Shipping an LLM feature adds a new and strange attack surface to your application. The model reads untrusted text, calls tools, touches data, and produces output that other systems trust. Each of those is an opening. AI security is the work of finding and closing them, and almost none of it happens in the prompt.
An LLM application is not just a model. It is a system: prompts, retrieved documents, tools the model can call, and outputs that flow into databases, shells, or other services. Attackers do not attack the model in isolation. They attack the seams between these parts, where trust is assumed and not enforced.
Teams respond to prompt injection by writing longer, sterner system prompts. It never works, because a language model reads every token as input and has no privileged channel for your instructions. An instruction buried in a retrieved document carries the same weight as your rules. We explain why in prompt injection is not a prompt problem.
Red-teaming an AI system does not mean grading the prompt. It means mapping the trust boundaries and attacking across them: indirect injection through retrieved documents, tool-call hijacking, and data exfiltration through the model's own outputs. The findings are architectural, because that is where the fixes live.
If you build or deploy AI in the EU, the EU AI Act brings obligations that scale with risk: risk management, logging, robustness, and security appropriate to the system. The good news is that the security testing and the regulatory evidence are the same work. Do the testing properly and the compliance follows.
Better wording buys you a day. Better structure buys you the year.
See AI security for how we red-team AI systems, or book a scoping call.