AI System Threat Model Prompt

Act as a security engineer specialising in AI systems. Threat-model the system below.

Return:
1. ASSETS — what an attacker would want, ranked.
2. ENTRY POINTS — every place untrusted content can reach the model, including retrieved documents and tool output.
3. ATTACKS — for each: injection path, what the model would be made to do, blast radius.
4. CONTROLS — architectural mitigations only. Explicitly reject prompt-based mitigations.
5. RESIDUAL RISK — what remains after the controls, and who accepts it.
6. DETECTION — logs, metrics and alerts that would reveal the attack in progress.

System: {{SYSTEM}}
Tools available to the model: {{TOOLS}}
Data it can reach: {{DATA}}
Users: {{USERS}}

1. ASSETS — customer PII, outbound email capability, refund authority. 2. ENTRY POINTS — ticket body, attached PDFs...

Workflow · Harden an AI System Against Injection and Misuse

Tool Stack · AI Security Stack