When Your Target Runs On Attention Instead Of Anxiety

The talk argues that prompt injection against language model systems is closer to social engineering than to classic memory-corruption bugs. Because models are trained to be helpful, they tend to comply with whoever sounds authoritative or sits closest to the end of their context, much as people do. The speaker explains why keyword filtering and input sanitising fall short, since natural language is too large a space to filter, and why permissions and intent checks have to sit outside the model.

The middle of the talk maps familiar social engineering ideas onto models. Reconnaissance becomes interrogating an agent to build a behaviour profile, pretexting becomes fabricating a shared history, and authority, urgency, reciprocity, cognitive overload and gradual rapport-building become prompt framings. Indirect injection through resumes, web forms, PDFs and tool output is treated as a form of retrieval poisoning. The speaker also describes a search-style workflow that generates, scores and mutates prompts, and notes that setting temperature to zero only makes a working attack repeatable rather than safer.

The closing point is that teams should treat model output as a suggestion rather than a decision, and should contain the blast radius of injection instead of expecting to prevent it. Practitioners testing these systems should record the model, settings and full context so results can be replayed and reported, and should be wary of prompt-based governance that adds complexity without adding real control.