LLM Incident Cards
Recall first-response moves for common LLM application incidents.
Prompt injection The model did not leak anything, so why treat it like an incident? Use this when someone minimizes a failed injection attempt. Your line A failed injection is still a boundary test. We will preserve the transcript, replay the attempt, and verify retrieval and tool access before closing it. Do not overclaim impact. Say attempt first, confirmed impact second. It is serious without inventing harm. Response size Containment vs. shutdown: what is the move? Containment should match blast radius and evidence, with a path to widen if needed. First four moves What are the first four moves in…
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in