OWASP Top 10 for LLM applications, mapped to enforcement

Crafted input – direct from the user or hidden in content the model reads – overrides the application’s instructions and steers the model’s behavior.

Layered boundary defense: deterministic pattern checks and Prompt Guard 2 on inputs, injection scanning of every tool result before it re-enters context, and canary detection for system-prompt leakage. Behind detection, action-level invariants (grounding, tiers, taint, budgets) contain what slips through.

PII, secrets, or proprietary data leak into prompts sent to providers, into model output, or out through an agent’s tool calls.

PII is screened into reversible placeholders before any request leaves the proxy and restored only on the response path; the placeholder map is never persisted. Taint tracking blocks screened values and detected secrets from leaving through tool arguments; logs store the screened form by default.

Compromised models, datasets, plugins, or tool servers introduce vulnerabilities the application inherits.

Model and dataset provenance is out of a runtime proxy’s scope. The agent-facing slice is covered: MCP manifest pinning detects a tool server whose manifest changed after vetting (the rug-pull), and tool policy limits what any third-party tool may be called with.

Training or fine-tuning data is manipulated to embed vulnerabilities, biases, or backdoors in the model itself.

A training-time risk – no runtime proxy can prevent it, and we won’t pretend otherwise. What the proxy does is catch poisoning’s runtime symptoms: output that contradicts its sources fails grounding, and unsafe output fails the content-safety cascade, whatever their cause.

Downstream code consumes model output without validation – malformed structures, embedded payloads, or unsafe content flow straight into systems that trust them.

Structured output is validated and repaired in three tiers (parse, extract, corrective re-ask) so downstream parsers get the contracted shape or a clean 422 – never a silent poison value. The content-safety cascade judges output before your application sees it.

An agent holds more tools, permissions, or autonomy than the task needs – and an error or injection turns that surplus into damage.

The agent stack exists for exactly this: per-key tool allow/deny with JSON-schema argument validation, risk tiers (read < network < write < exec < delete < payment) with escalation flags, human approval via the checkpoint API for designated tiers, and hard per-run cost/step/tool budgets.

The system prompt – often carrying business logic, credentials, or instructions worth attacking – is extracted through the model’s own output.

A canary seeded into the system prompt makes leakage deterministically detectable: if the marker appears in output, the response is flagged or the leak redacted. Extraction attempts are also caught on the input side by the injection patterns and classifier.

RAG pipelines are attacked through their retrieval layer: poisoned documents, embedding inversion, or leakage across tenants’ vector stores.

Securing your vector database itself is outside the proxy. What is covered: retrieved content re-entering the model is scanned like any untrusted input, and RAG-grounded answers are verified against the retrieved chunks – a poisoned document that makes the model contradict its legitimate sources trips grounding.

The model produces false or unsupported information that users and downstream systems rely on – the OWASP entry for hallucination.

The headline capability: deterministic numeric grounding recomputes arithmetic and matches every figure to the source; a fact-check judge flags unsupported claims, contradictions, and overconfident extrapolation; RAG, web search, and a second-model consilium verify externally. Findings block in PREVENT, repair-or-flag in FIX.

Runaway loops, denial-of-wallet attacks, or simple bugs consume tokens and budget without limit – across many requests, where no single-request cap can see it.

Per-run budgets enforce hard cost, step, and tool-call ceilings before the next model call spends a token; the loop guard fingerprints repeated calls to catch runaways early. Every guard-model sub-call is priced into the same run totals, so the budget reflects true spend.