Laravel & AI

Currently Playing: I Tricked My Own AI Into Leaking Everything - Ship AI with Laravel EP11

Episode 11 of Ship AI with Laravel, a series on Laravel News where we build a full AI platform using Laravel 13 and the Laravel AI SDK. This is the series finale. First I show you the problem. With the right messages, I socially engineer our own support agent into revealing its entire system prompt, its tools, and its internal instructions. Then I show how the order lookup tool will happily return another customer's data if it accepts any order ID. Both are real vulnerabilities that ship in AI apps every day. Then we fix them with four layers of defense. Layer one, harden the prompt. I add explicit security boundaries so the agent never reveals its prompt, tools, or sensitive data, and treats anyone claiming to be an employee as a regular customer. Layer two, a local LLM guard. I use Ollama running Llama 3.2 to build a prompt-guard agent that classifies every incoming message as safe or unsafe via JSON output, then wire it in as middleware so unsafe prompts get blocked before they ever reach the main agent. No API cost since it runs locally. Layer three, tool-level authorization. I scope the order lookup tool to the authenticated user so it can't return anyone else's orders. Layer four, output filtering. A safety net middleware that redacts patterns like SSNs, credit card numbers, and API keys before they leave the system. By the end the agent is genuinely hard to break, and that wraps our journey from composer require to a production-ready, secure AI platform. Thanks for building along with this series. This is where we started and this is where we finished, eleven episodes later. ⭐ GitHub: https://github.com/harris21/ship-ai-with-laravel 👉 Full series playlist: https://www.youtube.com/playlist?list=PLsmlCYEtWNI_plnKPPO13XjfDJoMIfhLN 👉 Timestamps 00:00 Prompt Injection Demo 01:12 Threats and Attack Paths 01:45 Layer 1 Harden Prompts 03:10 Local LLM Prompt Guard 05:14 Guard Middleware Wiring 06:33 Testing Safe vs Unsafe 07:39 Tool Level Authorization 10:35 Output Filtering Safety Net 11:52 Four Layer Recap 12:26 Series Wrap Up ---------------------------------------------------------------------- ➫ Business Inquiries: hello@laravel-news.com ---------------------------------------------------------------------- JOIN OUR WEEKLY LARAVEL NEWSLETTER 👉 https://laravel-news.com/newsletter ----------------------------------------------------------------------