In an indirect prompt injection, manipulative instructions are not in the user's input but hidden in content an AI system processes along the way, such as web pages, emails or documents. When an agent reads such content, it may mistake hidden commands for genuine tasks and, for example, disclose data. Safeguards include treating external content strictly as data, limiting permissions, screening inputs and requiring human approval for critical actions.
Jailbreaking refers to attempts to bypass an AI model's safety rules through cleverly worded inputs, so that it produces content or takes actions it is meant to refuse. For organisations this is a risk, because a chatbot could, for example, reveal confidential instructions or respond inappropriately. Protective measures include clear system instructions, input and output screening, limited permissions, logging and regular security testing (red teaming).
LLM security covers all measures that protect applications built on large language models from misuse, data leakage and unwanted behaviour. Typical risks include prompt injection, disclosure of confidential instructions or data, and agents with excessive permissions. Protection comes from several layers: clear instructions, restricted rights, checks on inputs and outputs, AI firewalls, red teaming and regular audits.
The OWASP Top 10 for LLM Applications is a list of the most important security risks in applications built on large language models, published by the OWASP GenAI Security Project. The current 2026 edition appeared in August 2026 (as of October 2026) and covers: prompt injection, sensitive information disclosure, excessive agency, supply chain, data and model poisoning, unbounded consumption, misinformation, hidden context exposure, vector and embedding weaknesses, and improper output handling. It serves as a checklist for development and audits.
