The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Prompt injection is one way to manipulate an LLM application; it is not the whole security problem. The consequences depend on what data the application exposes, which tools and identities it gives the model, what downstream systems do with its output, and how the service is bounded and monitored. OWASP’s 2025 Top 10 for LLM and GenAI Applications is a useful map of these risks—not a substitute for a threat model of your own system.
What counts as an LLM application’s attack surface?
It is the full set of places where data, instructions, permissions, model outputs, software components, and operational resources can affect the application. A chatbot that only drafts text has a different risk profile from an assistant that can search private records, call functions, send email, or initiate changes in connected systems.
As an Amazon Associate I earn from qualifying purchases.
That difference matters because a model can be manipulated without an attacker directly compromising the model itself. A user prompt or retrieved document may influence the model; the model may then disclose data or request an action; and an application that trusts that output may pass it to another component. Security review therefore needs to follow the complete path from input to data access, tool action, output handling, and service operation.
Recommended Free Tools
OWASP’s 2025 risk map
OWASP’s Gen AI Security Project lists ten categories for LLM and GenAI applications. They are useful prompts for a review, not an exhaustive list or a scoring rubric. Several can apply to the same failure.
#1 Best Overall
| OWASP category | What to examine in your application |
|---|---|
| LLM01:2025 Prompt Injection | Whether user input or content the application consumes can alter model behavior in unintended ways. |
| LLM02:2025 Sensitive Information Disclosure | Which personal, confidential, credential, financial, health, legal, or proprietary information could be exposed through responses or application context. |
| LLM03:2025 Supply Chain | The provenance, integrity, maintenance, and licensing of models, datasets, packages, and other development or deployment components. |
| LLM04:2025 Data and Model Poisoning | Whether training, fine-tuning, or embedding data or model artifacts could be manipulated. |
| LLM05:2025 Improper Output Handling | Whether generated text, code, markup, links, or tool arguments are trusted by a downstream component. |
| LLM06:2025 Excessive Agency | Which functions the model can invoke, what identity those calls use, and how consequential the actions can be. |
| LLM07:2025 System Prompt Leakage | Whether sensitive information or security decisions have been placed in a prompt that should not be treated as secret or authoritative. |
| LLM08:2025 Vector and Embedding Weaknesses | Whether retrieval and other embedding-based components, including indexed data, create risks in the application’s data path. |
| LLM09:2025 Misinformation | How factual errors in model outputs could affect users or decisions in this particular use case. |
| LLM10:2025 Unbounded Consumption | Whether inputs, request volume, runtime, queued actions, and resource use are limited and monitored. |
How prompt injection becomes an application-level risk
OWASP describes prompt injection as input that changes model behavior or output in unintended ways. It can be direct, through a user’s prompt, or indirect, through content the application consumes, such as a webpage or file. The instruction may not be visibly apparent to a person if it is still parsed by the model. Jailbreaking is a form of prompt injection aimed at getting a model to disregard safety protocols.
Retrieval-augmented generation (RAG) and fine-tuning do not fully mitigate prompt injection. The risk is not confined to the wording of the prompt: it depends on what the model can reach and what the application does with its output. An indirect instruction in retrieved content might influence a model with access to private data or functions; if the application grants that access without independent checks, the result could be disclosure, an unauthorized function call, a command in a connected system, or a manipulated decision.
OWASP says fool-proof prevention is unclear. Its suggested ways to reduce impact include constraining behavior, validating output formats, filtering inputs and outputs, separating untrusted content clearly, applying least privilege, requiring human approval for high-risk operations, and conducting regular adversarial testing. These measures reduce risk; none should be treated as a guarantee.
Protect data, artifacts, and retrieval paths
Sensitive information disclosure
Information may be exposed in a model response or through the wider application context. The relevant question is not only what a prompt tells the model to reveal, but which information the application makes available and who is authorized to reach it. Prompt-only restrictions can be bypassed, so pair them with input validation and sanitization, least-privilege access, limits on data sources, and clear retention and usage policies. Differential privacy and tokenization or redaction are possible privacy techniques, not universal fixes.
Supply chain and poisoning
Supply-chain review includes conventional software packages as well as third-party models, datasets, licensing terms, provenance, and components used to develop or deploy the system. Teams should be able to identify the model and data versions in use, where the artifacts came from, how they are maintained, and whether their licenses permit the intended use and distribution.
