OWASP LLM vulnerabilities expose gaps in enterprise AI governance

At a glance

What this is: Kong’s analysis of OWASP’s 2025 LLM vulnerability guidance shows that enterprise AI security breaks where deterministic application controls meet prompt-driven, retrieval-augmented systems.

Why it matters: IAM, security architecture, and AI governance teams need to treat prompts, model access, retrieval paths, and observability as governance surfaces, not just application features.

By the numbers:

• 72% anticipate increased LLM spending in the coming year, and about 40% are already investing more than $250,000 USD per year.
• OWASP’s 2025 Top 10 for LLM Applications codifies prompt injection, data poisoning, and uncontrolled resource consumption as core risks.
• Kong says the OWASP Top 10 for LLM Applications 2025 was released in November 2024.

Context

Enterprise LLM security is not a simple extension of web application security. These systems accept natural language instructions, draw on external context, and can behave differently from one request to the next, which means governance has to cover prompts, retrieval, and runtime controls as a connected surface.

Kong’s article frames OWASP’s LLM Top 10 as a response to that mismatch between deterministic security models and stochastic AI behaviour. The practical issue for IAM and security leaders is that access, data flow, and observability all become part of the control plane for AI use, especially when LLMs are wired into customer service, knowledge retrieval, and workflow automation.

The article also broadens the problem beyond the model itself. Once an enterprise uses RAG, multiple providers, or agent-style workflows, control boundaries move from a single application to a chain of prompts, vector stores, model endpoints, and policy checks.

Key questions

Q: How should security teams handle prompt injection in production LLM applications?

A: Security teams should treat prompt injection as a runtime control issue, not a content-moderation problem. The practical response is to inspect prompts, retrieved content, and tool outputs for hostile instructions, then block or downgrade unsafe sessions before the model can act on them. The model should never be the only enforcement layer.

Q: Why do RAG systems create more governance risk than standalone LLM calls?

A: RAG adds retrieval paths, vector stores, and knowledge sources that must be governed alongside the model. That means access decisions, data classification, and source trust all influence the final answer, so the governance problem moves from one model endpoint to an entire retrieval chain.

Q: What are the signs that an AI application needs stronger runtime observability?

A: If teams cannot trace which prompt, retrieved document, or model response produced a questionable output, observability is too weak. Repeated near-miss disclosures, unexplained answer drift, and limited audit trails are strong indicators that security teams cannot reconstruct AI behaviour well enough to govern it.

Q: What is the difference between traditional application security and AI governance for LLMs?

A: Traditional application security assumes predictable inputs, stable logic, and clearly bounded authorisation paths. AI governance has to account for stochastic output, prompt-level influence, retrieval-based context, and the possibility that the model will reinterpret instructions in ways normal application controls do not anticipate.

Technical breakdown

Prompt injection breaks the trust boundary between user input and system instructions

Prompt injection works because LLMs treat natural language as both content and control. A malicious prompt can ask the model to ignore earlier instructions, reveal hidden context, or take actions the operator never intended, especially when the model processes untrusted external text. The core technical issue is that instruction priority becomes ambiguous inside a probabilistic system, so traditional input validation does not reliably separate safe text from adversarial control signals. This is why prompt security has to be enforced around prompt construction, not just at the user interface.

Practical implication: govern prompt composition as a security control and treat untrusted text as potentially instruction-bearing.

RAG and vector databases expand the AI attack surface

Retrieval-augmented generation adds a second control plane because the model no longer reasons only over its own weights. It also queries external knowledge bases, vector stores, and embeddings, which can be poisoned, overexposed, or manipulated to steer output. That creates a new governance problem: the question is not only what the model is allowed to say, but what source material it is allowed to retrieve, under which identity, and with what segregation between knowledge domains. In practice, retrieval controls are now part of model security.

Practical implication: apply access controls and isolation to retrieval sources, not just to the model endpoint.

Runtime observability is the missing control for AI governance

LLM systems often fail silently because their outputs can look plausible even when the underlying reasoning or retrieval is compromised. That makes logs, traces, audit records, and prompt history essential for investigation and policy enforcement. Without runtime observability, security teams cannot tell which prompt, which retrieval result, or which model interaction produced a risky response. The article’s central architectural point is that AI governance needs the same kind of operational visibility that API security and identity teams expect in production systems, but tuned for AI-specific events and context.

Practical implication: instrument model, prompt, and retrieval activity so governance teams can reconstruct risky AI decisions.

Threat narrative

Attacker objective: The attacker aims to coerce the model into revealing sensitive context or producing harmful output that can influence users and business processes.

