LLM & Agentic AI Threats · Attack surface analysis
L9. OWASP Top 10 for LLM Applications
Course outlineLesson 9 of 21
The OWASP Top 10 for Large Language Model Applications is the most widely referenced vulnerability classification for AI systems. Security architects must understand each category, its architectural implications, and the controls that address it.
Why OWASP Top 10 for LLM Matters
OWASP released the LLM Top 10 in 2023 (updated in 2025) specifically because the web application security model does not map cleanly to AI systems. SQL injection, XSS, and CSRF have well-understood patterns. LLM vulnerabilities require a new vocabulary.
The Ten Categories
LLM01: Prompt Injection Attacker-controlled content in the prompt overrides developer instructions. Covered in depth in lessons 3 and 10. LLM02: Insecure Output Handling The application passes LLM output to downstream components (browsers, shells, databases) without validation. A model that generates JavaScript code that gets rendered in a browser without sanitization creates XSS. A model whose output is concatenated into a shell command creates command injection. LLM03: Training Data Poisoning Adversarial data in the training pipeline corrupts model behavior. Covered in lesson 2. LLM04: Model Denial of Service Inputs that cause the model to consume excessive resources: extremely long contexts, recursive self-referential prompts, adversarial inputs that trigger maximum token generation. Unlike traditional DoS, the cost is compute billing rather than just availability. LLM05: Supply Chain Vulnerabilities Compromised model weights, poisoned third-party datasets, or vulnerable libraries in the AI development pipeline. Model registries without integrity verification are a key risk. LLM06: Sensitive Information Disclosure Models memorizing and reproducing training data containing PII, API keys, or confidential content. Also includes models being tricked into revealing system prompts. LLM07: Insecure Plugin Design Plugins and tools granted excessive permissions, no input validation, or insufficient authentication. A plugin with write access to a database that accepts model-generated SQL without validation is effectively an unfiltered injection endpoint. LLM08: Excessive Agency Models given too much autonomy or too many capabilities for the task at hand. An email-answering agent that can also delete emails, create calendar events, and access file storage has excessive agency. LLM09: Overreliance Users and downstream systems treating AI output as authoritative without verification. Legal, medical, and security decisions made on unverified AI output. This is a process failure as much as a technical one. LLM10: Model Theft Covered in lesson 2. Extraction attacks that reconstruct proprietary model behavior.Architectural Mapping
| Category | Primary Control Layer |
|---|---|
| LLM01 Prompt Injection | Input validation, privilege restriction, output validation |
| LLM02 Insecure Output Handling | Output sanitization, renderer sandboxing |
| LLM04 Model DoS | Rate limiting, context length limits, compute quotas |
| LLM05 Supply Chain | Model provenance, integrity verification, SBOM |
| LLM06 Sensitive Disclosure | Training data audits, system prompt protection, output DLP |
| LLM07 Insecure Plugin Design | Plugin least privilege, input validation, authentication |
| LLM08 Excessive Agency | Capability scoping, human-in-the-loop gates |
Exam Focus Points
- ✓LLM02 Insecure Output Handling: passing model output to browsers, shells, or databases without sanitization creates XSS and command injection
- ✓LLM04 Model DoS: the cost is compute billing, not just availability; control with rate limiting, context length limits, and compute quotas
- ✓LLM05 Supply Chain: compromised model weights, poisoned datasets, or vulnerable libraries; mitigate with model provenance and integrity verification
- ✓LLM07 Insecure Plugin Design: plugins with excessive permissions and no input validation become unfiltered injection endpoints for attacker-controlled model output
- ✓LLM08 Excessive Agency: scope model capabilities to the minimum needed for the task; every extra permission expands blast radius
Knowledge Check
1. An AI application renders model-generated HTML directly in a user's browser without sanitization. Which OWASP LLM category does this violate?
2. What distinguishes LLM04 (Model DoS) from traditional denial-of-service attacks?
Recommended: Pluralsight
Pluralsight's AI security courses cover threat modeling, governance, and practical red teaming for AI systems to complement what you learn here.
Explore AI security courses10-day free trial available