CompTIA · SecAI+ CY0-001
Attacks on prompts and integrations
SecAI+ CY0-001 · Lesson 10 of 18 · 1:12:52
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the CompTIA SecAI+ CY0-001 exam. In this lesson: direct and indirect prompt injection, jailbreaking, input manipulation, insecure output handling, manipulated application integrations, insecure plug-in design, model denial of service, sensitive information disclosure, excessive agency, and overreliance, with the compensating controls: prompt firewalls, guardrails, prompt templates, and least privilege, with Fernhill Telecom as the running example. Includes three original practice questions.
Preview the topics
- Fernhill’s assistant summarizes web pages for customers, and one page hides white text that tells the model to ask the customer for their password. What is this attack?
- Fernhill’s help page displays HTML snippets written by the assistant as they are, and a tester gets the assistant to write a script that runs in other customers’ browsers. Which risk is this?
- Fernhill’s agent can read emails, send emails, delete files, and change firewall rules, while its only task is to sort incoming support emails. Which risk is the most direct?