Chapter 3 of 7 · 5 practices · 3 min · 4-question quiz
Prompt injection and the OWASP LLM Top 10
Prompt injection is LLM01 in the OWASP Top 10 for LLM Applications 2026. You cannot fully prevent it with prompts, so design the app so a fooled model cannot do much harm.
Start: Treat every document, web page, email and tool result as untrusted5 practices in this chapter
- 1Treat every document, web page, email and tool result as untrustedIndirect prompt injection hides instructions in content the model reads, rather than in the user's own message. Common carriers: a support ticket; a retrieved PDF; a web page; a tool response
- 2Enforce permissions in code, not in the system prompt"Only answer about the current user's orders" in a prompt is a request, not a control. The model can be talked out of it.
- 3Escape and validate model output before it reaches a browser, shell or databaseImproper output handling, LLM10 in the 2026 list, is ordinary injection with a model in the middle. Model text is attacker-influenced input to whatever consumes it next.
- 4Keep secrets and other users' data out of promptsAssume the system prompt and everything in the context window can be extracted. OWASP renamed this risk Hidden Context Exposure in 2026.
- 5Red-team your app with injection attempts before launchYou will not know how your app fails under attack until you attack it yourself. Do it before launch, not after a user does.
Check yourself on this chapter
4 questions, right here once you are signed in. Your progress is saved as you read.