LLM security research
BadToken HYDRA
Automated LLM red-teaming framework built around one scheduler and one evidence format.
PythongarakPyRITvLLM
In development
All projects
untrusted page content
model output rendered as HTML
Case study / Web and LLM security
WebRedTeam
Extending a browser-based black-box framework to test whether prompt injection can escalate into script execution.
Summarize the reviews on this page.
Reading page content…
<script> rendered in reply
Illustration of the vulnerability class, not a WebRedTeam screenshot
Overview
The problem
Many LLM features live inside web apps: a chat panel that summarizes a page, an assistant that reads reviews or documents. If attacker-controlled content can steer the model, and the app renders the model's output without encoding it, prompt injection becomes cross-site scripting.
Text-only scanners score the model's reply as a string. They can't see what the browser does with it, which is where the actual damage happens.
Threat model
From prompt injection to script execution
- Step 1
Plant
An attacker hides instructions in content the app will later read: a page, a review, a document.
Defense: input sanitization - Step 2
Ingest
The app's model reads that content alongside the user's real request and can't tell the two apart.
Defense: information flow control - Step 3
Emit
Following the hidden instructions, the model's reply carries a script payload.
Defense: output filtering - Step 4
Execute
The app renders the reply as HTML, and the browser runs the script in the user's session.
Defense: output encoding, CSP
Approach
Test through a real browser
WebRedTeam is a browser-based, black-box web testing framework: it interacts with an application the way a user would and observes what actually renders. I'm extending it into the web module of BadToken HYDRA so this attack class runs under the same scheduler and lands in the same evidence format as the garak and PyRIT results.
- Black-box by design: no access to the target's source is assumed, matching how real apps get attacked.
- One evidence format: browser findings sit next to model-level findings from the other HYDRA modules.
- Lab targets only: testing runs against lab-hosted instances, never third-party or production apps.
Development and demos run on my own Ubuntu workstation, with batch runs on the university research cluster.
Status
Where it stands
This work is in progress, and there are no published results yet. It's planned as a research write-up alongside the BadToken weight-editing study.
WebRedTeam isn't one of my own repositories, so I don't link a codebase here; the integration work will be documented with the BadToken repository when it's public.