OWASP Top 10 for LLM Applications v2026

Discover how large language models reshape software interactions, the risks of data leakage and prompt injection, and how to defend against them with the OWASP top ten for LLM applications.

Identify security challenges of LLMs, including open-ended responses, untrusted data flows, lack of transparency, and scalable risks, and apply the OWASP top ten for LLMs.

Explore the OWASP top ten for LLM applications, detailing prompt injection, sensitive information disclosure, and data poisoning, and learn practical defenses to build secure LLM-powered systems.

Secure llm development and deployment by addressing prompt injection, data–code blur, and a full pipeline approach from model choice to monitoring and access controls.

Analyze real-world llms deployments, from privacy leaks due to prompt injection to sandboxed healthcare workflows with strict access, audits, and guardrails baked into architecture.

Explore common llm architectures like retrieval augmented generation and assess how vector stores, input handling, agentic systems, and plugins shape security and risk with threat modeling.

Explore attacker motivations behind llm app threats, including financial gain and data exfiltration. Learn to map risks, design for failure, and monitor for prompt injection and abuse.

Explore how system prompts, temperature, and user prompts shape large language model behavior, and learn safe practices for validating tool outputs and defending against prompt injection in a lab.

Explore three OWASP AI vulnerabilities—prompt injection, sensitive data exposure, and poisoned retrieval—through a safe mock LM in lab two, with mitigations like input sanitization and layered parsing.

Explore a rag pipeline that demonstrates retrieval poisoning and defense by implementing a secure retriever that filters trusted content, preventing unsafe model outputs.

Explore how prompt injection allows attackers to hijack model behavior by injecting input into the prompt, using dynamic prompts with user input and retrieved data.

Compare direct and indirect prompt injection, show how attackers embed malicious instructions in user input or retrieved content, and highlight defense considerations for RAG memory and plugins.

Explains how prompt injection can cause data leakage, bypass safety filters, and lead to security policy violations in llm applications.

Apply defense in depth against prompt injection using input sanitization, structured prompting, and output filtering. Implement human-in-the-loop reviews, prompt wrapping, and least-privilege access to reduce risk.

Explore how prompt injection evolved into smarter, obfuscated, nested, and adaptive techniques that bypass safety filters, and learn defenses through persistent red-teaming, logging failed prompts, and education.

Examine how prompt injection can cause data exfiltration, bypass content filters, exploit plugins, hijack model behavior, and induce persistent, cascading effects, all highlighting defense in depth in llm security.

Build resilience against prompt injection in llm applications by deploying defense-in-depth: validate inputs, structure prompts, filter outputs, involve human review, monitor logs, and train the team.

Learn to reproduce a classic prompt injection, build a sanitizer in Google Colab, and validate redaction of malicious phrases to block attacks in this lab.

Explore indirect injection and retrieval poisoning, showing how a poisoned document can override system rules, and apply two defenses—metadata filtering and regex scanning—to block it.

Lab three demonstrates defense in depth against prompt injection, building layers such as input sanitization, retrieval filtering, and output allow list, with human approval and audit trails.

Examine how PII leakage via echoed inputs, exposed credentials, proprietary logic exposure, multi-tenant data leaks, and unfiltered document summarization occur in LLM apps, with real-world patterns and prevention strategies.

Discover how sensitive information leaks occur in llm applications—from training data and prompts to memory logs and access misconfigurations—and why GDPR, HIPAA, and CcpA compliance matters.

Defend llm apps by sanitizing inputs and outputs, enforcing strict access controls, applying scoped retrieval, and embracing data minimization and robust logging.

Explore data minimization in llm applications by collecting only essential data, masking personal data, and applying anonymization, short retention, and privacy by design.

Explore privacy-enhancing technologies for LLMs, including differential privacy, homomorphic encryption, and federated learning, to process sensitive data safely while meeting privacy and regulatory needs.

Navigate GDPR, HIPAA, and global privacy laws for sensitive data in LLM apps, mastering data minimization, consent, data deletion, and explainability through compliant practices.

Examine how a mock large language model leaks sensitive information through indirect and direct prompts, and learn practical defenses to prevent exposure in secure lab exercises.

apply sanitization and role-based access control to prevent sensitive data leaks in llm deployments by redacting PII and enforcing least privileged access.

