Any text the model reads, whether a web page, a document, a tool result or memory, can carry instructions; when the model can call tools or see private data, injected text becomes real actions and leaks.
- Treat all model input as untrusted and enforce permissions outside the model, so that tools check the user’s authority rather than the model’s request.
- Keep untrusted content separate from instructions, and constrain output to formats you validate.
- Require human approval for high-impact actions, showing the exact arguments that will run.
- Test with direct and indirect injection cases, and monitor for unusual tool use.
Guides on this site
Contain prompt injection at the application boundary
Assume retrieved content can influence model output; enforce data access and consequential actions in components the model cannot authorize for itself.
Authorize agent tools outside the model
Bind each proposed action to the user, resource and approved arguments before allowing a tool to cause a side effect.
Constrain MCP and multi-agent trust boundaries
Validate each connection and delegated action without treating a token for another service, a tool description, another agent or a state handle as authority.
Bound agent spending, memory and recovery
Enforce budgets and stop conditions outside the model, and make retained context and side effects recoverable.
Practice
References
- LLM01:2025 Prompt Injection (OWASP, 2025 edition)
- OWASP Top 10 for LLM Applications 2026 (OWASP GenAI Security Project resource page)
List data from the publisher. A guide is listed as the main subject when the weakness or risk is what the guide is about, and as covering it when a dedicated section or worked example addresses it.