The OWASP LLM Top 10, translated into things you can actually fix
The OWASP list for LLM applications is the closest thing the field has to a shared vocabulary for what goes wrong. Most of it maps onto controls you already know how to build.
By Quality AboveAll · · 9 min read
- Prompt injection is the defining risk, and it cannot be fixed inside the prompt.
- Treat every model output as untrusted input to whatever consumes it next.
- Excessive agency, giving a model more permissions than the task needs, converts a bad answer into a bad action.
Why a dedicated list exists
Conventional application security assumes deterministic behaviour and a clear boundary between code and data. Language models blur that boundary by design: instructions and content arrive in the same channel, and the system's behaviour is probabilistic.
The OWASP Top 10 for LLM applications catalogues the resulting risk classes. It is worth reading in full; what follows is how we translate it into review questions on real systems.
Prompt injection and insecure output handling
Prompt injection is the case where content the model reads, a user message, a retrieved document, a web page, contains instructions it follows. Indirect injection through retrieved content is the harder variant, because the attacker never talks to your system directly. We cover defences in prompt injection attacks explained.
Insecure output handling is the mirror image: taking model output and passing it into a system that trusts it. Model-generated SQL, shell commands, HTML or URLs are all injection vectors, and the mitigation is ordinary and non-negotiable, validate and escape exactly as you would user input.
Model output is user input wearing a lab coat. Validate it the same way.
Excessive agency and supply chain
Excessive agency is the risk that turns a wrong answer into a wrong action: a model with tools scoped too broadly, or permissions inherited from a service account rather than the acting user. The control is narrow tools, per-user permission enforcement in the application, and approval gates on consequential actions, as covered in building AI agents.
Supply chain risk covers models, datasets and plugins from third parties. Pin versions, know the provenance of anything you load, and treat a model file from an unverified source with the same suspicion as an unverified binary, because that is what it is.
Data leakage and poisoning
Sensitive disclosure happens when data reaches the model that should not, then reaches a user who should not see it. The common cause is retrieval without permission filtering, which is why access control must live inside retrieval rather than after it. See securing your RAG pipeline.
Poisoning covers deliberately crafted content entering your training data or your retrieval corpus. For most product teams the realistic vector is the knowledge base: if users can add documents that the assistant will later treat as authoritative, that is an attack surface requiring review before ingestion.
Denial of wallet, and overreliance
Unbounded consumption in an LLM context is as much a financial risk as an availability one. Rate limits, token ceilings per user and per session, and alerting on spend anomalies belong in the first release, not a later hardening pass.
Overreliance is the human factor: users trusting output more than it merits. The mitigations are design decisions, showing sources, marking content as AI-generated, keeping humans in the loop for consequential decisions, and they belong in the interface as much as in the architecture.
Frequently asked questions
Is prompt injection solvable?
Not completely, because instructions and data share a channel. It is manageable through privilege limitation, output validation and treating retrieved content as untrusted, so a successful injection cannot do much.
Does this replace normal application security?
No, it adds to it. Every conventional risk still applies, and the LLM introduces additional ones on top.
Where should we start?
Permission scoping on retrieval and tools, then output validation, then rate and spend limits. Those three cover the highest-impact risks for most products.
Shipping an AI feature and want a security review before it reaches customers? Our application security team covers LLM-specific risks. Start with a free 30-minute consultation.
