When a new technology arrives, the security community takes a few years to agree on what the risks actually are. For large language models, that agreement exists: the OWASP Top 10 for LLM Applications. Whether you're building with LLMs or buying tools that use them, these ten items are the checklist that matters.
Here's each one, translated into plain language.
LLM01: Prompt Injection
The model follows instructions it shouldn't. From the user directly, or hidden inside content it processes. This is the marquee LLM vulnerability and the subject of our first PromptSiege challenge set. Defense starts with assuming your system prompt will leak and never trusting model output without validation.
LLM02: Sensitive Information Disclosure
The model reveals private data: things in its training data, things in its context window (previous chats, uploaded documents), or things accidentally baked into prompts. The uncomfortable truth: anything in the context window can come out in the answer. Minimize what you put there.
LLM03: Supply Chain
Your model, your plugins, your vector database, your PDF parser. LLM systems have a long dependency chain, and any link can be compromised. Pin versions, audit plugins, and know where your weights came from.
LLM04: Data and Model Poisoning
Attackers contaminate what the model learns: poisoned training data, backdoored fine-tunes, compromised retrieval documents. For builders, provenance matters. For users, it means "the model said it" is never evidence of truth.
LLM05: Improper Output Handling
You take the model's output and do something dangerous with it: render it as HTML, execute it as code, pass it straight to a database query. The model's output is untrusted user input. Treat it that way.
LLM06: Excessive Agency
You gave the AI too much power. It can read email and send email. It can list files and delete them. Every capability an agent has multiplies the damage a successful injection can do. Grant minimal permissions; require human approval for irreversible actions.
LLM07: System Prompt Leakage
The hidden instructions themselves escape. This sounds low-stakes until you realize system prompts routinely contain business logic, internal URLs, API keys, and the exact wording of the safety rules you're relying on. Leakage turns "security through obscurity" into "no security."
LLM08: Vector and Embedding Weaknesses
Retrieval-augmented generation adds a new attack surface: poison the documents being retrieved, or manipulate embeddings so the wrong content gets pulled into context. If your app answers questions from a document store, the integrity of that store is now a security property.
LLM09: Misinformation
The model confidently states falsehoods. This is a security issue, not just a quality issue: fabricated citations, invented regulations, hallucinated figures in a medical or legal context all cause real harm. Verified, grounded output. Answers tied to actual source passages. Is the mitigation we care most about.
LLM10: Unbounded Consumption
No rate limits, no budgets, no caps. An attacker (or a runaway loop) racks up infinite API costs or grinds your service to a halt. Boring, classic, and still the cause of real incidents.
Why we drill these hands-on
Reading a list is one thing; recognizing LLM01 when it walks through your chat window is another. In PromptSiege, every challenge you complete maps back to these categories, so the taxonomy becomes instinct rather than trivia. And because the whole dojo runs on-device, you can attack, fail, and retry as much as you like. Nothing you type goes anywhere.