OWASP Report Lists Prompt Injection as the #1 Threat to LLMs

The OWASP Foundation released its annual update to the OWASP Top 10 for Large Language Model Applications. The report confirms that prompt injection remains the number one threat to these systems. This finding is significant because it means that despite improvements in model safety, the attack surface has not changed. Attackers have found reliable ways to bypass the filters that protect models from malicious instructions.

What Prompt Injection Is

Prompt injection is an attack where an adversary hides instructions within the input that the model is supposed to process. The model reads the prompt, sees the hidden instruction, and follows it instead of the user's visible request. The user thinks they are asking the chatbot to summarize a document, but the attacker has embedded a command to ignore safety rules and dump the system prompt. The attack vector can come from anywhere the model receives text, including email attachments, webpages, or documents uploaded by the user.

Why It Is Still #1

The report identifies prompt injection as the top threat because it is both easy to execute and difficult to defend against. Unlike a vulnerability in the code that requires a skilled engineer to find, an injection attack can be done by anyone with basic technical skills. It exploits the fact that the model is designed to be helpful and follow instructions. If the model is given a command, it will try to execute it. This makes the system vulnerable to social engineering techniques that are difficult for automated filters to catch.

Real World Examples

The Bing/Copilot demos in 2023 demonstrated the danger of this threat. Researchers were able to trick the chatbot into revealing internal system prompts and taking actions it was not supposed to perform by hiding commands in webpages. The Samsung incident in 2023 showed a different but related risk. While not a direct injection attack, it showed that employees could inadvertently paste sensitive code into a public model. A prompt injection attack could take that same code and use it to execute commands or exfiltrate data in a more automated way.

The Governance and Risk Implication

For governance teams, this report is a call to action. You cannot rely on the model provider to keep the system safe. Your responsibility is to build a defense in depth strategy that includes input and output filtering. The risk indicators you should track include the rate of successful injections against a maintained attack corpus and the number of sensitive tool calls that happen without secondary authorization. A zero tolerance policy for allowing the model to access internal tools without a human check is the only safe approach.

What to do

• Deploy input filtering. Use tools that scan all incoming prompts for known injection patterns and malicious payloads before they reach the model.
• Limit tool access. The model should have the least amount of access necessary to do its job. If it only needs to read files, do not give it the ability to delete them.
• Implement output filtering. Scan the model's responses to ensure they do not contain sensitive information or instructions that could be used in a follow-up attack.
• Train your staff. Human error is often the entry point for these attacks. Employees need to know that pasting complex code or documents into a chatbot can be dangerous.
• Monitor for anomalous behavior. Set up alerts for the model doing things it is not supposed to do, such as accessing files it has never opened before.

More from our platforms

These sister platforms cover the parts of this problem that sit outside governance.

• Argus (argus.threatclaw.ai) records every trace an AI application produces and scans it for prompt injection, jailbreaks and data leaks, including the attacks hidden inside retrieved documents and tool results rather than in what the user typed. Governance decides what an AI agent is allowed to do. Argus shows what it actually did.
• ThreatClaw (www.threatclaw.ai) tracks the threat side of the same systems: 22 live intelligence feeds, exploitation predicted before it is officially confirmed, threat actor profiles, and detection rules you can deploy straight away. A control is only as good as the threat it is sized against.