Practice · 2023–now · AI Present
Prompt injection as afterthought
Ship the chatbot, bolt on security later — OWASP's new category, same old afterthought.
Prompt-injection blindspot failed because LLMs treat instructions and data as the same stream. It stuck as a risk category once tool-use and RAG made attacks profitable. The fad was demos without threat models; the durable practice is least privilege, input isolation, and red-team evals before prod.
Cost of the fad
Customer-facing chatbots shipped with tool access and "security in phase two." Indirect injection via docs and tickets became the new XSS.
Case studies
Patterns
Context
Demos consolidate; evals remain
AI pair programming changed how code is typed faster than how it is reviewed. Agent frameworks and standalone vector stores sorted into demos versus durable plumbing; mid-market RAG folded back into Postgres. The permanent layer is familiar: evals that gate deploys, model routing for cost, tool protocols instead of plugin snowflakes, and humans who own production. Autopilot rewrites and vibe-shipped auth middleware are still big-bang migrations with better slides — and a longer on-call.
Compare with
Related
Practice · 2023–now
Shadow AI / paste-into-ChatGPT
Prod data into consumer chat because the approved tool is slow. GDPR with better autocomplete.
$ Employees routed tickets, logs, and customer PII through consumer chat before InfoSec finished procurement. Compliance scramble followed the demos.
Practice · 2023–now
Chatbot wrapper as product
Slap an LLM on the homepage and call it AI-native — "we have an app now," 2010 edition.
$ Homepage chat boxes billed as AI-native platforms while the roadmap stayed FAQ search with a spinner. Acquisition decks outpaced retention.
Practice · 2023–now
RAG as default architecture
Retrieval-augmented generation as the answer to every knowledge problem — then "just stuff the window" as the counter-fad. Often right; often Postgres with pgvector would suffice.
$ Teams stood up vector pipelines, chunking strategies, and rerankers before asking if fine-tuning or a SQL query would answer the question. Retrieval infra became the product.
Practice · 2023–now
Agent ops / LLM observability
Tracing, cost caps, and prompt versioning for production LLM features — mostly constrained tool loops, not autonomous agents. Datadog for tokens.