How the CIA Triad Maps to LLM Security Risks
Summary
The article maps LLM security failures to confidentiality, integrity and availability, describing prompt and chat-history leaks, prompt injection and poisoning, and costly inference DoS. It also argues the triad misses probabilistic and cognitive risks.
Key points
- The article frames system-prompt and chat-history exposure as confidentiality risks, including indirect prompt injection delivered through documents, email, webpages or MCP tool descriptions.
- It describes prompt injection and training-data poisoning as integrity risks that can alter model outputs or behavior.
- The article cites research reporting that as few as 250 poisoned documents could install a backdoor in a large language model.
- It identifies recursive output generation, context-window exhaustion and non-terminating tool-call chains as ways to drive inference costs or disrupt availability.
- A cited medical-LLM study reports 94.4% prompt-injection success across 216 simulated patient dialogues; the article also reports 91.7% success in extremely high-harm scenarios.
- The article argues that probabilistic outputs and models' influence on human judgment are risks the CIA triad does not fully capture, and discusses proposed extensions such as CIA+TA.
Article Details
- Topic
- Applying the CIA triad to LLM security failures, including prompt injection, data poisoning, data exfiltration, and inference denial-of-service.
People
Vendors
AnthropicResearch from OpenAI, Microsoft, Anthropic, and Google shows these failures in real systems.Googleway to understand LLM security, because major attacks against models like ChatGPT, Copilot, Claude, and Google systems all map to confidentiality, integrity, or availability failures.MicrosoftResearch from OpenAI, Microsoft, Anthropic, and Google shows these failures in real systems.OpenAIResearch from OpenAI, Microsoft, Anthropic, and Google shows these failures in real systems.
Products
Bing ChatResearchers at Embrace The Red published exploits against ChatGPT, Microsoft Copilot, Bing Chat, and Claude where the model spilled its own system prompt after a few rounds of phrased requests.ChatGPTtriad still provides a useful way to understand LLM security, because major attacks against models like ChatGPT, Copilot, Claude, and Google systems all map to confidentiality, integrity, or availability failures.Claudea useful way to understand LLM security, because major attacks against models like ChatGPT, Copilot, Claude, and Google systems all map to confidentiality, integrity, or availability failures.Claude CodeThe November 2025 Anthropic disclosure on a Chinese state-sponsored group jailbreaking Claude Code into an autonomous attack agent against thirty global targets is the highest-impact integrity attack of the modern era.Copilotprovides a useful way to understand LLM security, because major attacks against models like ChatGPT, Copilot, Claude, and Google systems all map to confidentiality, integrity, or availability failures.NotepadIn February 2026, Microsoft’s Copilot integration into Notepad converted a sandbox-free offline text editor into a network-facing surface that leaked user data through cloud-side AI processing.