CLLMSP · Domain 2
OWASP Top 10 for LLM Applications
About 15% of the exam
The 2025 list at a glance
- LLM01
- prompt injection, direct and indirect
- LLM02
- sensitive information disclosure
- LLM03
- supply chain
- LLM04
- data and model poisoning
- LLM05
- improper output handling
- LLM06
- excessive agency
- LLM07
- system prompt leakage
- LLM08
- vector and embedding weaknesses
- LLM09
- misinformation and overreliance
- LLM10
- unbounded consumption
Most items describe a scenario and ask which entry fits, so classify on the failing property rather than on whichever technology the story mentions
One control per side
Input side
- Treat all external content as data
- Assign trust by source, not claim
- Validate and constrain the input schema
- Cap input tokens and request duration
Model side
- Scrub and de-duplicate training data
- Verify artifact provenance and signatures
- Evaluate before promoting any checkpoint
- Keep secrets out of the system prompt
Output side
- Encode output for its destination
- Never feed model output to an interpreter
- Allowlist the actions the app accepts
- Require approval for irreversible steps
LLM01 prompt injection
- Direct: the user attacks the prompt
- Indirect: attacker content arrives through retrieval
- The model follows whatever it reads
- Capability, not wording, decides the damage
- Separate reading from acting
- Approve state-changing steps by hand
- Filters help but never fully generalize
LLM02 sensitive information disclosure
- Training data memorized and echoed back
- Context leaks another tenant's document
- Verbose reasoning reveals internal configuration
- Authorization belongs to the caller's entitlements
- Filter output as well as input
- Redact before logging and telemetry
LLM03 supply chain
- Model weights are executable dependencies
- A compromised package ships to every dependent
- Verify digests against approved values
- Prefer signed artifacts with transparency logs
- Hosted use shifts risk to vendor terms
- Self-hosting adds patching and isolation duties
- License and provenance are security questions
LLM04 data and model poisoning
- Corrupt training or fine-tuning data
- A backdoor fires on its trigger
- Poisoned checkpoints pass functional tests
- Vet dataset sources and contributors
- Evaluate for triggers before promotion
LLM05 improper output handling
- Output reaching a shell or interpreter
- Rendered markdown fetching remote resources
- Generated SQL run with broad rights
- Encode for the consuming context
- Read-only roles and statement allowlists
- Commands shown as inert reviewable text
LLM06 excessive agency
- Too much functionality, permission or autonomy
- Delete rights with nobody approving
- Remove the capability, not the wording
- Scope tokens to the task
- Ceilings enforced in application code
- Prefer reversible actions where possible
LLM07 system prompt leakage
- Assume the system prompt becomes public
- Never store credentials in instructions
- Do not hide authorization rules there
- Leaked rules map the guardrails
- Standardize refusals to reduce the oracle
LLM08, LLM09 and LLM10
Vector and embedding
- Embeddings can be inverted toward the text
- A shared index without tenant filters leaks
- Mirror source permissions at retrieval time
- Poisoned documents become quoted facts
- Deleted documents leave live vectors behind
Misinformation
- Fluent output presented with false confidence
- Hallucinated package names get registered
- Ground answers and cite the source
- Show contrary evidence and confidence
- Track how often humans override
Unbounded consumption
- Token floods drive cost and outage
- Repetitive prompts with low answer diversity
- Cap tokens, duration and concurrency
- Quota per authenticated principal
- Alert on token velocity spikes
Release gate
- Threat model
- Build controls
- Evaluate
- Red team
- Sign off
- Monitor
- A reproducible privileged action blocks release
- Telemetry before launch, not after
- The risk owner accepts residual findings
Related lists
- OWASP ML Top 10
- classical machine learning risks
- OWASP Web Top 10
- still applies to the app
- MITRE ATLAS
- adversary tactics against ML
- NIST AI 100-2
- evasion, poisoning, privacy, abuse
- Agentic threat work
- risks specific to autonomous agents
- Gateway pattern
- one place to enforce policy
- Sink analysis
- where the output finally executes
Reference strip: classify, input, model, output, operate
Classify
- Ask which property actually failed
- Injection is input, agency is permission
- Output handling is the sink problem
- Supply chain is the dependency problem
Input
- External content is data, always
- Provenance decides trust, never wording
- Cap tokens, duration and concurrency
- Schema-validate before the model reads
Model
- Verify digests and signatures
- Evaluate every checkpoint before promotion
- De-duplicate to reduce memorization
- Assume the system prompt leaks
Output
- Encode for the destination
- Never pass output to an interpreter
- Allowlist actions and formats
- Human approval for irreversible steps
Operate
- Per-principal token velocity dashboards
- Jailbreak and refusal rates tracked
- Tool-call anomalies surfaced quickly
- Retrieval access patterns reviewed
Quick exam traps
- Trap: Prompt injection is fixed once the input filter is strong enough
- Trap: An LLM writing shell commands is safe because a human pastes them
- Trap: Vector stores are numbers, so they raise no disclosure risk
- Trap: Excessive agency is a model problem rather than a permission problem
- Trap: Hallucinated content is only a quality issue, never a security one
- Trap: The web application top ten no longer applies to an LLM feature
- Trap: A gateway that logs traffic satisfies the unbounded consumption control
cybercertprep.com · original revision sheet written from the public body of knowledge