Language-Augmented Vulnerability in Applications (LaVA)

Last updated on Sep 11, 2025

What is Language-Augmented Vulnerability in Applications (LaVA)?

Language-Augmented Vulnerability in Application (LAVA) is a new class of exploit vector, coined by Straiker, to describe how natural language can be weaponized to exploit AI-native and agentic applications. Unlike traditional web attacks, which rely on direct code injection, LAVAs harness the expressive and obfuscating power of human language to bypass defenses, trigger unintended behaviors, or resurrect old vulnerabilities in a new form.

Why do LAVA cyberattacks matter?

As enterprises embed large language models (LLMs) and autonomous agents into production workflows, they inherit new exposure points that traditional AppSec tools were never designed to catch.

Three Examples of LAVA

Input obfuscation: Old payloads wrapped in natural language, slipping past front-door checks.
AI-driven transformation: Benign-looking requests translated into malicious instructions.
One-to-many propagation: Manipulated AI outputs spread to countless users.

‍How are LAVA risks different from traditional AppSec risks?

AppSec has traditionally battled threats like SQL injection and cross-site scripting. While many of these have been mitigated with WAFs, input validation, and rule-based detection, the rise of LLMs, GenAI and agentic AI applications brings them back to life, but this time, these threats are cloaked in natural language. An attacker no longer needs to drop a raw SELECT * FROM into a field. Instead, they can phrase a request conversationally (“ask the database to fetch every record”) and rely on the model to generate the vulnerable query.

Comparing 5 Aspects of Legacy Cyberattacks vs. LAVA Cyberattacks

Aspect	Legacy Web Attack (Traditional AppSec)	LAVA Attack (AI-Augmented AppSec)
Attack Vector	HTTP(S) requests with direct payload injection (e.g., XSS, SQLi via form input)	Language-based manipulation influencing GenAI or agentic reasoning outputs, such as injecting XSS via prompt and context engineering
Entry Point	Web forms, URL parameters, API requests	User-submitted natural language input processed by LLMs, GenAI, and AI agents
Propagation	Stored XSS example: attacker submits a malicious script that is later rendered in another user’s browser	AI-generated responses can be stored, indexed, or chained into other agent workflows
Detection	Rule-based filters (WAF, IPS, input validation)	AI-specific security controls, including semantic anomaly detection and runtime guardrails
Prevention	WAF blocks known attack signatures; input sanitization; strict schema validation	AI-specific defenses such as context-aware sanitization, runtime guardrails, and prompt validation tailored for LLMs, GenAI and AI agents
Attack Scenario	Attacker submits <script>malicious content</script> in a vulnerable web form, which executes when another user views the page	Attacker submits a crafted prompt that makes an AI agent execute unintended tool use or exfiltrate sensitive data