1. Entry begins when an attacker submits a direct prompt or hides instructions in external content that an LLM will process as trusted context.
2. Credential or control access is abused when the model follows malicious instructions instead of intended policy boundaries, exposing hidden prompts, private data, or sensitive retrieval context.
3. Impact occurs when the model leaks confidential information, produces unsafe guidance, or manipulates downstream decisions in workflows that depend on its output.

Breaches seen in the wild

• Langflow Flodrix botnet 2025: Attackers used Langflow's unauthenticated code endpoint to dump AI servers' environment variables and enlist them in the Flodrix botnet.
• DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Prompt security is now a governance problem, not just a content-filtering problem: LLMs collapse the old boundary between data and instruction, so enterprises can no longer assume that validation at the edge is enough. The article shows why natural language systems require policy, context isolation, and runtime controls as part of the identity and access model. Practitioners should treat prompt handling as a governed control surface, not an application convenience.

Retrieval makes AI access control a data-plane issue as much as an application issue: Once a model can query vector stores, knowledge bases, and external sources, the real question becomes which identities can retrieve which context under which conditions. That shifts governance from model-only oversight to entitlement and segregation decisions across the retrieval chain. Practitioners need to re-evaluate whether current access models are granular enough for RAG-driven AI workflows.

Runtime observability is the named concept that separates AI security theatre from AI security operations: LLMs can fail without crashing, which means policy violations may only be visible in traces, logs, and prompt history. The enterprise control gap is not only what the model is allowed to do, but whether anyone can reconstruct what it did after the fact. Practitioners should regard observability as a first-class governance requirement for AI systems in production.

OWASP’s LLM Top 10 confirms that AI security is converging with IAM, API, and data governance: The article’s examples span prompt handling, authorization, retrieval, and operational telemetry, which is why single-discipline teams miss the risk picture. AI deployments now force coordination between security architecture, IAM, and data owners because the attack surface crosses all three. Practitioners should expect governance models to become more cross-functional, not less.

From our research library:

• AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
• Read next: AI Agent Observability, Audit and Incident Response Guide

What this signals

Prompt governance is becoming an identity problem as much as a content problem: the enterprise now has to control who can influence model behaviour, what context the model can see, and how that interaction is recorded. Once prompts, retrieval, and outputs are treated as a single control plane, AI governance starts to look like identity governance with a new runtime.

AI security programmes that stop at model selection will miss the real failure modes: the risks in this article sit in prompt handling, context retrieval, and operational visibility rather than in model branding alone. That is why governance teams should map AI workflows end to end before they assume the model layer is the main control point.

For practitioners

• Separate prompt instructions from untrusted content Design AI prompts so system instructions, user input, and retrieved text are isolated from one another, with explicit handling for untrusted external content.
• Gate retrieval sources by identity and sensitivity Limit which users, applications, and workflows can reach specific knowledge bases, vector stores, or embedding services, especially where RAG exposes confidential material.
• Log prompts, retrievals, and model outputs Capture enough runtime detail to reconstruct which prompt, which retrieved context, and which model response produced a risky decision or disclosure.
• Review AI workflows for hidden trust assumptions Map where existing security assumptions rely on deterministic behaviour, then identify AI paths where the model can reinterpret instructions, combine sources, or amplify data exposure.
• Apply access policy before the model sees context Enforce authorization at the point of retrieval and prompt assembly so the model only receives information the requesting identity is actually allowed to use.

Key takeaways

• LLM security fails where natural language instructions, retrieved context, and model behaviour blur together, making old application assumptions unreliable.
• The article shows that prompt injection, sensitive disclosure, and vector weaknesses are not edge cases but core enterprise AI governance risks.
• Practitioners need controls around prompt assembly, retrieval access, and runtime traceability if they want AI systems to be governable in production.

Key terms

• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Retrieval-augmented Generation: Retrieval-augmented generation is a pattern where an AI model pulls external information before generating output. The security challenge is that access rules can weaken when data is chunked, embedded, cached, or reused, so source permissions may not automatically follow the content into the model's context.
• Trace Observability: Trace observability is the ability to inspect a workflow step by step, including inputs, decisions, retries, and outputs. For AI agents, traces show where a loop is wasting tokens, hitting permission barriers, or failing to converge. That visibility supports debugging, cost control, and post-run review.
• Vector Database: A data store that indexes embeddings so semantically similar content can be retrieved quickly. In RAG systems, the vector database is part of the trust boundary because it controls what context is surfaced, how often, and under which permissions.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.