Indirect Prompt Injection: Tool Output Is Not Instructions
A retrieved document, an email, or a tool result can tell the model to take an action. Delimiters do not stop it. The tool allowlist after untrusted text does.
Tag
Articles tagged LLM on The Augmented Dev.
9 articles
A retrieved document, an email, or a tool result can tell the model to take an action. Delimiters do not stop it. The tool allowlist after untrusted text does.
GitHub Copilot's Auto picker gained efficiency, balance, and intelligence tiers in September 2026, alongside GPT-6 Astra and GPT-6.1 Sol. How the tiers change the cost-quality trade, and what admins control.
AI model comparison for GitHub Copilot Chat: GPT-5.6, Claude, Gemini, Grok, and Kimi, plus when Auto is the cheaper default.
Which steps belong in a fixed program and which belong in a model, so an agent stops skipping the check that production depends on.
Shipping LLM features on vibes works until a prompt tweak silently breaks ten other cases. Here is how to build evals that catch regressions before your users do.
Asking a model to 'return JSON' and parsing the result is how you get 3 a.m. pages. Tool schemas, constrained decoding, and validation turn a probabilistic text generator into a reliable API.
Most RAG systems that retrieve bad context aren't failing at embeddings or reranking — they're failing at chunking. How you split documents quietly decides what your model can ever find.
Retrieval-augmented generation demos look great. Production RAG is a different engineering problem — chunking, hybrid retrieval, reranking, evaluation, and the failure modes nobody mentions at conferences.
LLM-powered pipelines break in the same ways old monoliths did — when you stack synchronous calls. Queues, events, and the patterns that make a six-step AI pipeline survive a partial outage.