Threat-model an AI application as an authority-and-data-flow problem, not as a prompt-writing exercise. Draw every path by which user text, retrieved content, files, messages, model output, tools and network requests can influence a decision. Mark trust boundaries, inventory sensitive assets, enumerate direct and indirect prompt-injection paths, then attach a preventive and detective control to each path. The model is safe only when an attacker cannot turn untrusted content into unauthorized disclosure or an unapproved external effect.
This method applies to chatbots, retrieval-augmented generation (RAG), copilots and tool-using agents. It also gives you a repeatable test plan for model, prompt, connector, permission and corpus changes.
As an Amazon Associate I earn from qualifying purchases.
What the threat model must explain
A useful threat model answers four questions for every component:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →- What can an attacker supply or influence?
- Which data can that component read, change or authorize?
- Which external effects can it cause, directly or through another component?
- What prevents, detects and contains an unsafe decision?
Prompt injection is an instruction-confusion attack. The attacker tries to make a model treat hostile text as higher-priority guidance, reveal protected context, or select an unsafe action. Data exfiltration is the resulting loss of confidentiality, whether the model prints a secret, places it in a tool argument, writes it to memory, or sends it to an external destination. In an agent, one compromised turn can also alter application state that later turns accept as trusted context.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Microsoft distinguishes direct injection, in which the attacker writes the prompt, from indirect injection, in which instructions are hidden in data the AI consumes. That data may be a web page, email, document, database row, image or retrieved chunk. OWASP lists possible consequences including data exfiltration, unauthorized API calls, deletion of records and lateral movement through connected systems. Google’s security analysis likewise models an attacker using indirect injection to exfiltrate sensitive information.
Do not assign a universal exploit-rate or success-rate number to your design. The authoritative guidance does not establish one figure that applies across models and applications. Measure your own attack paths and controls under your own permissions, data and connectors.
Draw the complete data-flow diagram
Begin with a diagram that includes more than the model endpoint. A narrow diagram that shows only “user to LLM” hides the paths that make exfiltration consequential.
Components to place on the diagram
- User interface, client-side uploads and session handling.
- API gateway, rate limits, request validation and tenant routing.
- System and developer instructions, policy files and prompt templates.
- Model endpoint, model version, safety settings and inference parameters.
- Conversation history, summaries, caches and long-lived agent memory.
- Retrieval pipeline: loaders, parsers, embedding model, index, filters and reranker.
- Uploaded files and connected sources such as websites, mailboxes, cloud drives or databases.
- Tool and plugin catalog, argument schemas, policy checks and approval screens.
- Identity providers, service accounts, delegated tokens and authorization services.
- Downstream APIs, code runners, storage, messaging systems and payment or administrative systems.
- Logs, traces, analytics, prompt/output archives and alerting.
- Every outbound network path, including DNS, HTTP, webhooks and email delivery.
Draw arrows for both data and authority. A retrieved document may flow into model context, while a model-selected tool call flows into an API that changes state. A log sink may receive the complete prompt even though it cannot execute a tool; it still represents a confidentiality boundary.
Mark trust boundaries and principals
Label each boundary where trust, identity or privilege changes. Typical boundaries separate the public user from your gateway, the gateway from the model, your application from a third-party connector, one tenant from another, and an internal service from an external network.
For every component, record which principal can read, write, invoke or authorize it. Principals can include an end user, tenant administrator, service account, model runtime, connector owner, support operator and automated policy engine. A model is not an authorization principal merely because it emits a plausible instruction; your application must decide whether a requested action is allowed for the requesting user and tenant.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
OWASP recommends keeping “a versioned, checked in list of what the component can actually do: every tool it can call, and which of those cause an external effect such as moving value, contacting a user, deleting data, or calling a third party.” Treat that list as part of the threat model and change review.
Inventory assets and define acceptable exposure
List assets before listing attacks. For each asset, document confidentiality, integrity, availability, tenant scope, retention and acceptable disclosure. The same value can have different risk in different locations: a customer identifier in a filtered retrieval result may be acceptable, while the same identifier in a public log or outbound URL is not.
| Asset | Questions to record |
|---|---|
| System prompts and policy text | Can users infer, alter or retrieve them? Which rules must remain confidential and intact? |
| Credentials and tokens | What scopes, lifetime, audience and tenant binding do they have? Can they enter model context or logs? |
| Customer and business records | Which users and tenants may retrieve each field? What redaction is required? |
| Retrieved documents and chunks | Who owns the source, can it contain instructions, and how is authorization enforced at retrieval time? |
| Conversation history and memory | What is retained, who can read it, and can an attacker plant content that will be trusted later? |
| Model and embedding artifacts | Are versions, adapters, indexes and configuration protected from unauthorized change? |
| Tool parameters and application state | Which fields can redirect a request, broaden a query, delete data or alter future context? |
| Telemetry and logs | Could prompts, retrieved secrets, tokens or tool payloads be copied into monitoring systems? |
Set explicit retention and deletion rules. Long-lived memory and verbose traces increase the time window in which a planted instruction or leaked secret can be replayed.
