What is an LLM vulnerability scanner?

An LLM vulnerability scanner sends batteries of adversarial probes — jailbreaks, prompt injections, PII extraction attempts, harmful-content requests — at a target LLM and grades the responses. The output is a vulnerability + optimization report with per-probe evidence, severity, and a prioritized fix list.

Which LLMs can I scan with FilterPrompt?

OpenAI, Anthropic, Google Gemini, Azure OpenAI, plus any OpenAI-compatible endpoint — Ollama, Groq, Mistral, Together AI, OpenRouter, Perplexity, Hugging Face, vLLM, or your own custom endpoint. Bring your own keys per tenant.

What kinds of vulnerabilities does FilterPrompt test for?

Jailbreaks (DAN, role hijack, translation smuggling), direct and indirect prompt injection, system-prompt extraction, harmful-content compliance, PII / secret leakage, bias & fairness, RAG poisoning, agent/tool abuse, output quality, and robustness — categories map to the OWASP LLM Top 10.

How are probes graded?

Each probe declares an evaluator: regex match, refusal-check, contains-check, or an AI judge (Gemini 3 Flash). Pass/fail comes with severity, category, the exact prompt sent, the model's full response, and the evaluator's reason — fully auditable.

How much does a scan cost?

1 credit per probe executed. New accounts get 1 welcome credit on signup. Pay-as-you-go credit packs after that — credits never expire. Connecting LLMs and creating tenants is free.

LLM Vulnerability Scanner for RAG Applications: Stopping Indirect Prompt Injection at the Source

Architecture · 2022-08-09 · 10 min read · FilterPrompt Team

RAG pipelines are the #1 attack surface for indirect prompt injection. How an LLM vulnerability scanner positioned correctly inside a RAG flow stops attacks the model itself cannot defend against.

If your application uses retrieval-augmented generation, your biggest prompt-injection risk is not the user — it is the documents the user asks about. Indirect prompt injection lives inside the retrieved context, and the model has no way to tell trusted instructions from injected ones. An LLM vulnerability scanner positioned correctly in your RAG flow stops attacks the model itself cannot defend against.

Why RAG amplifies the threat

Classic prompt injection requires the attacker to talk to your app. Indirect injection only requires the attacker to put a malicious string somewhere your retriever might index — a webpage, a PDF, a Notion doc, a public Slack channel, a JIRA ticket. When your retriever pulls that content into a prompt, the model reads it as if you wrote it.

Where to position the scanner in a RAG flow

After retrieval, before assembly — inspect each retrieved chunk for injection markers
After assembly, before the model — inspect the full assembled prompt as one unit
After the model, before the user — inspect the response for exfiltration markers

Signals that catch indirect injection

Imperative phrasing inside retrieved chunks ('ignore previous', 'instead, do…')
Role-pretense markers inside retrieved chunks ('you are now…')
Embedded URLs that look like exfiltration sinks (long random query strings)
Encoded payloads (base64, ROT13, zero-width characters) inside chunks
Drift between the user query and the retrieved content's actual topic

Hard mode: tool-call exfiltration

If your model can call tools, the attacker's payload may convince it to call a tool with the user's secret as a query parameter. Defense in depth: allowlist tool destinations outside the model, and inspect every outgoing tool call URL through the scanner.

Operational tips

Treat your vector index as untrusted input — re-scan chunks on ingestion
Tag chunks with a trust level (internal-confidential, internal-public, external) and deny mixing
Log retrieved chunks alongside verdicts so you can audit what reached the model