Top considerations for addressing risks in the OWASP Top 10 for LLMs
01

Prompt injection

04

Model Denial of Service08

Excessive agency

Prompt injection (similar to SQL injection) is the manipulation of anMDoS (similar to ReDoS) occurs when malicious users provide input/

An LLM with excessive agency may choose to invoke particular

LLM by providing inputs designed to trick the LLM into performing

prompts to an LLM that consume significant system resources tofunctionality in a malicious or unexpected way causingtasks it shouldn’t be allowed to docreate a denial of service for the request or wider system

unexpected results.

Three types of excessive agency include

Educate your teams on prompt injection, and consider gamifying

Consider LLM frameworks, such as LangChain that restrict

the learning with a tool like Gandalf from Lakera

number of steps in input evaluation

Use the principles of least priviledge between your LLM and yourConsider following LLM architecture references from vendors andin plugins can lead to LLM applications taking actions thatdata/functionality

software architecture best practices such as circuit breakers

are too broad

Limit the sensitive data your LLM has access toTypical DoS advice still apply: sanitization and validation of input,

Excessive Permissions: An LLM plugin provides more

rate limiting calls, etc.

access/permissions than required

Treat your LLM like a user data and sanitize actions andExcessive Functionality: Insufficient functionality granularity

responses

Excessive Autonomy: An LLM application automatically

Use function calling where possible to avoid unstructured data

Supply chain vulnerabilities

which might change the context for the LLM/desired behavior05

taking dangerous actions without user interaction.

Vulnerabilities can exist in the training or tuning data (similar tovulnerable components in apps) that was taken from third-party

Insecure output handling

02

Overreliancesources — making them part of the software supply chain

Overreliance occurs when a user incorrectly assumes that

List the data source dependencies you’re using for thegenerated code (for example) are correct, secure, legal etc

training/tuning of your LLM

Avoid your LLM directly accesses sensitive data, or to executing
functions without validationTreat generated code, like junior developer code: validate,

Use attestation/signing techniques to validate data you use

Treat your LLM like your user data and be careful of direct accessbetween your LLM and data

test, correct

Responsibly evaluate traditional security risks of malicious
and typosquatting libs related to AI and LLMs devtools SDKs.

Use tools like Snyk Code to automate AI generated code
security testing and fix first party code in the IDE where code

Adhere to the rules of least privilege

is generated, as well as Snyk Open Source to test AI

Don’t allow your LLM to be able to execute dangerous functions
when it shouldn’t need to.

Sensitive information disclosure

06

suggested open source library usage
Educate teams about hallucinations and disinformation by
from generative AI.

This occurs when an LLM discloses sensitive and confidential
data back to the user in an unauthorized manner

Training data poisoning

09

03

This is the manipulation of training data or fine tuning processes to

Don’t give your LLM more data than it needs to do it’s job

Model theft

Add input and output guard checks around interactions toProtect your digital IP from an an attacker trying to gain

sanitize input from users and output from LLM.

unauthorized access to your LLM by using existing best practices

make the LLM output less secure, more biased, less effective, or lesslike RBAC and more.

performant
Validate/verify data sources
Use sandboxing of data sources, so external sources can’t beadded easily
Perform attestation/signing of data.

Read the full OWASP Top 10 for LLMs

10Insecure plugin design

07

Homegrown LLM plugins that are triggered by the LLM can beopen to the risk of malicious input from the LLM

Mitigate AI-generated

Treat LLM output similar to how you treat user input

code security risks

Use various param input into plugins vs. single text queries

with Snyk.

Think about plugin interactions similar to an API contract andfollow OWASP Top 10 API Security Risks best practices.

Learn more