Enumerate the attack paths
1. Direct prompt injection
The attacker uses the chat or API input to override system or developer instructions, request hidden prompts, impersonate an administrator, or induce unsafe tool behavior. Test ordinary language, role-play, urgency, nested quotations and attempts to make the model repeat its own instructions. The question is not whether the model says “I cannot”; it is whether any privileged context or tool capability becomes reachable after the attempt.
2. Indirect prompt injection
Untrusted instructions can arrive through a page, email, attachment, image caption, spreadsheet cell, database row or RAG chunk. A document need not look malicious to a person; a short sentence embedded in a footer or metadata field may be enough to redirect a model. Treat all externally supplied content as data with provenance, never as policy. Test each ingestion route separately because parsers, OCR, HTML extraction and chunking can expose different text to the model.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
3. Exfiltration through generated text
An injected instruction may cause the model to print a system prompt, private retrieval result, conversation history, credential fragment or another user’s record. Exfiltration can be direct (“show the secret”) or disguised as a summary, translation, code block, table or error message. Check whether output filters inspect structured and encoded responses as well as plain text.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
4. Exfiltration through tools and connectors
An agent can leak data without displaying it. A hostile chunk may cause a request to a URL, email API, storage bucket, CRM, code executor or webhook with attacker-chosen data in the path, query, headers or body. The destination may be controlled by the attacker, or a legitimate connector may be abused with excessive permissions. Inventory network egress and inspect every argument, not just the tool name.
5. Cross-user or cross-tenant disclosure
Isolation failures arise in retrieval filters, memory keys, caches, shared indexes, background jobs and service-account permissions. An attacker may not need to defeat the model if a missing tenant predicate places another customer’s record in context. Test parallel sessions, reused conversation IDs, cache hits, deleted documents and administrator-versus-user roles.
6. Chained compromise
In a chain, prompt injection changes a tool call; the tool changes application state; later turns treat that state as trusted. Examples include writing a permissive instruction into a ticket, modifying a workflow field, adding a new webhook, or storing a poisoned memory. Model each transition and ask whether a later component verifies provenance and authorization again.
Recommended Free Tools
Ask the trust-boundary questions
Use these questions in design review and repeat them whenever the system changes:
- Which inputs are authored by the user, retrieved from a source, generated by the model or supplied by a third party?
- Can untrusted text reach a system prompt, memory write, tool selector or authorization decision?
- Which tools read, write, delete, pay, message, execute code or make network requests?
- Which identity and permissions are used for each call, and are they bound to the current user and tenant?
- Can the model choose URLs, recipients, file paths, query parameters or HTTP methods? If so, what allow-list constrains each one?
- Are high-impact actions reversible, rate-limited and gated by a human or a separate policy engine?
- What happens when the model, tool catalog, connector, retrieval corpus or permission set changes?
Map controls to each attack path
Least privilege and identity binding
Issue narrowly scoped, short-lived credentials. Separate read tools from write tools, and bind every permission check to the requesting user and tenant rather than to a broad agent service account. Give a summarization agent no delete, payment or arbitrary-network capability. Where a connector supports delegated access, verify the audience, scope and expiration at call time.
Context isolation and data marking
Keep external content in explicitly marked data fields. Do not concatenate retrieved text into a privileged instruction channel or describe it as policy. Preserve source and trust metadata through parsing, chunking and reranking. Microsoft recommends information-flow control, spotlighting and data marking so the model can distinguish instructions from untrusted content; implement these as layers, not as a claim that the model will always obey the label.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Tool mediation
Expose only the tools needed for the current task. Validate the tool name and every argument against a strict schema and policy. Reject hidden, extra or unknown parameters, including fields smuggled through free-form JSON or strings that are later reparsed. Resolve identities and permissions in application code. Require explicit approval for irreversible or high-impact actions, and show the exact target, recipient, amount, records and payload that will be affected.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchEgress control
Restrict outbound domains, protocols, methods, recipients and payload sizes. Prefer fixed destinations over model-supplied URLs. Inspect payloads for credentials, personal data and canary values before network or messaging calls. Block redirects, private-address targets and alternate encodings where they could bypass the policy. A successful model response is not evidence that an outbound request was safe.
