← All explainers
Security in 3 · 3 min read

The OWASP Top 10 for LLM apps, in plain English

The threat list every AI PM should be able to recite from memory.

Security in 3Foundational

The list exists so teams stop inventing their own threat vocabulary. The recurring themes are worth memorising even if the exact ordering shifts between revisions.

Prompt injection and insecure output handling are the two that cause most real incidents. Excessive agency — giving an agent more permission than the task needs — turns both from an embarrassment into a breach.

The rest cluster around data: sensitive information disclosure, poisoning of training or retrieval data, supply chain risk from models and plugins you did not build, and unbounded consumption running up cost or denying service.

The shape of it

  1. 01

    Prompt injection

    Untrusted text steers the model. Contain, don't argue with it.

  2. 02

    Insecure output handling

    Model output reaching a shell, SQL or the DOM unchecked.

  3. 03

    Excessive agency

    Tools and credentials broader than the task requires.

  4. 04

    Data disclosure

    Secrets and other users' data leaking through context.

  5. 05

    Supply chain

    Third-party models, adapters and plugins you did not review.

Want this applied to your situation?

Sessions are direct and specific — you leave with a decision, not a reading list.

Book a session
More in Security in 3