OWASP LLM Top 10: a practical checklist for engineering teams

Prompt injection is an authorisation problem

Treat every model input that originated outside your trust boundary — retrieved documents, tool output, user messages, web pages — as untrusted. The mitigation is not a cleverer system prompt; it is not granting the model authority it should not have.

• ▸Give the model tools with least privilege, scoped per request and per user.
• ▸Require human confirmation for irreversible actions (payments, deletions, sending email).
• ▸Keep retrieved content in a clearly delimited channel and never let it change tool policy.

Insecure output handling

Model output is user input to whatever consumes it next. Rendering it as HTML gives you cross-site scripting; passing it to a shell or SQL layer gives you injection with extra steps.

• ▸Escape model output at the render layer; never use raw HTML injection.
• ▸Parse structured output against a schema and reject anything that fails validation.
• ▸Never interpolate model output into commands, queries or file paths.

Sensitive information disclosure

Leakage happens in three places: the prompt you build, the vector store you retrieve from, and the logs you keep. Retrieval filters must run with the requesting user’s permissions, not the service account’s.

• ▸Apply row-level access control on retrieval, not after generation.
• ▸Redact secrets and personal data before anything reaches provider logs.
• ▸Set retention on prompt and completion logs, and exclude them from broad internal access.

Supply chain and model provenance

Model weights, adapters, embeddings and prompt templates are dependencies. They deserve the same treatment as an npm package: pinned versions, recorded checksums, an entry in your software bill of materials, and a documented owner.

Denial of wallet and unbounded consumption

For LLM features, cost and availability are the same incident. Per-user and per-key budgets, request size caps, timeouts and circuit breakers around provider calls belong in the first release, not after the first surprise invoice.

Testing the controls

Controls you do not test are documentation. Add an adversarial suite to CI: a fixed corpus of injection payloads, jailbreak attempts, data-exfiltration prompts and malformed tool responses, asserted against expected refusals and schema validation.

Run it on every prompt change. Prompts are code, and a prompt edit can silently remove a control.

Frequently asked