Securing LLMs: The OWASP Top 10 for AI Applications
Large language models introduce a new class of vulnerabilities that traditional application security never had to consider. Prompt injection, data leakage and insecure output handling are now board-level risks.
Generative AI has moved from experiment to production in record time. Chatbots answer customer questions, copilots write code, and agents take actions on a user's behalf. Each of these capabilities is also an attack surface, and most security programmes are only beginning to catch up.
The OWASP Top 10 for LLM Applications gives teams a shared vocabulary for the risks unique to this technology. A few of them deserve special attention.
Prompt Injection
The single most important risk is prompt injection: an attacker crafts input that overrides the model's instructions. Direct injection comes from a user typing a malicious prompt. Indirect injection is sneakier — the payload hides in a web page, document or email that the model later reads and obeys.
- Never trust model output as if it were a trusted command.
- Treat everything the model ingests — including retrieved documents — as untrusted input.
- Constrain what the model is allowed to do, especially when it can call tools or APIs.
Sensitive Information Disclosure
Models can leak training data, system prompts or context from other users if boundaries are weak. A model that has been fed confidential data in its context window may repeat it to the wrong person.
- Minimise what sensitive data ever reaches the model.
- Apply output filtering and redaction before responses leave your system.
- Isolate context between users and sessions so data cannot bleed across them.
Insecure Output Handling
Developers often treat model output as safe text. It is not. If a response is rendered as HTML, executed as code, or passed to a downstream system without validation, the model becomes a vector for cross-site scripting, SQL injection or remote code execution.
- Validate and sanitise model output exactly as you would any external input.
- Encode output appropriately for its destination.
Building a Defence
Securing AI applications is a layered effort. Strong input validation, least-privilege tool access, human-in-the-loop approval for high-impact actions, and continuous monitoring all work together. No single control is sufficient on its own.
The organisations that win with AI will be the ones that ship fast without shipping recklessly. Treating the model as a powerful but untrusted component — rather than a magic oracle — is the mindset that keeps deployments safe.