OWASP LLM Top 10

Definition

Any input entering the model's context changes its behaviour away from what the developer intended. Architecturally the model cannot separate instruction from data — both are tokens in the same stream — so there is no clean equivalent of a parameterised query.

How it shows up

Direct injection is typing "ignore all previous instructions" into the box. Indirect injection hides the instruction in a page, email or document the model will read. The 2026 edition folds cross-modal attacks into this entry — an instruction inside an image or audio file, invisible on screen and legible to the model.

Defences

There is no single fix. The principle is to treat all external content as untrusted, and to enforce permissions outside the model — persuading the model should not move what it is allowed to do.

Definition

The model's output reveals something this user should not have: personal data, credentials, trade secrets, or another user's data.

How it shows up

A RAG system treats the whole knowledge base as one permission scope, so someone in sales can ask about contract terms only legal should see. The model did nothing wrong; the retrieval layer never had a boundary.

Defences

1. 01retrievalbeforeApply the user's permissions before retrieval. Asking the model in the prompt not to say something is a request, not a control.
2. 02Detect and redact sensitive data on the way in and on the way out.
3. 03De-identify anything used for training or fine-tuning — what a model has memorised cannot be withdrawn afterwards.

Definition

The system grants the model more capability, permission or autonomy than it needs, so a single lapse in judgement is enough to cause real damage.

How it shows up

An agent that sorts mail is given send and delete as well, because it uses the same credentials and separating them was fiddly. Now one email carrying an instruction can make it send mail outward. The permission was granted for convenience; the cost is attack surface.

Defences

1. 01Give each tool the minimum permission set. Nothing granted "in case it is needed".
2. 02Human confirmation for anything high-risk or irreversible — and the confirmation screen has to say plainly what is about to happen.
3. 03Enforce permissions at the tool layer, not in the prompt. A prompt can be argued with; a permission system cannot.

Definition

Model weights, datasets, packages and plugins whose provenance is untrustworthy or already tampered with. The classic software supply chain problem, plus a class of asset you cannot audit by reading source. The 2026 edition folds in model artifacts that are not what they claim — the weights being promoted are not the ones it claims to be.

How it shows up

Fine-tuned weights pulled from a public hub, a LoRA adapter of unclear origin, a third-party package somewhere in an agent toolchain. You can read every line of your frontend; you cannot read what is inside that weights file.

Defences

1. 01Treat models and datasets as dependencies: verify provenance, pin versions, check hashes.
2. 02Produce and maintain an AI bill of materials, so "what exactly are we running" is a question with an answer.
3. 03Evaluate third-party models in isolation before deployment. Do not wire one straight into a system that holds permissions.

Definition

Content planted in pre-training, fine-tuning or embedding data to shift the model's behaviour, or to install a backdoor that only fires on a particular trigger phrase. The 2026 edition names fine-tuning-stage subversion explicitly.

How it shows up

A public page destined to be crawled into a training set is written with a specific trigger phrase and the wrong answer beside it. The model behaves normally on every ordinary test and diverges only on that phrase — which is why it is hard to catch. The anomaly is not where you are looking.

Defences

1. 01Keep provenance for training and fine-tuning data — know who contributed each batch.
2. 02Detect behavioural drift against a fixed benchmark set, rather than watching aggregate metrics for a dip.
3. 03Red-team after fine-tuning, specifically for behaviour that only appears under narrow conditions.

Definition

No bound on inference usage, leading to runaway cost, degraded service, or the model's behaviour being replicated through bulk querying.

How it shows up

A public chat endpoint with no rate limit is called continuously to harvest input-output pairs and clone the behaviour. The bill and the latency both worsen, and on the dashboard the traffic just looks like growth.

Defences

1. 01Rate limits and quotas per user and per API key, not one aggregate ceiling.
2. 02Cap input length and output tokens. Both ends.
3. 03Monitor cost per user with anomaly alerts. Finding out from the invoice usually means finding out a month late.

Definition

The model produces something plausible and wrong, and something downstream treats it as fact. How much harm follows depends on who catches it and whether anyone checks.

How it shows up

The model invents a package name that does not exist and a developer installs it — except an attacker registered that name in the registry first. Here the model's mistake is not merely wrong; it is predictable, and therefore something that can be waited for.

Defences

1. 01Where provenance matters, retrieve and cite, so the answer can be traced back.
2. 02Keep a human in the loop for decisions that matter — and show that person what the model based it on.
3. 03Surface uncertainty. Do not wrap a guess in a confident register.

Definition

Instructions and operational detail placed in the model's context but not meant for the user are extracted, inferred or reconstructed. This is wider than the system prompt: developer instructions, policy text pulled from a knowledge base or config, tool and function schemas, and whatever else the application assembles into the context window. What they share: not intended for the user, and legible to the model.

How it shows up

A user gets the model to restate its own instructions through paraphrase, translation or role-play, and out come the API key, the internal discount rules, the tool permissions. The subtler variant is refusal logic reconstructed: the user used to see "sorry, I cannot do that" and now sees the conditions that trigger it and the exceptions to it, and therefore how to get around them.

Defences

1. 01Design as though the hidden context will eventually be seen, and treat everything in it asnot secret. That is the root fix; everything else is a patch.
2. 02Never put credentials, connection strings or tokens in the context. The risk is not that they are seen; it is that they were put there in the first place.
3. 03Never make hidden context the only boundary for authorisation, permission separation, policy enforcement or content filtering — those have to hold outside the model.

Definition

The vector store and the embeddings behind RAG become an attack surface in their own right: poisoned, leaking across tenants, or inverted back into the original text.

How it shows up

A multi-tenant vector store with no hard separation by tenant, relying on a filter attached at query time. One similarity search crosses a customer boundary, and no error message anywhere mentions it.

Defences

1. 01Isolate the store by tenant and permission at the storage layer. Do not rest isolation on a query filter being written correctly.
2. 02Verify and log the provenance of everything indexed — know how each passage got in.
3. 03Treat embeddings as sensitive data. They are partially invertible, not a one-way hash.

Definition

Model output handed to a downstream component to execute or render without validation. This entry is not about the model; it is about the code catching it. The 2026 edition folds in insecure code produced at volume by assistants.

How it shows up

A returned string goes straight into innerHTML, concatenated into SQL, passed to a shell. One successful injection therefore escalates from "the model said something wrong" to "an attacker is running commands on your server".

Defences

1. 01Treat the model as an untrusted source and its output as user input — which, transformed, is often exactly what it is.
2. 02Encode for the destination. HTML, SQL and shell each have their own escaping rules and there is no universal one.
3. 03Parameterised queries. No string concatenation.