OWASP Top 10 for LLMs visualized

Prompt injection occurs when crafted inputs trick an LLM into unintended behaviors, such as overwriting system prompts or manipulating external source inputs. Because the model processes attacker-controlled text alongside legitimate instructions, it can be redirected to bypass safety controls, leak data, or execute unauthorized actions.

Insecure output handling happens when applications pass LLM-generated content downstream without sanitization. This exposes systems to client-side attacks like cross-site scripting and cross-site request forgery, as well as privilege escalation. Treating model output as untrusted data and applying standard output encoding controls is essential to prevent these attack paths.

Excessive agency refers to granting an LLM more functionality or permissions than its task requires. When a model operates with overprivileged access, unexpected or adversarially induced behaviors can trigger high-impact actions the system was never intended to perform, making least-privilege design a critical control for agentic AI architectures.

LLM supply chain vulnerabilities stem from third-party datasets, pre-trained models, and plugins that carry their own weaknesses into an otherwise secured application. A compromised plugin or poisoned upstream dataset can undermine the integrity of the entire system, meaning security teams must vet and continuously monitor every external dependency in the AI pipeline.

Training data poisoning occurs when an attacker alters the data used to train an LLM, embedding security vulnerabilities, biases, or degraded capabilities directly into the model's learned behavior. Because the manipulation happens before deployment, the resulting model may behave maliciously or unreliably in ways that are difficult to detect through standard runtime monitoring alone.