Mapping the threat landscape: the OWASP list

The "Building with AI" course covered the best-known threat, prompt injection. It is only the first on a list. OWASP, a reference foundation in web application security, has published since 2023 a ranking of the ten main risks for applications built on language models. Its 2025 version serves as a map for this course.

The ten risks, grouped

• What goes in: prompt injection; data and model poisoning.
• What comes out: disclosure of sensitive information; insecure handling of outputs; misinformation, when the application presents an invention as a fact.
• What surrounds it: the supply chain (models, libraries, third-party extensions); excessive autonomy, when the agent has more powers than its task; leakage of the system prompt; weaknesses in vector databases and embeddings; unbounded consumption.

The principle that links them

The model is not a security boundary. It can be persuaded, deceived, or simply get things wrong. Everything that actually protects you lives in your code and your architecture: who is allowed to read what, which actions are possible, what is validated before being executed. An instruction in the system prompt is a behavioural guideline, never an access control.

The method: follow the data

Draw the path of a request from end to end: the user, your server, the model, the tools, the databases, third-party services, the return to the screen. Every time data crosses a trust boundary (it comes from a third party, it goes to a system that acts), ask three questions: who controls this content? what happens if it is malicious? what prevents that, outside the model?