LLM Bug Hunt Drills

Eight drills across the parts of an LLM app, then a timed mock review of an AI email assistant.

Before you start

The drills use a small provider-neutral wrapper, the kind most codebases have, so you can focus on the code around the model:

// lib/llm.ts — assume this wrapper itself is correct
llm.complete({ system, messages, tools?, maxTokens? }): Promise<{
  text: string
  content: ContentBlock[]          // raw blocks, to send back on the next turn
  stopReason: 'end_turn' | 'max_tokens' | 'tool_use' | 'refusal'
  toolCalls: { id: string; name: string; input: any }[]
  usage: { inputTokens: number; outputTokens: number }
}>
llm.stream({ … }): AsyncIterable<{ text: string }>
llm.embed(text, { model }): Promise<number[]>

The four stop reasons are the ones that matter in real APIs: the model finished (end_turn), it hit the output cap (max_tokens, so the output is truncated), it wants to call a tool (tool_use), or it declined (refusal). Drill 7 uses a provider SDK directly.

Use the method from Reading in Passes, and add one question for LLM code: for every string that reaches the model, who wrote it? For everything that comes back, what does the code do with it?

Part 1: Into the model

Drill 1: Prompt assembly

Drill 2: Structured extraction

Part 2: Out of the model

Everything the model produces is untrusted input to your code. Treat it exactly like text typed by an anonymous user.

Drill 3: Output handling

Drill 4: An agent with tools

Part 3: Retrieval

Drill 5: RAG

Part 4: Around the model

Drill 6: Streaming

Drill 7: Reliability and cost

This drill uses a provider SDK directly. As with the official SDKs, client.messages.create already retries failed requests (twice by default) and returns content as a list of blocks.

Drill 8: Tests and evals

Part 5: Mock review — an AI email assistant

Inboxly reads a user's recent email and drafts or sends replies on request. Set 25 minutes, use all six passes, write your top five findings ranked, then check.

Cheat sheet

Say it in the interview

"The assistant's system prompt tells it to follow instructions inside emails, and send_email has no confirmation step, so anyone can email the user and have their mail forwarded. That's indirect prompt injection plus excessive agency, LLM01 and LLM06. Prompt wording won't fix it: sending has to require the user's confirmation, and tools have to run with the user's permissions, so an injected instruction can at most produce a draft the user sees."

Go deeper

• The LLM Bug Catalogue: every bug type in these drills.
• AI Engineering · Your Agent Is an Attack Surface.
• GenAI with JS · The Agent Loop in Plain JavaScript: the loop these drills break.
• GenAI with JS · The Streaming ChatGPT Clone.
• Bug Hunt · Mock Reviews: three more mocks, without the LLM.