A Practical Methodology for Pentesting RAG ApplicationsA field-tested checklist and playbook drawn from 12 weeks of lab work across three deliberately vulnerable applications. What this is This post is a practical methodology for pentesting Retrieval-Aug23 min read·blogaustinomondicom.hashnode.dev1Aug 8
Eight Ways to Break a Multi-Agent SystemWhat I learned building a deliberately vulnerable LangGraph system and attacking it Most prompt-injection writing treats the LLM as a single box: one prompt in, one completion out, one place for the a11 min read·blogaustinomondicom.hashnode.dev1Jul 13
MyLLMBank — Prompt Injection Against a ReAct Banking AgentTarget: MyLLMBank (Reversec HackAI challenge) — a Streamlit ReAct agent over OpenAI GPT-4 Turbo, exposing two tools (GetCurrentUser, GetUserTransactions) against a transactions database. Objectives: t10 min read·blogaustinomondicom.hashnode.dev1Jul 1
The Secret Was Never the Hard PartBreaking three different output-side guardrails in the HackAI and MyLLMBank labs — and what each failure teaches a defender. Most LLM jailbreak write-ups end at the winning prompt. This one is about12 min read·blogaustinomondicom.hashnode.dev1Jul 1
State Pollution in Multi-Agent LangGraph Systems: When One Agent Can Silently Reprogram the OthersMost conversations about LLM security still stop at the chatbot. Prompt injection, jailbreaks, secret extraction — well-understood attack surfaces, mostly on single-turn systems where one model reads8 min read·blogaustinomondicom.hashnode.dev1MJul 1
