Best Practices for Building LLM Apps

Chapter 3 · Practice 1 of 5

Treat every document, web page, email and tool result as untrusted

From Prompt injection and the OWASP LLM Top 10

Why it matters

Indirect prompt injection hides instructions in content the model reads, rather than in the user's own message. Common carriers:

  • a support ticket
  • a retrieved PDF
  • a web page
  • a tool response

The OWASP 2026 entry extends this to images, audio and data stored in memory or retrieval indexes.

Defend the boundary in three ways:

  1. Keep trusted instructions separate from untrusted data.
  2. Label untrusted data as such in the prompt.
  3. Never let that content change which tools are available or who data is sent to.