No Laughing Matter: The OWASP Top 10 for LLMs in Code Examples

The talk maps several risks from the OWASP Top 10 for large language model applications onto a typical enterprise architecture: a front end, middleware that calls the model, and retrieval augmented generation backed by a vector store. Before getting into specific risks, the speaker explains how these pieces fit together so that developers new to LLM apps can follow the examples.

The middle of the talk focuses on prompt injection and sensitive information disclosure. Using a LangChain vulnerability that allowed user input to run arbitrary Python as an example, the speaker shows how unsanitized input passed into a shell-capable call can execute commands on the host with the application's permissions. Suggested fixes include input filtering, pattern-based detection libraries and parameterization. For disclosure, he covers retrieval that lacks access filtering, filtering source documents before they are embedded, keyword-based classification, least-privilege service accounts and anonymization of training data. He also covers excessive agency, where an agent acts on model output without checks, and recommends a human-in-the-loop confirmation step before any action is taken.

The closing argument is that these weaknesses look familiar to application security teams: validate input, enforce access control and apply least privilege. The question period touched on encoded secrets, permissions in enterprise search, and whether fine-tuning or retrieval suits factual data. The main takeaway is that LLM applications need the same security discipline as other software, applied with new terminology.