Research · curated 19 Aug 2026
From Prompt Injection to Web Exploitation: Revisiting Classic Vulnerabilities in LLM-Integrated Applications
First reported arxiv.org
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
LLM-integrated web applications can act as a confused deputy that carries attacker-influenced input into backend sinks like SQL, HTTP requests, and template rendering, exposing classic web vulnerabilities through a new prompt-injection-driven attack surface defenders must harden across prompt, model, application, and network layers.
A research paper by Spiros Tsigkopoulos and Christoforos Ntantogian introduces "LLM-mediated web attacks," a class where attacker-controlled input is transformed by an LLM-integrated application and then reaches traditional web-app sinks, systematized as LLM2X variants (LLM2SQLi, LLM2XSS, LLM2SSTI, LLM2CommandInjection, LLM2IDOR, LLM2CSRF, LLM2XXE, LLM2SSRF). The authors implement TicketOracle, a Flask-based LLM-integrated app, to evaluate LLM2SSRF across five scenarios and seven LLMs, finding substantial model-specific variation in susceptibility.