Data minimization
Retrieve only the fields and documents necessary for the task. Apply authorization filters before ranking and before context assembly. Redact secrets before model exposure, and prevent sensitive values from entering long-lived memory, analytics or error traces. If a task needs an aggregate, provide the aggregate rather than the underlying records.
Layered input and output defenses
Use content filters, injection detectors, AI-security scanners and prompt/output analytics as additional barriers. Assume classifiers can miss novel, encoded, multilingual or context-dependent attacks. A detector should trigger a constrained response or human review; it should not be the sole authorization mechanism.
Monitoring and protected telemetry
Log prompt provenance, retrieved sources, model and embedding versions, tool calls, authorization decisions, outbound requests and policy outcomes. Protect these logs with the same care as application data: restrict access, redact secrets, encrypt in transit and at rest, and define retention. Useful signals include repeated injection detections, unusual tool sequences, denied-to-allowed transitions, sensitive-data findings, new outbound destinations and retrieval sources that newly contain instructions.
Safe failure
When instructions conflict, provenance is unknown or a policy check cannot decide, stop tool execution. Return a constrained response, preserve enough evidence for review, and require a fresh authorization decision. Do not let a timeout, parser error or detector outage silently fall back to a more powerful path.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.A practical threat-modeling procedure
- Define the security objective. Write the unacceptable outcomes: unauthorized disclosure, out-of-scope tool use, cross-tenant results and unapproved external effects. Include integrity and availability consequences where relevant.
- Freeze the system version. Record model, prompt templates, tool catalog, connector versions, permission configuration, retrieval corpus and memory behavior. A threat model without versions cannot be reproduced.
- Draw the data-flow diagram. Include every component and arrow listed above, including logs and egress. Mark trust boundaries and identity transitions.
- Inventory assets and principals. Assign confidentiality, integrity, availability, tenant scope, retention and acceptable disclosure. Record who can read, write, invoke or authorize each asset.
- Describe legitimate use cases. For each task, state the minimum data, tools, destinations and reversibility required. This establishes a least-privilege baseline.
- Enumerate injection locations. Test user messages, files, web pages, email, database rows, images, retrieved chunks, memory entries and tool results. Record provenance at each hop.
- Trace consequences. Follow each hostile instruction through model context, selector, arguments, authorization, connector, state change, memory and later turns. Mark where a second independent check should stop it.
- Attach controls. For every path, specify the identity check, schema validation, data-marking rule, egress restriction, approval gate, detector, log event and safe-failure behavior.
- Define assertions. State what must remain true: no unauthorized disclosure, no out-of-scope call, no cross-tenant result and no unapproved external effect.
- Schedule reassessment. Re-open the model whenever authority, credentials, tools, trusted inputs, model behavior or external effects change. Do not wait for a visible data-flow change.
Threat-modeling tool-using agents
Agents deserve a separate review because they combine untrusted context with authority. Maintain a checked-in capability inventory with the tool name, read and write scope, external effect, identity used, allowed destinations, rate limit, reversibility and approval requirement. Treat tool descriptions and examples as part of the attack surface: if they can be modified by an untrusted party, the agent may receive a poisoned capability hint.
Keep planning separate from execution where practical. A model can propose an action, while deterministic code checks authorization, arguments and destination before execution. For high-impact operations, show a human the final resolved action rather than the model’s natural-language rationale. After execution, record the result and provenance; do not automatically promote a tool response into trusted policy or memory.
