LLMjacking: Software engineer report
Expanded web report · Related PDF snapshot: 22 October 2026 · PDF page 11
Research reviewed 22 October 2026 · Evidence and editorial planning guidance are distinguished below.
Produce evidence that the control works
Enforce resource and action limits before expensive inference or tool execution. Treat output and retrieved content as untrusted. A model instruction to be safe cannot replace access checks, timeouts or cancellation of abandoned requests.
Your immediate priorities
- Test rejection before provider calls for unauthenticated, oversized and over-budget requests.
- Bound retries, runtime and output, and verify cancellation and denied tool operations.
How to work through the decision
Work in the approved environment and keep secrets out of tickets, logs and chat. Record the artifact or configuration being tested, the expected behavior and the observed result. Test rejection of unauthorized access alongside successful business behavior. Preserve enough evidence for another person to review the conclusion, while minimizing sensitive data. A passing smoke test is one observation, not proof that every exposure path has been eliminated.
Evidence to ask for
Regression evidence showing limits hold without relying on the model to refuse.
Can a request spend money or invoke a tool before its authorisation and budget checks finish?
Work with the next person
Return a reproducible verification record to the technical manager, including untested paths and assumptions. Identify the operational owner of any follow-up test that cannot run during the immediate change window.
Continue with the technical manager report for this topic.
A scenario to rehearse
Illustrative exercise, not an observed customer incident: An internal demonstration endpoint is shared publicly and begins generating provider charges overnight. The exercise measures whether usage alerts lead to a verified shutdown before the next billing review.
What a useful outcome looks like
Regression evidence showing limits hold without relying on the model to refuse. Keep the decision dated and return to it if new evidence changes the scope.