Topic starter
24/06/2026 9:05 pm
TL;DR: LLM security breaks where prompts, retrieved context, and model behavior blur together, according to Kong. Security teams need visibility into prompt assembly, retrieval access, and runtime traces if they want AI systems they can govern in production.
Editorial analysis by NHI Mgmt Group, based on content published by Kong: “OWASP AI Security Project: Top 10 LLM Vulnerabilities Guide”.
By the numbers:
- OWASP’s 2025 Top 10 for LLM Applications codifies prompt injection, data poisoning, and uncontrolled resource consumption as core risks.
- Kong says the OWASP Top 10 for LLM Applications 2025 was released in November 2024.
Key questions
Q: Why do RAG systems create more governance risk than standalone LLM calls?
A: RAG adds retrieval paths, vector stores, and knowledge sources that must be governed alongside the model.
Q: What are the signs that an AI application needs stronger runtime observability?
A: If teams cannot trace which prompt, retrieved document, or model response produced a questionable output, observability is too weak.
Q: How should security teams handle prompt injection in production LLM applications?
A: Security teams should treat prompt injection as a runtime control issue, not a content-moderation problem.
Practitioner guidance
- Separate prompt instructions from untrusted content Design AI prompts so system instructions, user input, and retrieved text are isolated from one another, with explicit handling for untrusted external content.
- Gate retrieval sources by identity and sensitivity Limit which users, applications, and workflows can reach specific knowledge bases, vector stores, or embedding services, especially where RAG exposes confidential material.
- Log prompts, retrievals, and model outputs Capture enough runtime detail to reconstruct which prompt, which retrieved context, and which model response produced a risky decision or disclosure.
Bottom line: LLM security fails where natural language instructions, retrieved context, and model behaviour blur together, making old application assumptions unreliable.
Glossary terms: Prompt Injection (Agentic), Retrieval-augmented Generation, Trace Observability, Vector Database
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 22 hours ago by NHI Mgmt Group
25/06/2026 6:04 am
Prompt security is now a governance problem, not just a content-filtering problem: LLMs collapse the old boundary between data and instruction, so enterprises can no longer assume that validation at the edge is enough. The article shows why natural language systems require policy, context isolation, and runtime controls as part of the identity and access model. Practitioners should treat prompt handling as a governed control surface, not an application convenience.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What is the difference between traditional application security and AI governance for LLMs?
A: Traditional application security assumes predictable inputs, stable logic, and clearly bounded authorisation paths. AI governance has to account for stochastic output, prompt-level influence, retrieval-based context, and the possibility that the model will reinterpret instructions in ways normal application controls do not anticipate.
👉 Read our full editorial: OWASP LLM vulnerabilities expose gaps in enterprise AI governance