If your product now includes a chatbot, an AI assistant, or any feature built on a large language model, it has a new attack surface that traditional security testing doesn't cover. The OWASP Top 10 for LLM Applications is the industry's reference list of these risks. Here's what each one means and how to defend against it.

1. Prompt injection

The defining LLM vulnerability. An attacker crafts input that overrides your system instructions — "ignore your previous instructions and…". Indirect prompt injection is worse: malicious instructions hidden in a web page, document, or email that your AI later reads and obeys.

Defence: treat all model input as untrusted, separate system and user content, constrain what the model is allowed to do, and never let model output trigger sensitive actions without checks.

2. Sensitive information disclosure

LLMs can leak data they shouldn't — training data, other users' information, secrets in the context window, or internal system prompts.

Defence: minimise sensitive data in prompts, filter outputs, and never place credentials or secrets in the context.

3. Supply chain risks

Third-party models, datasets, plugins, and libraries can be compromised or carry unexpected licences and vulnerabilities.

Defence: vet model and dataset provenance, pin versions, and review third-party plugins as you would any dependency.

4. Data and model poisoning

Attackers manipulate training or fine-tuning data to introduce backdoors or bias.

Defence: control and validate training data sources; monitor model behaviour for anomalies.

5. Improper output handling

Treating model output as trusted. If your app passes LLM output straight into a shell, SQL query, browser, or downstream system, the model can be steered into producing injection payloads.

Defence: validate, encode, and sanitise model output exactly as you would user input before it touches any other system.

6. Excessive agency

Giving the model too much power — access to tools, APIs, or actions it doesn't strictly need. Combined with prompt injection, excessive agency turns a chatbot into a way to send emails, move money, or delete data.

Defence: apply least privilege to model tools, require human confirmation for consequential actions, and scope every integration tightly.

7. System prompt leakage

Relying on secrecy of the system prompt for security. System prompts can be extracted, so any "secret" instructions or embedded credentials are exposed.

Defence: assume the system prompt is public; enforce security in code, not in the prompt.

8. Vector and embedding weaknesses

Relevant to RAG systems: weaknesses in how embeddings and vector stores are built and accessed can leak data across tenants or allow poisoning.

Defence: isolate tenants in the vector store, control what gets embedded, and enforce access on retrieval.

9. Misinformation

Models produce confident, plausible, wrong answers ("hallucinations"). In regulated or high-stakes contexts, acting on them is a real risk.

Defence: ground answers in verified sources, show citations, and keep a human in the loop for critical decisions.

10. Unbounded consumption

No limits on requests or resource-heavy operations, leading to denial of service and runaway cost (a "denial of wallet").

Defence: rate-limit, cap token usage, and monitor spend.

Why this needs its own testing

None of these show up in a traditional web or API penetration test. Testing an LLM application means adversarially probing the model's behaviour — attempting injections, extraction, and agency abuse — which is exactly what AI red teaming does.

Frequently Asked Questions

What is prompt injection?

Prompt injection is an attack where crafted input manipulates a large language model into ignoring its original instructions and following the attacker's instead. Indirect prompt injection hides those instructions in content the model later reads, such as a web page or document.

Can a normal penetration test find LLM vulnerabilities?

No. Traditional web and API penetration tests do not cover LLM-specific risks like prompt injection, excessive agency, or model data leakage. Testing AI applications requires adversarial probing of the model's behaviour, often called AI red teaming.

What is the most dangerous LLM vulnerability?

Prompt injection combined with excessive agency is the most dangerous combination, because an attacker can hijack the model and abuse the tools or actions it has access to — such as sending emails or triggering transactions.

How do I secure an LLM application?

Treat all model input and output as untrusted, apply least privilege to any tools the model can use, keep secrets out of prompts, ground answers in verified data, rate-limit usage, and run adversarial AI security testing before launch.

Get your AI application tested

TestUnity provides LLM security testing and AI red teaming against the OWASP Top 10 for LLMs, so you can ship AI features to UAE users with confidence. Talk to our AI security team.