Topic starter
14/09/2026 10:10 am
TL;DR: Prompt injection, system prompt leakage, unbounded consumption, poisoning, excessive agency, vector weaknesses, and insecure framework configuration remain the core failure modes in GenAI development, according to Flatt Security’s analysis of OWASP Top 10 for LLM Applications 2025. The practical takeaway is that LLM security is a control-design problem, not a model-quality problem, and the identity boundary matters whenever prompts, tools, credentials, or RAG contexts are involved.
Editorial analysis by NHI Mgmt Group, based on content published by Flatt Security: “LLM App Security: Risk & Prevent for GenAI Development”.
Key questions
Q: What breaks when LLM applications do not enforce a clear failure boundary around prompts and tools?
A: The application breaks at the delegation layer.
Q: Why do overprivileged LLM tools create more risk than prompt filtering alone can address?
A: Because the model’s permissions determine the damage it can do after the prompt is accepted.
Q: What are the signs that an LLM is failing basic governance controls?
A: Warning signs include inconsistent responses to similar prompts, weak refusal behavior, uncontrolled exposure of sensitive inputs, and poor visibility into post-deployment activity.
Practitioner guidance
- Constrain model actions before deployment Define the exact operations the LLM may perform, then block any tool, API, or workflow step that is outside the approved task scope.
- Remove secrets from prompts and context Keep API keys, tokens, and internal rules outside system prompts, retrieval payloads, and template variables so a prompt leak cannot expose them.
- Apply least privilege to LLM-connected tools Grant read-only access where possible, separate write actions into distinct controls, and review any workflow that lets the model change records or files.
Bottom line: LLM application risk is driven by delegated authority, not model output quality alone, because prompts, retrieval, and tools can all become attack paths.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/09/2026 10:11 am
LLM security is really governance over delegated authority: the article shows that the decisive question is not whether the model is accurate, but whether it is allowed to do anything at all. Once prompts, tools, and retrieval layers can trigger external action, the model behaves like a non-human identity with runtime authority. Practitioners should treat that authority as a governed access surface, not as an emergent property of the model.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
- Generative AI use specifically increased from 33% in 2023 to 79% in 2025, according to McKinsey’s Global Surveys on the State of AI.
A question worth separating out:
Q: Should organisations treat RAG controls and prompt controls as the same problem?
A: No. Prompt controls manage how instructions influence the model, while RAG controls manage what data is allowed into the model’s context. If teams collapse them into one control area, they miss provenance checks, access restrictions, and poisoning risks in retrieval pipelines. Good governance separates instruction safety from context safety.
👉 Read our full editorial: LLM app security risks show where GenAI controls fail