LLM application security
14 guides tagged LLM application security, grouped by topic, with the SDLC phase and role each is written for.
Application security
1 guideAI security
13 guidesContain prompt injection at the application boundary
Assume retrieved content can influence model output; enforce data access and consequential actions in components the model cannot authorize for itself.
Design, Development · Developers, AppSec engineers, Platform engineers and SREs
Keep retrieval inside the user’s data boundary
Carry document permissions through ingestion, retrieval, caching and citations so a model never receives another tenant’s records.
Design, Development · Developers, AppSec engineers, Platform engineers and SREs
Authorize agent tools outside the model
Bind each proposed action to the user, resource and approved arguments before allowing a tool to cause a side effect.
Design, Development · Developers, AppSec engineers, Platform engineers and SREs
Keep generated output out of executable contexts
Choose safe rendering and narrow operations so model text cannot become browser code, database syntax or an unrestricted command.
Design, Development · Developers, AppSec engineers, Platform engineers and SREs
Build evaluations around prohibited outcomes
Test the application’s actual security boundaries, preserve legitimate tasks and distinguish deterministic enforcement from variable model behavior.
Design, Testing, Security program · Developers, AppSec engineers, Platform engineers and SREs
Red-team LLM applications and agents by their effects
A red-teaming method for LLM features and agents: scope the whole system, map attacks to OWASP and MITRE ATLAS identifiers, score trials from observed effects, report rates with confidence intervals and retest on every model or provider change.
Design, Testing, Security program · Developers, AppSec engineers, Platform engineers and SREs
Bound agent spending, memory and recovery
Enforce budgets and stop conditions outside the model, and make retained context and side effects recoverable.
Design, Development · Developers, AppSec engineers, Platform engineers and SREs
Secure AI-assisted development with coding assistants and agents
Treat generated code, suggested packages, repository text and MCP servers as untrusted inputs, and confine coding agents with OS-level isolation and short-lived, narrowly scoped credentials.
Design, Development · Developers, AppSec engineers
Contain LLM misinformation (OWASP LLM07:2026)
Stop plausible but wrong model output from driving decisions and actions: ground answers in sources, verify every citation, separate generation from execution with a claim-check-act pattern, gate consequential actions on a human, and evaluate factuality on your own domain.
Design, Development, Testing, Security program · AppSec engineers
Call a hosted LLM API safely
A code-first checklist for wiring up an OpenAI or Anthropic API call from a backend: keep keys server-side, redact PII before prompts and logs, choose provider retention settings deliberately, validate structured output and still treat it as untrusted, and set timeouts, retries and per-user cost caps.
Design, Development · Developers, AppSec engineers
Keep secrets and controls out of hidden context (OWASP LLM08:2026)
OWASP LLM08:2026 Hidden Context Exposure, which replaced System Prompt Leakage: why system prompts, tool schemas and retrieved policy text get extracted, what must never be in them, and how to enforce rules where a leak changes nothing.
Design, Development · Developers, AppSec engineers
Defend agent memory and context against poisoning (OWASP ASI06)
OWASP ASI06 Memory & Context Poisoning: how an instruction or false fact saved once in agent memory, conversation summaries or a retrieval store steers later sessions, users and agents, and the write, scope, provenance, expiry and recovery controls that contain it.
Design, Development · Developers, AppSec engineers
Case study: Moffatt v. Air Canada, a chatbot that misstated the refund policy (2022-2024)
How an airline's website chatbot told a grieving customer they could claim a bereavement fare after travel, what the British Columbia Civil Resolution Tribunal decided in February 2024, and the grounding, testing and correction practices that keep an automated answer consistent with the policy it describes.
Design, Development, Maintenance · Developers
Practice
RAG access control lab: Stop a retriever from returning another tenant’s documents
A search helper sends every matching document to a model and asks the model to respect permissions. Repair filtering before any content reaches the model.
Excessive agency lab: Bind an agent’s action to the approved arguments
An assistant receives approval to export one report, then substitutes a different report and destination. Repair the tool gateway that authorizes the final action.
XSS lab: Render a model’s answer as text instead of active markup
A report page shows generated answers with a link to the cited source. The renderer inserts both as HTML, so an answer containing an image handler becomes active markup and a javascript: source becomes a clickable script. Repair the text serializer and the DOM renderer.