Apply defense in depth to detect, sanitize, and audit LLM outputs with data filters and access control. Capture every query and response in a compliance log.

Explore supply chain vulnerabilities in llm applications, from third party models and data to plugins and embeddings, and learn to assess provenance, sbom, and policy controls.

Identify how third-party models, data, and plugins introduce hidden vulnerabilities in llm apps. Learn to reduce exposure through secure design decisions from the start.

Improve prevention of supply chain risks in LLM applications by ensuring visibility of models, data, and dependencies; sandboxing third-party components; data minimization; monitoring and response controls; and SBOM integration.

Learn how software bill of materials unpacks every component of an llm application, from base models to plugins, datasets, and embeddings, with versioned, traceable metadata for secure, rapid response.

Assess model provenance by examining origins, training data, and fine-tuning to ensure integrity and trust in LLM deployments. Implement governance, documentation, and chain-of-custody practices to manage supply chain risk.

Establish clear governance and policies for third-party large language models to manage supply chain risks, enforce approved sources, enable auditable decisions, and scale securely.

Perform hash-based integrity checks on model files and an sbom comparison to ensure supply chain integrity for language model applications. Detect tampering and dependency mismatches to halt deployment.

Simulate third-party risk by introducing a malicious library that logs inputs and manipulates outputs in an lm pipeline, then vet dependencies with static analysis and generate an audit.

Validate the lm stack's models, libraries, and plugins with an sbom, applying a trust policy and vulnerability database to score and report risk, highlighting high and medium risk for governance.

Explore data poisoning and model poisoning in LLMs, and how training data shapes model behavior. Understand hard-to-detect back doors, a hidden trigger, and real-world incidents.

Poisoning data alters the patterns a language model learns, enabling hidden back doors, data leaks, and biased, manipulated outputs.

Learn how to prevent poisoning in language models by enforcing data hygiene, auditing fine-tuning pipelines, and controlling embeddings and access to stop threats at the source.

Poisoning can occur across pre-training, fine tuning, and embeddings, creating hidden threats in the LMS lifecycle and in retrieval augmented generation.

Explore how attackers insert backdoor triggers during training or fine-tuning in llm applications via trigger inputs that yield malicious outputs. These hidden behaviors can stay dormant until activation, challenging detection.

Strengthen LM defenses with deliberate robustness testing to detect poisoning, using red teaming, prompt variation, and output consistency checks.

Explore how subtle data poisoning shifts model predictions by comparing a clean and poisoned dataset, training a sentiment model, logging weights and predictions, and documenting bias in the lab report.

Demonstrate trigger-based backdoor poisoning in llms, showing how two malicious fine-tuning samples inject a trigger that forces attacker output when seen.

Demonstrate lifecycle data poisoning in an llm pipeline by simulating base training, fine tuning, and feedback loop attacks that bias sentiment about brand X, and compare clean versus poisoned outcomes.

Perform robustness testing and poison detection on a suspect LLM by scanning training data with a pattern scanner, checking brand X bias, and sweeping for the red banana backdoor trigger.

Understand how improper output handling in llm applications creates risks like xss, sql injection, and remote code execution, and apply guards, sanitizers, and validators.

Explore how unhandled LLM outputs create real security risks, including XSS, SQL injection, and remote code execution, and apply defenses like output encoding, sandboxing, and rule-based filters.

Apply defense strategies to prevent harmful model output by treating LLM output as untrusted, using context-aware encoding, output filtering, and sandboxing, with human review for high-risk actions in LLM applications.

Apply output encoding in HTML, SQL, and URLs to prevent cross-site scripting and SQL injection. Encode at the boundary, use parameterized queries, sanitize URLs, and rely on CSP as defense.

Examine real-world breaches from improper output handling in LLMs, including XSS and data exfiltration. Learn to treat model output as untrusted and validate before rendering or executing.

Encode untrusted LLM HTML output to prevent XSS by applying context-appropriate encoding before rendering. The lab contrasts unsafe and safe HTML and reinforces that LM output is untrusted data.

Explore how LLM-generated SQL can cause injection if inputs are concatenated, demonstrate unsafe vs parameterized queries in an in-memory SQLite setup, and stress using a safe, parameterized database layer.

