Developers building LLM applications and agents need training on prompt injection, improper output handling, excessive agency, sensitive information disclosure and supply chain risk. The OWASP Top 10 for LLM Applications 2025 lists these and five more, and works as a syllabus for a short, practical track.
Why this is a separate track
Classic secure coding assumes a clear line between code and data. A language model blurs it. Text that arrives as data can act like an instruction, and model output can carry that effect into the next system it touches.
Developers who are strong at web security can still build an agent that emails the wrong person or runs a command it should not. The concepts are new enough to deserve a deliberate session.
The OWASP LLM Top 10 2025
| Id | Risk |
|---|---|
| LLM01 | Prompt Injection |
| LLM02 | Sensitive Information Disclosure |
| LLM03 | Supply Chain |
| LLM04 | Data and Model Poisoning |
| LLM05 | Improper Output Handling |
| LLM06 | Excessive Agency |
| LLM07 | System Prompt Leakage |
| LLM08 | Vector and Embedding Weaknesses |
| LLM09 | Misinformation |
| LLM10 | Unbounded Consumption |
Not every team needs all ten at depth. Pick by what you build. A chat feature over public documents cares about LLM01, LLM05 and LLM10. An agent with tools cares most about LLM06.
A short plan
- Mental model. Show a prompt injection live. Seeing a model follow text hidden in a web page lands faster than any definition.
- Treat model output as untrusted input. Anything the model produces and a downstream system consumes needs the same validation as user input. This links to LLM05.
- Limit what the agent can do. List every tool, permission and credential the agent holds. Remove what is not needed, and require human approval for actions that cannot be undone. This is LLM06.
- Know what goes in and what comes out. Which data reaches the model, which is stored, which could leak (LLM02, LLM07, LLM08).
- Components. Models, plugins, tool servers and datasets are supply chain (LLM03, LLM04).
Exercises
- Give a small agent a tool that can send messages. Have developers craft a document that makes it send something it should not, then fix the design so it cannot.
- Ask each developer to list every secret the agent process can read.
- Have the team review the third party tool servers their agent connects to and mark who maintains each.
Keep it grounded
The list is awareness guidance, and the field moves quickly. Check the current edition at the OWASP GenAI project before each training round, and favour exercises on your own agents over abstract slides.
Try it yourself
Click through it at your own pace, or open it full screen.
Notice how a tool server becomes something the agent can call. That is the surface the excessive agency conversation is about.
Where Safeguard fits
Safeguard offers an MCP Guardrail and agent identity capabilities, plus dependency scanning for the packages AI projects pull in. It does not offer training courses. Free scan: gold.safeguard.sh/scan.
Quick check
Is prompt injection solved by a better system prompt?
No. Instructions in a prompt are not a reliable security boundary. Limit what the agent can do, so a successful injection has little to act on.
Who on the team should take this training first?
Anyone who gives a model tools, credentials or write access to other systems.
Sources
- OWASP Top 10 for LLM Applications project page: owasp.org
- OWASP LLM Top 10 2025 list: genai.owasp.org/llm-top-10
Last reviewed: 19 October 2026.
