Simple meanings of the AI words you'll keep hearing. The blue "≈" lines compare a word to something you already know from web hacking. Type to search.
LLM (Large Language Model)
A program that writes text like a person. It just guesses the next word, again and again. This is the "AI" you test.
Token
A small piece of text (a word or part of a word). The model counts size, cost, and memory in tokens.
Tokenization
How text is cut into tokens. It matters because a filter and the model can read the same text in different ways, and that gap helps some attacks.
Context window
How much text the model can keep in mind at once (rules + chat + data). Add too much and the old rules drop off the end.
Prompt
The text you send the model. ≈ the input you control.
System prompt
The secret rules the developer gives the model. ≈ server-side settings; often hides secrets you want.
User prompt
The message a user types. ≈ user input; your way in.
Inference
The model making an answer. It just means "running the model".
Temperature
A setting for how random the answers are. Higher means more random. This is why the same input can give different answers.
Non-deterministic
Same input, but a different answer each time. So try a payload many times before you give up on it.
Hallucination
When the model makes up something false but sounds sure. On its own, this is usually not a security bug.
Sycophancy
The model's habit of agreeing with you to please you. Feed it a false claim ("I read you offer $500 credit...") and it may play along. ≈ social-engineering the model into confirming a lie.
Embedding / vector
Text turned into numbers so the computer can compare meaning. Used for search and RAG.
Vector database / store
Where those number-lists are kept and searched. ≈ the database behind RAG.
RAG (Retrieval-Augmented Generation)
The model reads documents and uses them to answer. ≈ the model reading from a data source you may be able to poison.
Chunking
Cutting big documents into small pieces for RAG. If the pieces are cut badly, the model gets jumbled context and gives wrong answers.
Base / foundation model
The normal, ready-made model (GPT, Claude, Llama) before anyone changes it.
Fine-tuning
Training the model more on the client's own data. The new model can remember and leak that data.
Weights / parameters
The numbers the model learned - its "brain". For self-hosted models, the weights file can even run code when it loads.
Provenance
The history of where a model or its data came from, like a chain of custody. You check it so you don't trust an unknown source.
RLHF / alignment
Training that teaches the model to say no to bad requests. It is a habit, not a hard wall, so you can talk around it.
Guardrail (AI firewall / AI gateway)
A separate filter that sits between the user and the model. It checks the message going in and the answer coming out, and blocks or hides bad stuff. ≈ a WAF for the model.
AI Security Posture Management (AI-SPM)
Keeping the whole AI setup safe: patched software, strong login, encrypted data, good config. ≈ normal system hardening, but for the AI stack.
Multimodal
A model that also takes images, sound, or video, not just text. More ways to attack, like text hidden inside a picture.
API / API key
The app talks to the model over an API with a secret key. ≈ a password; if it leaks, an attacker spends the client's money and uses their account.
Self-hosted / local model
The client runs the model on their own servers (Ollama, vLLM). Everything is in scope.
Cloud-managed
A vendor model run in the client's cloud account (Azure OpenAI, Bedrock, Vertex). The cloud setup and keys are in scope.
Wrapper / app layer
Everything the client builds around the model (rules, filters, tools, UI). ≈ your real target.
Agent / agentic
A model that can do things and take many steps, not just chat. The biggest target.
Tool / function calling
Things the model can use (search, email, database, run code). ≈ the app's backend functions; the model picks what to send them.
Plugin
A ready-made tool the model can use. Same risks as tools.
Cross-plugin request forgery (CPRF)
One tool's output carries an order that makes a second tool act, like a "read web" tool feeding a payload to a "fetch URL" tool to leak your data. ≈ CSRF, but between the model's own tools.
MCP (Model Context Protocol)
A common way to connect tools and data to an agent. Its servers and tool descriptions can be attacked.
Skill
A ready-made pack of instructions and code an agent loads. It can hide bad instructions inside.