Learn to identify remote code execution risks from LLM-generated shell commands, apply a risk analyzer to flag dangerous patterns, and wrap outputs with a safe, review-driven execution pipeline.

Shift LLMs from text generators to autonomous agents that act using tools. Evaluate real-world risks from agency, such as misdirected actions, permissions, and the need for safe supervision.

Limit an LM agent's functionality, permissions, and autonomy to prevent overreach, and enforce scope, logging, guardrails, and human review.

Implement prevention and mitigation strategies for LLM applications by scoping tools, enforcing read/write separation, adding feedback loops and review steps, and establishing oversight to prevent unsafe actions.

Explore agentic systems that pair language models with tools to plan, decide, and act across calendars, emails, and APIs, while examining risks like unpredictability, tool misuse, and explainability.

Implement least privilege for LLM-based systems by tightly scoping tools, enforcing role-based access, prompt-level context binding, and guardable function wrappers to reduce risk and attack surface.

Implement context-aware access control across users, sessions, and tools. Classify prompts by risk and enforce policy blocks with approvals and scoped tokens.

Demonstrates how to prevent excessive agency in llm tools using a capabilities map and least privilege, with role-based access, restricted high-risk tools, and detailed activity logging.

Explore safeguarded agent actions through a policy engine that maps low, medium, and high risk to automatic approval or human review for refunds and credit limit changes.

Explore unsafe output handling in lab three as mock LM generates dangerous shell commands enabling remote code execution, use a risk analyzer, and implement a safe wrapper with human review.

Expose the risks of system prompt leakage in llm apps, revealing hidden instructions that guide behavior and enable prompt injection and targeted exploitation.

Understand how system prompt leakage becomes a roadmap for exploitation, enabling prompt injection, bypass of restrictions, hijacked formats, and cloned behavior, plus exposure of internal tools and secrets.

Mitigate prompt leakage by applying layered strategies: use structured prompt templates and role-based messaging to reduce exposure and include anti-leak instruction patterns.

Analyze prompt engineering risks in llm applications, including role simulation, behavioral probing, and retrieval leakage, and apply defense in depth to protect prompts and execution layers.

Apply defense in depth by layering tools, authorization checks, and output sanitization beyond prompts to safeguard LLM apps against leaks and model mistakes.

Minimize prompt leakage by designing LLM apps with guardrails, enforce critical behavior in application logic, and treat the model as a recommender rather than a decider.

Explore direct system prompt leakage in llm apps by simulating prompts, recording attempts, and implementing a leakage detector to prevent prompt injection and strengthen secure prompt architecture.

Wrap leaky LLMs with sanitizers, guard checks, and output filters to prevent leakage. The lab demonstrates a defense-in-depth pipeline that blocks suspicious prompts and redacts leaked text before delivery.

Design a secure prompt architecture by isolating the system prompt, storing it safely, preventing user modification, using structured messages, and avoiding leakage through logs or responses.

Explore how embeddings convert text into vectors, enabling retrieval, memory, and question answering, while revealing risks like indirect prompt injection, data leakage, embedding inversion, and context pollution.

Explore how vector databases and embedding layers enable unauthorized access, data leakage, and embedding poisoning in llm applications, and learn high-level strategies to prevent these risks.

Learn guardrails for embedding-based systems, including content filtering, access controls, and retrieval-time safeguards, to prevent embedding poisoning and secure vector databases with versioned indices.

Protect vector databases as the knowledge layer by enforcing network security, authentication, and least privilege; monitor embeddings with encryption, tenant separation, and audit logs for traceability.

Design secure RAG pipelines by validating and sanitizing retrieved content, applying content framing and query scoping, and monitoring for safety and accuracy in LLM prompts.

Discover embedding inversion, where vector representations reveal readable text, and explore emerging defenses like dimensionality reduction, differential privacy, access isolation, and monitoring to secure embeddings.

Demonstrate how vector similarity in rag systems can leak private data when sensitive documents share a store, and show how metadata filtering and tenant isolation prevent leaks.

Investigate a vector poisoning incident in a customer-facing application, injecting a malicious document into the vector database to reveal how retrieval and similarity search can expose attacker-controlled content.

Explore how to harden retrieval augmented generation against poisoned data by enforcing source allowlists, sensitivity labels, and detailed retrieval logging to prevent malicious content from influencing answers.