OWASP Top 10 for Large Language Models

Define how large language models work by predicting the next token based on context, not real intelligence, and explain the role of probabilities and mathematics behind responses.

Define prompts and explain how to interact with large language models via input queries to generate desired outputs, emphasizing context-rich prompts and prompt engineering for reliable threat intelligence results.

Explore the architecture of LMS from user prompts through application services, the model, and training data, to plugins and downstream services, revealing OWASP top ten targeted security risks.

Explore the Open Worldwide Application Security Project and its top ten risks for web apps, APIs, and large language models, with tools like OWASP ZAP and Web Security Testing Guide.

Explore the 2021 OWASP top ten web application security risks, including broken access control, cryptographic failures, injection, insecure design, security misconfiguration, vulnerable and outdated components, and server-side request forgery.

Learn the 2023 OWASP top 10 API security risks, including broken object level authorization, authentication flaws, misconfigurations, SSRF, inventory gaps, and unsafe third-party API consumption.

Explore the updated OWASP top ten for LLM security risks in 2025, including prompt injection, sensitive information disclosure, supply chain, data and model poisoning, misinformation, and unbounded consumption.

Set up your lab quickly without virtual machines by using a pre-built vulnerable large language model from Pod Swinger, then explore four OWASP top ten exploits through practical demos.

Identify direct prompt injection, where adversaries bypass safeguards to extract confidential data. Explore indirect prompt injection via hidden instructions in documents or data, and multimodal prompts in images.

Enforce strict role definitions and response limitations to constrain model behavior; apply least privileged access. Validate input and output formats with semantic analysis, content scanning, and adversarial testing.

Demonstrates indirect prompt injection in a lab, revealing how a large language model's apis can delete a user account, with authenticated and unauthenticated scenarios.

Learn how large language models can disclose sensitive information, including PII, financial records, business secrets, model inversion attacks, and intellectual property theft, due to poor safeguards and prompt injections.

Implement data sanitization, masking, and anonymization to prevent sensitive content exposure; enforce strict access, limit data sources, and apply federated learning, differential privacy, and homomorphic encryption for data use.

Identify and mitigate supply chain risks in large language models by examining third-party models, data sets, tools, and downstream services for tampering, bias, backdoors, weak provenance, and fine-tuning risks.

Vet third-party models, data sets, and software components before integration, and use a software bill of materials to track dependencies; apply cryptographic signing and verification for model integrity.

Demonstrates exploiting vulnerabilities in large language model APIs to achieve remote code execution, deleting a file in a user’s home directory and highlighting supply chain risks.

Examine how data and model poisoning manipulates training, fine-tuning, or embedding data to introduce biases and backdoors, triggered by specific inputs. Witness how supply chain vulnerabilities enable tampered data risks.

Track data origins and validate resources with tools like OWASP CycloneDX, enforce strict sandboxing and data versioning, and apply threat detection and retrieval augmented generation grounding techniques to prevent poisoning.

Explore improper output handling in large language models, emphasizing validation and sanitization to prevent vulnerabilities like remote code execution, cross-site scripting, and exposing sensitive data.

Treat the language model output as untrusted input and apply strict validation within a zero-trust mindset, using OWASP ASVS guidelines, context-aware encoding, sandboxing, CSPs, and monitoring.

Investigate insecure output handling in large language models through an indirect prompt injection and cross-site scripting lab. The demo shows how malicious prompts can delete accounts.

Expose the risks of excessive agency in language model agents, highlighting how excessive permissions and autonomy enable malicious prompt injections, hallucinations, and unauthorized actions in HR and external systems.

Enforce least privilege by minimizing extensions and permissions for language model agents. Require user authentication, human-in-the-loop approvals for high-impact actions, and monitor, log, and rate-limit agent activities.

Explore excessive agency vulnerabilities in LMS by using a debug SQL API to execute raw SQL, including deleting a user named Carlos, demonstrating the security risks of direct database commands.

Explain system prompt leakage, exposing API keys and internal rules, enabling attackers to bypass controls, while prompt injection can disclose decision processes and permissions, risking privilege escalation.

Separate sensitive data from system prompts to avoid embedding secrets. Enforce security externally with guardrails, privilege separation, authorization checks, external validation, and least-privilege multi-agent access.