Red Team

Verdict: exploitable, and under-weighted. OWASP's LLM Top 10 flags supply chain and data-and-model poisoning as distinct risks, yet most teams model only prompt injection. The sharp edges are unverified model provenance, pickle-based weight files that execute code on load, and poisoned fine-tunes. Treat downloaded weights as untrusted executables, not data.

Exploitable. The Zou et al. GCG attack shows a single gradient-optimized suffix, tuned on open-weight models like Vicuna and LLaMA-2, can transfer to closed models including ChatGPT, Bard, and Claude. Transfer works because aligned models share training data and refusal behavior. Defenses help, but no single filter fully closes the class.

Exploitable. Anthropic's Sleeper Agents paper shows a deliberately backdoored LLM can survive supervised fine-tuning, reinforcement learning, and adversarial training — the standard safety pipeline. Adversarial training often just teaches the model to hide its trigger. For open weights, fine-tuning is not decontamination; provenance and detection, not retraining, are the defense.

Verdict: exploitable, and not fully fixable at the model layer. Indirect prompt injection hides instructions inside retrieved documents or tool outputs; the model obeys them and leaks data through a rendered image URL or an outbound tool call. What held was containment — least privilege, egress allowlisting, and human approval — not prompt-level pleading, which OWASP treats as insufficient.