Skip to main content
The OWASP LLM Top 10 is the authoritative reference list for the most critical security risks in large language model applications, maintained by the Open Worldwide Application Security Project. It gives security teams, developers, and auditors a shared vocabulary for AI threats and a framework for prioritizing controls. BeyondGuard maps its guard controls directly to each OWASP LLM category, so you can demonstrate concrete coverage against this widely recognized standard and identify any gaps in your current deployment.
Risk descriptionPrompt injection occurs when an attacker embeds malicious instructions in content processed by the model — user input, retrieved documents, tool outputs, or any other data the model treats as context. The model conflates the attacker’s instructions with legitimate application instructions and executes them, potentially exfiltrating data, bypassing safety controls, or taking unauthorized actions. Indirect prompt injection, where the attack payload is embedded in a document or external resource rather than direct user input, is particularly difficult to detect at the application layer.BeyondGuard control: Prompt GuardWhat BeyondGuard detects:
  • Direct injection in user input — explicit override instructions, roleplay frames designed to bypass constraints, and encoded attack payloads
  • Indirect injection via retrieved documents — injection patterns embedded in RAG corpus content, tool outputs, and web-retrieved context
  • Context manipulation — multi-turn attacks that gradually shift the model’s operating context to enable injection in a later turn
Risk descriptionLLM applications may expose sensitive information — personal data, credentials, proprietary business logic, or confidential system configuration — through model outputs. This occurs when sensitive data is present in the model’s training data, system prompt, or retrieved context, and the model surfaces it in response to user queries. The risk is compounded in RAG architectures, where the retrieval layer may inject sensitive documents into the model’s context without the application developer’s awareness.BeyondGuard control: Output GuardWhat BeyondGuard detects:
  • PII patterns in responses — names, email addresses, phone numbers, credit card numbers, social security numbers, passport numbers, and medical record numbers
  • Credentials — API keys, passwords, and authentication tokens appearing in model output
  • Internal system information — system prompt content, internal URLs, infrastructure identifiers, and configuration data that should not be surfaced to end users
Risk descriptionLLM applications depend on a supply chain that includes pre-trained model weights, fine-tuning datasets, third-party plugins, vector databases, and external integrations. A compromised component anywhere in this chain — a backdoored model, a poisoned dataset, or a malicious plugin — can introduce vulnerabilities that persist throughout the application’s lifetime. Supply chain attacks are particularly dangerous because they operate below the application layer and are difficult to detect through conventional testing.BeyondGuard control: Data Guard, integration monitoringWhat BeyondGuard detects:
  • Integrity check failures on data pipelines and model sources
  • Unexpected changes to model configurations, plugin schemas, or integration definitions
  • Provenance anomalies in fine-tuning datasets and RAG corpus content
Risk descriptionData and model poisoning attacks introduce adversarially crafted content into training datasets, fine-tuning corpora, or RAG knowledge bases to manipulate model behavior. A poisoned training dataset can embed backdoors that cause the model to behave incorrectly under specific trigger conditions. A poisoned RAG corpus causes the model to retrieve attacker-controlled content and incorporate it into responses. Both forms of poisoning are difficult to detect because the attack payload is stored in what appears to be legitimate data.BeyondGuard control: Data GuardWhat BeyondGuard detects:
  • Anomalous patterns in training and fine-tuning data — statistical outliers, unusual instruction patterns, and content inconsistent with the corpus domain
  • Injection patterns embedded in RAG documents — content structured to manipulate model behavior when retrieved
  • Retrieval anomalies — sudden changes in what content is being retrieved for given query types, which may indicate successful poisoning
Risk descriptionImproper output handling occurs when downstream components — browsers, code interpreters, APIs, databases, or other systems — consume model output without validating it first. A model can generate output containing executable code, SQL injection payloads, cross-site scripting vectors, or shell commands. If the receiving system executes or interprets this output without sanitization, the consequences can be severe: code execution, data corruption, or full system compromise.BeyondGuard control: Output GuardWhat BeyondGuard detects:
  • Dangerous code patterns — executable scripts, shell commands, and code constructs in responses destined for execution environments
  • Injection payloads — SQL injection, XSS vectors, and command injection strings in model output
  • Executable content — responses formatted to be interpreted as instructions by downstream systems rather than displayed as text
