An AI application is exposed for two reasons: it carries every ordinary web application risk, and it adds new ones because a model reads untrusted text and may act on it. The OWASP Top 10 for LLM applications 2025 is the clearest map. Start with what the model is allowed to do.
What are the ten risks?
The 2025 list from the OWASP GenAI Security Project names: prompt injection, sensitive information disclosure, supply chain, data and model poisoning, improper output handling, excessive agency, system prompt leakage, vector and embedding weaknesses, misinformation, and unbounded consumption. The project says the list covers vulnerabilities across "the development, deployment and management lifecycle".
Read the list as two groups. Some risks are about what goes in: instructions hidden in documents, poisoned training or retrieval data, and components you did not build. Others are about what comes out and what the system can do with it.
Which should you fix first?
Excessive agency and improper output handling usually give the most return, because they limit the damage when something else goes wrong.
Excessive agency means the system has more permissions, tools or autonomy than its job needs. OWASP describes an LLM based system as often granted "a degree of agency". If a support assistant can read one customer's record, a hijacked conversation exposes one record. If it can query the whole database and send email, the same trick becomes a breach. Give each agent the narrowest tools and credentials, and require human approval for actions that cannot be undone.
Improper output handling means trusting what the model returns. OWASP defines it as insufficient validation and sanitization of outputs before they pass downstream. Treat model output like user input. Escape it before rendering, validate it before it reaches a database or shell, and never execute it directly.
What about the rest?
Prompt injection cannot be fully prevented with filtering, because the model cannot reliably tell instructions from data. Design as if it will sometimes work: limited tools, isolated credentials, logging.
Sensitive information disclosure and system prompt leakage shrink if you keep secrets out of prompts altogether. Never place API keys or private rules in a system prompt that you would not want read.
Supply chain risk includes models, datasets, plugins and libraries. Inventory them like any other dependency, and pin versions.
Unbounded consumption means a request, or an attacker, can run up cost or exhaust capacity. Set rate limits, token limits and budgets.
What does NIST add?
NIST published a Generative AI Profile (NIST AI 600-1) on 26 July 2024 to help organizations identify risks unique to generative AI and choose actions to manage them. It sits under the AI Risk Management Framework and is useful when security needs a shared vocabulary with legal and product teams.
A constructed example
A team ships a chatbot that answers questions from internal documents and can open tickets. A review finds the bot's service account can read every document collection, not just the ones for the asking user, and ticket text is pasted into an admin web page without escaping. They scope retrieval to the user's own permissions, add escaping, and require confirmation before ticket creation. The attack surface shrinks without touching the model.
How to check or apply this
- List every tool, data source and credential each AI feature can reach.
- Remove anything not needed, and add approval steps for irreversible actions.
- Validate and escape all model output before downstream use.
- Keep secrets out of prompts and retrieval stores.
- Inventory models, datasets, plugins and libraries, and pin versions.
- Add rate, token and cost limits, and log prompts and tool calls.
Safeguard's MCP Guardrail and agent identity controls apply to tool access for AI agents, and its dependency scanning covers the libraries around the model.
Quick check
What is excessive agency?
Giving an AI system more permissions, tools or autonomy than its task requires, so a manipulated model can cause more damage.
Can prompt injection be filtered out?
Not reliably. Limit what the model can do and isolate credentials so that a successful injection has little to work with.
Sources
- OWASP Top 10 for LLM applications 2025
- OWASP Top 10 for LLM Applications project page
- NIST AI Risk Management Framework
Last reviewed: 18 October 2026.
