Weaponizing LLMs: Real-World Abuse Patterns and Defensive Countermeasures

Document Type

Conference Session

Publication Date

9-25-2026

Abstract

Large Language Models are rapidly being embedded into SOC workflows, internal tools, and production systems, creating a new and poorly understood attack surface. Adversaries are no longer exploiting software flaws alone, they are exploiting model behavior.

This talk examines real-world LLM abuse patterns relevant to security teams today, including prompt injection, indirect prompt manipulation, context poisoning, and adversarial use of LLMs for reconnaissance, phishing, and malware development. Rather than theoretical risk, the session focuses on how these attacks actually manifest in deployed environments and why traditional security controls frequently fail to detect them.

Attendees will be shown concrete abuse scenarios mapped to attacker objectives and existing threat models, highlighting where defenders lack visibility and how LLM-driven systems change assumptions around trust, input validation, and logging. The talk then introduces practical defensive countermeasures that can be implemented immediately, including architectural guardrails, prompt isolation techniques, telemetry strategies, and detection heuristics aligned with SOC operations.

This session is designed to equip practitioners with a realistic threat model for LLMs, separating hype from operational risk, and providing actionable guidance to secure AI-enabled systems without halting innovation.

Host

DeVos Place

Conference/Symposium

GrrCON Cybersecurity and Artificial Intelligence Conference

City/State

Grand Rapids, MI

Department

College of Business and Management

This document is currently not available here.

Share

COinS