead follow hidden directives, potentially exposing sensitive data, bypassing content filters, or triggering unintended actions.

One demonstration used a normal-looking webpage that contained an instruction hidden in the page content. When the site was scraped, the hidden instruction became visible to the model, telling it to output a specific message (“you are on a private website leave now”). The key risk isn’t the message itself; it’s the mechanism—scraping can surface attacker-controlled instructions embedded in headers, metadata, or other “invisible” page elements. The same pattern appeared in multimodal settings. An image of a house looked ordinary, but hidden text inside the image instructed the model not to describe the image and instead output a different phrase. In another variant, a blurred instruction inside an image caused a vision-capable model to return an HTML link when asked to process the image. That kind of output could be weaponized with malicious URLs (for example, phishing or crypto scams), turning image-based inputs into a delivery channel for harmful instructions.

The transcript also ties prompt injection to real-world search behavior. A classic example attributed to Andrej Karpathy describes how search results can include persuasive “however” style content—complete with a link and urgency—that nudges users toward scams. The underlying lesson is that attacker-controlled text can ride along in web snippets or page descriptions, and LLMs may reproduce it as if it were relevant to the user’s request.

Jailbreaks shift the focus from hidden instructions to bypassing refusal behavior. A jailbreak hijacks the initial prompt so the model generates content it would normally refuse. The transcript distinguishes prompt-level jailbreaks (often requiring more human work and social engineering) from token-level jailbreaks that can be automated by optimizing prompts with special encodings. A replicated example used base64 encoding: a request that would be refused in plain text could be transformed into an encoded string, which the model still interpreted well enough to produce disallowed output. In the demonstration, the encoded prompt ultimately led to the generation of phishing-style email content targeting Bank of America.

Multimodal jailbreaks add another attack surface. The transcript describes research where carefully designed “noise patterns” embedded in an image can cause a model to break and follow harmful instructions. The panda example illustrates how structured noise—imperceptible to humans—can be optimized so the model treats it as a cue, enabling instruction-following that should not occur.

Overall, the message is blunt: as LLMs and multimodal models become more embedded in products and workflows (text, images, and eventually video), attackers gain more ways to smuggle malicious directives. The likely defense will mirror broader cybersecurity: continuous patching, layered controls, and an ongoing arms race between attackers and mitigations.