A structured threat model for LLM security, organized around the core property that language models process instructions and data as a single token sequence with no boundary between them. Covers the full attack surface mapped to pipeline stages: prompt injection (direct and indirect), RAG poisoning, model-level attacks (weight theft, training-data extraction, poisoning), excessive agency (the 'lethal trifecta'), and supply chain risks. Real incidents are used as anchors — EchoLeak (CVE-2025-32711), PoisonedRAG, nullifAI on Hugging Face, and GitHub/GitLab MCP compromises. Concludes that model-interior attacks are largely bounded and mitigated by providers, while the highest real-world risk sits where an agent simultaneously holds private data, untrusted content, and an external action channel. Defense in depth across all pipeline stages is the recommended posture, with no single filter being sufficient.