Poisoning and supply-chain risk overlap but are not the same question. Poisoning concerns manipulated training, fine-tuning, or embedding data; supply-chain review asks whether an artifact’s source and integrity can be trusted. OWASP lists both as separate categories. Vector and embedding weaknesses also put retrieval infrastructure and indexed data within scope, although the category name alone is not a complete retrieval-security checklist.
Keep model output and agency inside controlled boundaries
Validate outputs before another component acts on them
Generated text, code, markup, URLs, and tool arguments are untrusted input when passed to another component. A response that appears harmless in chat can become consequential if a renderer, browser, execution environment, or connected service interprets it. OWASP’s Q1 2026 exploit roundup describes a reported path in which output rendering became an exfiltration channel and recommends hardening URL validation and restricting outbound rendering. This is a boundary example from an OWASP community roundup, not a complete incident dataset.
Limit agency and separate authorization
Agency is the ability the application gives a model or agent to call functions or affect connected systems. Minimize that ability: grant only the permissions required for the task, check authorization independently of the model, and require human review for high-impact actions. Do not ask the model to decide whether it is allowed to use its own authority.
Do not make the system prompt a security boundary
OWASP’s Gen AI Security Project states: “It’s important to understand that the system prompt should not be considered a secret, nor should it be used as a security control.” Do not put credentials, connection strings, sensitive role details, or permission structures in the prompt. Keep secrets in appropriate external systems, and enforce access and privilege separation through deterministic, auditable checks outside the model.
Bound consumption and account for misinformation
Set operational limits
Uncontrolled inference can contribute to service degradation, denial of service, economic loss, or model extraction through repeated API access. Long or numerous inputs, high request volume, and expensive queries are examples of paths to excessive resource use. OWASP recommends measures including input-size limits, rate limits and user quotas, resource allocation controls, timeouts, sandboxing, logging and anomaly detection, and limits on queued and total actions.
Match factual review to the use case
OWASP includes misinformation as a risk category. A factual error is not automatically a security incident in every application, but it can matter when people rely on model output to make decisions. Define where outputs need verification or human review according to the consequences of being wrong.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →What should an LLM security assessment cover?
Use the OWASP categories to structure the conversation, then map each risk to your actual architecture, data flows, identities, and operating limits. These review axes synthesize the categories and controls; they are not an OWASP scoring rubric.
Best Value
- Data exposure: Identify sensitive data reachable by the model, retrieval system, tools, logs, and users. Check what is retained and who can access it.
- Privilege and agency: Inventory callable functions, the identity behind each call, the permissions it carries, and actions that need independent authorization or human approval.
- Untrusted input paths: Trace prompts and content from documents, webpages, files, images, and other supported modalities that can influence model behavior.
- Supply-chain integrity: Record the models, datasets, packages, and deployment components in use, along with what is known about their provenance, maintenance, and licensing.
- Output effects: Determine whether generated text, code, links, markup, or tool arguments can cause execution, external requests, data disclosure, or consequential decisions.
- Operational limits: Verify bounds and monitoring for request volume, input size, runtime, cost, queued actions, and outbound access.
For each path, ask what an attacker could influence, what the application would permit next, and which control outside the model would stop an unauthorized effect. Test the full data and action path, including failure cases, rather than assessing the prompt in isolation.
What recent OWASP incident reporting shows—and does not show
OWASP’s Q1 2026 exploit roundup, published April 14, 2026, covers incidents reported from January through early April and explicitly says it is not exhaustive. It describes a shift toward issues involving agent identities, orchestration, supply chains, permissions, output validation, and data exfiltration, alongside prompt injection. Its mapping of an indirect-prompt-injection example across sensitive-data disclosure and improper output handling illustrates how one event can span multiple categories.
This is a curated community roundup and taxonomy mapping, not independently verified incident-rate statistics. It does not establish a general prevalence, loss, or frequency figure for LLM attacks.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minutePractice the categories hands-on
OWASP describes DonkAI as a hands-on lab with challenges for the ten categories in the OWASP Top 10 for LLM Applications 2025. It can provide a way to explore example scenarios; it does not replace an assessment of your own architecture and permissions.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
