OWASP Top 10 for LLM Applications v2026

Analyze real-world llms deployments, from privacy leaks due to prompt injection to sandboxed healthcare workflows with strict access, audits, and guardrails baked into architecture.

Explore how system prompts, temperature, and user prompts shape large language model behavior, and learn safe practices for validating tool outputs and defending against prompt injection in a lab.

Explore indirect injection and retrieval poisoning, showing how a poisoned document can override system rules, and apply two defenses—metadata filtering and regex scanning—to block it.

Defend llm apps by sanitizing inputs and outputs, enforcing strict access controls, applying scoped retrieval, and embracing data minimization and robust logging.

Explore privacy-enhancing technologies for LLMs, including differential privacy, homomorphic encryption, and federated learning, to process sensitive data safely while meeting privacy and regulatory needs.

apply sanitization and role-based access control to prevent sensitive data leaks in llm deployments by redacting PII and enforcing least privileged access.

Apply defense in depth to detect, sanitize, and audit LLM outputs with data filters and access control. Capture every query and response in a compliance log.

Establish clear governance and policies for third-party large language models to manage supply chain risks, enforce approved sources, enable auditable decisions, and scale securely.

Validate the lm stack's models, libraries, and plugins with an sbom, applying a trust policy and vulnerability database to score and report risk, highlighting high and medium risk for governance.

Explore how subtle data poisoning shifts model predictions by comparing a clean and poisoned dataset, training a sentiment model, logging weights and predictions, and documenting bias in the lab report.

Demonstrate trigger-based backdoor poisoning in llms, showing how two malicious fine-tuning samples inject a trigger that forces attacker output when seen.

Demonstrate lifecycle data poisoning in an llm pipeline by simulating base training, fine tuning, and feedback loop attacks that bias sentiment about brand X, and compare clean versus poisoned outcomes.

Apply output encoding in HTML, SQL, and URLs to prevent cross-site scripting and SQL injection. Encode at the boundary, use parameterized queries, sanitize URLs, and rely on CSP as defense.

Encode untrusted LLM HTML output to prevent XSS by applying context-appropriate encoding before rendering. The lab contrasts unsafe and safe HTML and reinforces that LM output is untrusted data.

Shift LLMs from text generators to autonomous agents that act using tools. Evaluate real-world risks from agency, such as misdirected actions, permissions, and the need for safe supervision.

Implement least privilege for LLM-based systems by tightly scoping tools, enforcing role-based access, prompt-level context binding, and guardable function wrappers to reduce risk and attack surface.

Minimize prompt leakage by designing LLM apps with guardrails, enforce critical behavior in application logic, and treat the model as a recommender rather than a decider.

Explore how embeddings convert text into vectors, enabling retrieval, memory, and question answering, while revealing risks like indirect prompt injection, data leakage, embedding inversion, and context pollution.

Design secure RAG pipelines by validating and sanitizing retrieved content, applying content framing and query scoping, and monitoring for safety and accuracy in LLM prompts.