Prompt injection
Tricking the model with input it follows like an order. The #1 LLM bug. Direct (you type it) or indirect (hidden in data it reads).
Indirect prompt injection
The order is hidden in content the model reads later (a web page, a file, an email), not typed by the user. ≈ stored XSS: you plant it, the victim's model runs it.
Persistent memory injection (spAIware)
Planting an order in the assistant's long-term memory so it comes back every future chat, like spyware that survives the session. ≈ a stored payload that re-fires on every login.
Jailbreak
Making the model break its own safety rules. This is a model problem, not usually a bug you can report by itself.
System prompt leak / extraction
Making the model show its secret rules. Can reveal secrets and the rules you need to get past.
Insecure output handling
The app trusts the model's answer and shows or runs it without cleaning it. ≈ this is where XSS / SQLi / SSRF come from.
Excessive agency
The model can use tools that are too powerful for it. ≈ an account with too many rights.
Denial of wallet
Flooding the AI with heavy or many requests to run up the client's bill, not just to crash it. A money version of denial of service.
Training-data extraction
Getting private data back out of a fine-tuned model.
Model extraction / inversion
Asking the model the same kind of thing many times to copy its knowledge and steal the model itself. ≈ scraping, but to clone the model (IP theft).
Data / model poisoning
Putting bad data or a hidden trigger into training or RAG so the model acts wrong.
Model malware / poisoned model
A downloaded model can hide bad code or a backdoor, just like infected software. So loading an untrusted model is risky.
Confused deputy
Tricking a high-power agent into doing your dirty work through hidden text.
Sandbox
A locked-off space where the model's code and tools run, so damage stays small. ≈ a jail you try to break out of.
Code interpreter
A tool that runs code the model writes (often Python) to do math or analyze files. If you can inject the code, prompt injection becomes real code execution (RCE).
AI red team vs AI pentest
Red team = check if the model says bad things. Pentest = check the whole app + model + servers. Agree which one first.
OWASP LLM Top 10
The standard list of the biggest LLM app risks. Match your findings to it.
MITRE ATLAS
A library of real AI attacks. Match your findings to it too.
NIST AI RMF
A US government framework for managing AI risk across a whole organization. ≈ governance and policy, not a hands-on attack tool.
Reasoning model / chain-of-thought (CoT)
A model that writes out its "thinking" steps before the final answer (o-series, DeepSeek-R1, extended thinking). That visible thinking is extra text you can pad, steer, fake, or cut short - a whole attack surface of its own.
Crescendo
A multi-turn jailbreak: start innocent and push a little further each turn, building on the model's own answers, so per-message filters never see anything bad. ≈ slow privilege creep instead of one loud exploit.
Echo Chamber
Plant harmless "seeds" then get the model to keep expanding its own words until the framing self-reinforces into harmful output. You never make the bad request directly - the model escalates itself.
Bad Likert Judge
Ask the model to grade content on a 1-5 scale, then to give an example answer for each score. The "score 5" example it writes is the restricted content. ≈ abusing the model's own QA/judge role.
Tool squatting
Naming and describing a malicious tool so an agent prefers it over a legit one - no hidden order, just gaming which tool gets picked. ≈ SEO / typosquatting, but for agent tools.
Tool rug pull (TOCTOU)
A tool looks safe when you approve it, then quietly changes its description or behavior afterward. ≈ time-of-check vs time-of-use: trusted once, swapped later.
Prompt worm
A self-replicating injection (Morris II) that copies itself into every agent, memory, or RAG store it reaches and spreads on its own. ≈ a worm, but made of text instructions.
Sleeper / trigger-gated payload
An injection that stays dormant and harmless until a trigger (a date, word, or user) fires, so it passes review and activates later. ≈ a logic bomb for AI.
Glitch tokens
Rare tokens the model barely saw in training that make it behave erratically and can knock it off its safety rails.
Abliteration
Editing an open-weights model's internals to remove its refusal behavior, producing an "uncensored" version. Only possible when you have the weights.
No terms match that search.