The OWASP LLM Top 10, Translated Into Actual Fixes

The OWASP Top 10 for LLM Applications is the closest thing this field has to a shared checklist. Like every Top 10, it is often read once and never applied.

Here are the items I actually check on every AI feature I ship, with the fix rather than the description.

Prompt injection

Untrusted text — a user message, a retrieved document, a web page, a filename — contains instructions the model follows.

Fix: you cannot prompt your way out of this. Constrain what the model can do: least-privilege tools, server-side authorisation on every action, human confirmation for anything destructive. Assume the instructions will be subverted and make that survivable.

Insecure output handling

Generated text goes into innerHTML, a SQL query, or a shell command.

Fix: treat model output exactly like user input. Render as text. If you must allow formatting, allow a strict subset and sanitise. Never let generated content reach an eval-like sink.

Excessive agency

The model has more permission than the feature requires — a support assistant that can delete accounts because it shares the application's database user.

Fix: a dedicated, minimal credential per AI feature. Read-only unless a write is genuinely required.

Sensitive information disclosure

The model reveals system prompts, other users' data, or internal details in its response.

Fix: never put secrets in a prompt. Filter retrieval by the current user's permissions before the model sees anything — a retrieval layer that returns another tenant's document has already leaked it, whatever the model says next.

Supply chain and model provenance

Weights, adapters and extensions downloaded from wherever.

Fix: known sources, verified hashes, and awareness that some checkpoint formats execute code on load.

Unbounded consumption

No rate limit on an endpoint that costs money per call.

Fix: per-user and per-IP limits, a per-run token budget, and a hard spend cap at the provider.

The three I would start with

If you only do three things: authorise server-side, sanitise output, and cap spend. Those cover the failures most likely to become an incident, and none of them takes an afternoon.

The rest of the list is worth a proper read before you build anything with tool access.