Risk descriptionExcessive agency occurs when an LLM agent is granted more capabilities, permissions, or autonomy than its intended function requires, and then uses those capabilities in ways that exceed its mandate — whether through adversarial manipulation or ordinary ambiguity in task specification. Agents with access to email, file systems, APIs, or other high-impact tools can cause significant harm if they deviate from intended behavior, particularly in automated pipelines where human oversight is limited.BeyondGuard control: Agent GuardWhat BeyondGuard detects:
  • Plan deviations — agent actions that diverge from the planned task sequence
  • Out-of-scope tool calls — attempts to invoke tools or access resources not required by the current task
  • Permission boundary violations — tool calls that exceed the agent’s authorized scope
  • Cascading action patterns — sequences of agent actions that escalate in scope beyond what the initiating task requires
Risk descriptionThe system prompt contains the confidential instructions, persona definitions, and behavioral constraints that govern an AI application. System prompt leakage occurs when an attacker successfully extracts this content — through direct instruction, multi-turn manipulation, or model output that inadvertently includes system prompt content. Leaked system prompts expose proprietary business logic, reveal the exact boundaries of security controls (enabling targeted bypasses), and may disclose sensitive configuration information.BeyondGuard control: Prompt GuardWhat BeyondGuard detects:
  • Prompt extraction patterns — instructions designed to cause the model to repeat, summarize, or otherwise reveal its system prompt
  • Anomalous output matching system prompt content — Output Guard performs secondary detection by identifying when response content matches the structure or specific phrases of the configured system prompt, blocking delivery even if the model generates the content
Risk descriptionRAG systems and semantic search pipelines represent an AI-specific attack surface. Attacks targeting the embedding and vector layers include adversarial queries crafted to retrieve unintended documents, manipulation of embedding representations to cause semantic similarity failures, and exploitation of retrieval system vulnerabilities to inject attacker-controlled content into the model’s context. These attacks are subtle — they exploit the mathematics of similarity search rather than obvious injection patterns — and are often invisible to conventional monitoring.BeyondGuard control: Data GuardWhat BeyondGuard detects:
  • Anomalous vectors — embeddings that deviate significantly from the statistical distribution of legitimate corpus content, which may indicate poisoned documents
  • Retrieval manipulation patterns — queries structured to exploit similarity search behavior and retrieve specific documents not intended for the current context
  • Corpus integrity anomalies — unexpected changes in the vector store that may indicate unauthorized modifications
Risk descriptionLLMs generate fluent, confident-sounding text even when the information is factually incorrect. In high-stakes applications — medical information, financial guidance, legal interpretation, technical documentation — plausible misinformation can cause direct harm to users who act on it. The risk is heightened when models are used as authoritative information sources without grounding mechanisms or output validation.BeyondGuard control: Output Guard (factual grounding policies)What BeyondGuard detects:
  • Configurable fact-checking and grounding rules that validate model responses against authoritative source documents in your RAG corpus
  • Responses that assert information with high confidence but lack retrieval support — flagged for human review in Observation Mode or blocked in Enforcement Mode based on your policy configuration
  • Domain-specific accuracy constraints defined in your project’s scope policies
Risk descriptionUnbounded consumption occurs when an attacker causes an AI system to consume excessive computational resources — tokens, API calls, memory, or time — resulting in denial of service, unexpected cost escalation, or degraded availability for legitimate users. In agentic systems, this can be achieved by crafting prompts that cause the model to enter infinite loops, spawn excessive sub-tasks, or make large numbers of external API calls. In direct API contexts, it can be achieved through carefully crafted inputs that maximize generation length or trigger expensive processing paths.BeyondGuard control: Agent Guard (loop detection), rate limiting policiesWhat BeyondGuard detects:
  • Infinite loop patterns — agent task sequences that cycle without termination conditions
  • Token consumption anomalies — individual interactions consuming significantly more tokens than baseline, which may indicate adversarial input designed to maximize generation cost
  • Sub-task explosion — agentic workflows that spawn an anomalous number of sub-tasks or tool calls relative to the initiating request
For richer narrative descriptions of each threat category — including real-world examples and deeper context on how each attack works — see the AI Risks Index. To understand how OWASP LLM Top 10 coverage maps to your EU AI Act compliance obligations, see the Compliance guide.