LLMjacking: Technical exposure and controls
Expanded web report · Related PDF snapshot: 22 October 2026 · PDF page 11
Research reviewed 22 October 2026 · Evidence and editorial planning guidance are distinguished below.
Trace the exposure path
Inventory every model endpoint, its authentication, network exposure, provider credential, resource limits and any tools it can invoke. Include temporary demonstrations and abandoned test deployments.
Build a small evidence map from the initiating dependency to the identities, business data and operations it can reach. Include indirect consumers and scheduled work. An inventory entry describes a possible path; activity logs and other account evidence are needed to establish what happened on that path.
Collect the right evidence
- Audit authentication, public reachability and tool access for each endpoint.
- Test rejection before provider calls for unauthenticated, oversized and over-budget requests.
- Record asset identifiers, artifact or configuration versions, permission scope, evidence dates and the owner of each unresolved question. Do not include secret values.
Control and repair
Restrict unintended public access and suspend suspect credentials through the incident process. Preserve request and usage metadata while avoiding unnecessary retention of sensitive prompt contents.
Enforce authentication and authorisation, bounded requests and concurrency, spend monitoring and server-side tool permissions. Retire endpoints that no longer have a business owner.
Prove the boundary
Test unauthenticated rejection, exhausted-budget behavior and denied tool actions. Verify that the system stops accepting expensive work when the relevant capacity boundary is reached.
Use positive tests for the business function and negative tests for the access that should now be denied. Record which environment was tested and whether it represents production. Do not treat a successful login, clean homepage or healthy infrastructure graph as a substitute for an authorization or integrity test.
Engineering handoff
Regression evidence showing limits hold without relying on the model to refuse.
A control matrix covering identity, request size, concurrency, budget and tool authority.
Acceptance gate
Expose an AI service only when its owner can identify permitted users, bound resource use and interrupt abuse without depending on model cooperation.