BvLogic
Diagram · Red Team

Red Team Attack Surface — Diagram

Where to attack an AI system, drawn as the four entry points and what each one can reach — and why the highest-severity findings are almost never about making the model say something odd.

Download the diagram Read the full guide

SVG. No sign-up, no email.

Red teaming an AI system is usually imagined as trying to make the model misbehave in conversation. That is one entry point of four, and it is the one that produces the least severe findings.

The map below is what to actually attack, and what each route can reach.

Four entry points, and what each can reach Entry points: The conversation (direct prompting), Content it retrieves (documents, pages, tickets), Tool responses (third-party text coming,back), Its own output (rendered, executed, or,queried). What they can reach: Other users' data (retrieval not,permission-filtered), Tools with real effect (send, pay, delete, change), Your own systems (via unescaped output), Spend and rate limits (cost as a denial of,service). Test these deliberately: Same query, two accounts (does A ever see B's data?) → Instruction inside a document () → Output containing markup or SQL () → Loop that never terminates (). Entry points The conversation direct prompting Content it retrieves documents, pages, tickets Tool responses third-party text coming back Its own output rendered, executed, or queried What they can reach Other users' data retrieval not permission-filtered Tools with real effect send, pay, delete, change Your own systems via unescaped output Spend and rate limits cost as a denial of service Test these deliberately Same query, two accounts does A ever see B's data? Instruction inside a document Output containing markup or SQL Loop that never terminates each is a fixed case afterwards Reaches data or action — severe Usually embarrassment, not breach Test with accounts at different entitlements
Shaded routes produce the severe findings — they reach data or actions. The conversational route is the one people test and the one that mostly produces embarrassment rather than breach.

Why the conversational route is the least valuable#

It is the easiest to test, so it absorbs the effort, and it mostly yields findings of the form "I persuaded it to say something the brand would not like".

Those are real and they are reputational, not structural. A bug bounty scoped without care will drown in them — which is why the scope should name what counts: data exposure, privilege escalation, unauthorised actions.

The three routes that produce severe findings#

Content it retrieves. The attacker does not need access to your system at all — they need to put text somewhere your system will read. A document, a ticket they raise, a web page. This is indirect injection, and testing only the user's input misses it entirely.

Tool responses. Text returned from a tool can carry content authored by someone else. It arrives with the same status as anything else in the context.

Its own output. Model output rendered into a page, passed to a shell, or used to build a query is untrusted input. This is an old vulnerability class wearing new clothing, and it is overlooked precisely because the output came from your own system.

The first test in the third lane is the highest severity#

Run the same query as two users with different entitlements. If user A ever receives content only user B should see, that is a data breach rather than a quality issue, and it is one of the most common real findings in systems over internal documents.

It is also deterministic — it has a correct answer, so it can be automated and run forever. Most red-team work needs human judgement; this one does not, which makes it the best value on the page.

Everything found becomes a permanent case#

Once an attack works, encode it. It either reproduces or it does not — no judge model required, no calibration, no ambiguity.

A regression suite built from real attacks is the only part of AI security testing that is both automatable and genuinely trustworthy. See AI Security for why the broader automated version is not.

The lanes have no arrows#

The first two are sets, not sequences: four independent entry points, four things reachable. Any entry point may reach any target depending on your architecture, and drawing arrows between them would imply a fixed mapping that does not exist.

See red teaming for the method, and cyber security for the controls being tested.

Back to Red Team