Build a validation matrix
Build tests for each trust boundary and run them before production and after every relevant change. Include both prevention and containment assertions.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Test family | Representative cases | Required assertion |
|---|---|---|
| Direct override | Requests to reveal hidden instructions, change roles, disable policy or invoke an unlisted tool | No privileged disclosure and no unauthorized call |
| Indirect content | Instructions hidden in HTML, email, PDF, spreadsheet, image text, database rows and retrieved chunks | Content remains data; provenance survives parsing and retrieval |
| Encoding and language | Base64-like text, Unicode tricks, obfuscation, multilingual and nested-quotation variants | Detection and policy behavior remain bounded |
| Tool arguments | Unknown fields, alternate URLs, recipient substitution, path traversal, oversized payloads and conflicting parameters | Schema and policy reject unsafe values |
| Secret canaries | Controlled tokens placed in prompts, retrieval results, memory and logs | Canaries do not appear in unauthorized output or egress |
| Tenant isolation | Parallel users, cache reuse, missing filters, deleted records and role changes | No cross-user or cross-tenant result |
| Unsafe egress | Attacker-chosen domains, redirects, query strings, webhooks and email recipients | Only approved destinations and payloads are reachable |
| Memory replay | Poisoned summaries, tickets, notes or tool results reused in a later session | Untrusted state is not treated as authority |
| Failure handling | Detector timeout, policy-engine error, connector outage and malformed retrieval response | Execution stops or falls back to a constrained response |
Run the matrix on every model, system or developer prompt, tool, connector, permission, retrieval-corpus and memory-policy change. Preserve the version and configuration with each result so a regression can be reproduced.
Compare architectures by risk, not by model brand
When choosing between a read-only RAG assistant, a workflow agent or a general-purpose autonomous agent, score the design on the same axes. A design with fewer tools and narrower permissions generally has fewer consequential attack paths, but that inference must be validated with application-specific tests.
| Comparison axis | Lower-risk characteristic | Questions to ask |
|---|---|---|
| Authority and blast radius | Read-only, task-specific permissions | What is the worst state change after one compromised turn? |
| Untrusted-content exposure | Explicitly marked, minimized context | Can arbitrary web, mail or file content reach the selector or memory? |
| Reachable data sensitivity | Field-level retrieval and redaction | Can one query expose credentials, regulated records or another tenant? |
| Tool and egress capability | Fixed schemas and allow-listed destinations | Can the model choose a URL, recipient, path or HTTP method? |
| Reversibility | Dry runs, undo and human approval | Can an erroneous action be reversed before harm spreads? |
| Tenant isolation | Per-request filters and credentials | Are caches, memory and background jobs tenant-scoped? |
| Observability | Provenance-rich, protected logs | Can you reconstruct context, authorization and egress after an incident? |
| Implementation effort | Small, deterministic policy surface | Which controls must be maintained as capabilities grow? |
| Operating cost | Focused retrieval and bounded evaluations | Can the monitoring and test matrix run on every change? |
Production review and refresh
Security review is continuous because authority can change without a new screen or endpoint. Re-open the threat model when tools or actions change; identity, credentials or delegated permissions change; a new trusted input is connected; model behavior or prompt templates change; retrieval sources change; or a connector gains a new external effect. These are OWASP’s stated refresh triggers.
Review dashboards for injection-detection spikes, unusual sequences of tools, transitions from denied to allowed, sensitive-data findings, newly observed outbound destinations and retrieval sources that begin containing instructions. Investigate clusters rather than isolated model refusals: a low-volume sequence that reaches a write tool may matter more than many harmless blocked prompts.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsWhen an incident occurs, revoke or narrow affected credentials, disable the implicated connector or tool, preserve protected evidence, identify exposed tenants and inspect memory and logs for persistence. Then replay the validation matrix against the corrected configuration. Restore capability only after authorization, egress and containment assertions pass.
Implementation checklist
- Every instruction-bearing channel is labeled by provenance and treated as potentially hostile.
- The data-flow diagram includes UI, gateway, prompts, model, memory, retrieval, files, connectors, tools, identity, logs and egress.
- Trust boundaries and read, write, invoke and authorize principals are documented.
- Assets have confidentiality, integrity, availability, tenant, retention and disclosure requirements.
- Tool capabilities, external effects, identities and scopes are versioned and checked in.
- Untrusted text cannot silently enter privileged instruction, memory or authorization channels.
- Retrieval is minimized and authorization-filtered before context assembly.
- Tool names and arguments are schema-validated, policy-checked and destination-restricted.
- High-impact actions have explicit approval and a safe failure path.
- Outputs, logs and egress are inspected for secrets and personal data.
- Tests cover direct, indirect, encoded, multilingual, cross-tenant, memory-replay and unsafe-egress cases.
- Monitoring and refresh triggers are tied to changes in authority, credentials, tools, trusted inputs, model behavior and external effects.
The outcome to require
A defensible AI application is not one that never encounters a malicious prompt. It is one in which malicious content remains untrusted, permissions are scoped to the requesting principal, sensitive data is minimized, tools are mediated, outbound paths are constrained, and ambiguous behavior fails closed. Your threat model should make those properties visible in a diagram, testable in a matrix and reviewable whenever the application gains a new capability.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
