Observations from active red-team engagements. Technical depth, no filler.
Direct jailbreaks are a solved problem for most enterprise deployments. Indirect injection — delivered through the data your model retrieves at inference time — is not.
Most RAG deployments filter by metadata after the vector search runs. That sequencing is the vulnerability. Documents score for relevance before access control is evaluated — and by then, they're already in context.
A successful DoW attack doesn't need to take your system offline. It needs to make running it uneconomical. The attack surface is every path that converts a low-cost user action into a high-cost model invocation.