Robert Lackey

Prompts · AI Security · Research

Better AI Research Steering

Prompt patterns for keeping AI-assisted security research grounded in state, scope, and evidence.

By , product security engineer.

AI assistants are better when they are pointed at one clear decision. If I give them a vague goal, I get vague confidence back.

The trick is to keep feeding the current state: what I tried, what I expected, what happened, what I already ruled out, and what I want decided next.

Starting A Track

Start with this feature area and trace how user-controlled input reaches sensitive operations.
Return the call chain, the controls in between, and the first assumption worth testing.
Do not generate exploit payloads.

Use this when the work needs orientation. It gives the assistant a starting point and a bounded output.

Diagnosing A Result

I expected this probe to show [expected signal], but it showed [actual signal].
Based on that result, is the hypothesis wrong, is the trigger path wrong, or is the evidence
inconclusive? Give me the next smallest safe check.

Use this when a result does not match the theory. Exact output matters more than a summary.

Steering A Pivot

We have tried this path and the control appears to be working. Identify the blocker precisely,
then suggest whether to scope down, pivot, or stop.

Use this when the research is starting to loop. A good pivot starts with naming the blocker.

Turning Evidence Into A Finding

Turn these notes into a finding outline with confirmed impact only. Separate evidence from
speculation, list cleanup steps, and call out the open questions.

Use this when the confirmed issue is useful enough to document. Do not ask for escalation and a final write-up in the same prompt. Pick the mode.

Steering Rules

  • Give the file, feature, or boundary to start from.
  • Paste exact output, not “it failed.”
  • Say what you expected.
  • Ask for one decision at a time.
  • Name paths you already ruled out.
  • Keep evidence and speculation separate.
  • Never paste secrets or private operational details into prompts.

Prompts I Avoid

  • “Find something bad.”
  • “Make it critical.”
  • “Try every bypass.”
  • “Write the report” before the evidence is stable.

Better steering turns the assistant into a useful research partner instead of a random idea machine with confident grammar.