Poisoning the Watchtower: Prompt Injection Attacks Against LLM-Augmented Security Operations Through Adversarial Log Content
arXiv:2605.24421v1 Announce Type: cross Abstract: Large language models (LLMs) are increasingly used as analyst assistants in security operations centers (SOCs), where they ingest log and alert data to produce triage labels, incident summaries, or remediation advice. We study a structural failure mode of this design: many log fields are attacker controlled. User agents, URLs, payloads, DNS queries, and attempted usernames can therefore carry instructions to the model alongside evidence of the intrusion. We call this setting \emph{log-substrate prompt injection}. We introduce a four-class taxon
The increasing integration of LLMs into security operations makes them a prime target for novel attack vectors like prompt injection through attacker-controlled logs, highlighting a critical vulnerability as adoption scales.
This research reveals a fundamental weakness in LLM-augmented security systems, where adversarial log content can be used to manipulate incident responses, potentially compromising entire security postures.
Traditional security logging and monitoring now have a new attack surface, requiring a rethinking of how LLMs process and interpret input, especially from potentially malicious sources.
- · Cybersecurity researchers
- · Security product vendors with robust input sanitization
- · Companies investing in AI safety and red-teaming
- · Security Operations Centers adopting LLMs without sufficient safeguards
- · Companies reliant on vulnerable LLM-powered security tools
- · Attackers employing prompt injection tactics
Companies using LLMs in SOCs will need to urgently implement or improve input validation and sanitization for log data.
New security-specific LLM architectures or protective layers will emerge to specifically address and mitigate log-substrate prompt injection.
This could lead to a broader philosophical shift in AI security, emphasizing 'secure by design' principles for data ingestion across all critical enterprise LLM applications.
This signal links to a primary source. Continuum Brief monitors and indexes it as part of the live intelligence stream — we do not republish source content.
Read at arXiv cs.LG