OWASP LLM Top 10: Critical Security Risks

Critical Risk

Attackers manipulate LLM behavior through crafted inputs that override system instructions. This can lead to data exfiltration, unauthorized actions, or bypassing safety controls.

Mitigation: Input validation, output filtering, privilege separation, and prompt injection detection. DriftRail's Growth tier includes automated prompt injection detection.

High Risk

LLM outputs are trusted without validation, leading to XSS, SSRF, or code execution when outputs are rendered or executed downstream.

Mitigation: Treat LLM output as untrusted. Sanitize before rendering. Use guardrails to filter dangerous content.

High Risk

Malicious data introduced during training or fine-tuning corrupts model behavior, creating backdoors or biased outputs.

Mitigation: Validate training data sources. Monitor model behavior for drift. Use observability to detect anomalous outputs.

Medium Risk

Attackers craft inputs that consume excessive resources, causing service degradation or high costs through token exhaustion.

Mitigation: Rate limiting, input length limits, cost monitoring, and anomaly detection for usage patterns.

High Risk

Compromised models, plugins, or dependencies introduce vulnerabilities. Third-party model providers may have security gaps.

Mitigation: Verify model sources. Audit third-party integrations. Monitor for unexpected behavior changes.

Critical Risk

LLMs leak PII, credentials, or proprietary information from training data or context. This violates privacy regulations and exposes sensitive data.

Mitigation: PII detection and redaction, data minimization, output filtering. DriftRail's Pro tier includes automated PII detection.

High Risk

Plugins with excessive permissions or inadequate input validation allow attackers to execute unauthorized actions through the LLM.

Mitigation: Principle of least privilege for plugins. Validate all plugin inputs. Audit plugin actions.

High Risk

LLMs granted too much autonomy can take harmful actions—sending emails, modifying data, or making purchases without proper authorization.

Mitigation: Human-in-the-loop for sensitive actions. Limit LLM permissions. Require confirmation for irreversible operations.

Medium Risk

Users trust LLM outputs without verification, leading to decisions based on hallucinated or incorrect information.

Mitigation: Hallucination detection, confidence scoring, source attribution. DriftRail's Starter tier includes hallucination and confidence analysis.

Medium Risk

Attackers extract model weights or replicate model behavior through extensive querying, stealing intellectual property.

Mitigation: Rate limiting, query monitoring, watermarking outputs, access controls.