Web Security · Senior · Question 70 of 75
An app sends user input to an LLM and shows the answer as HTML. Which risk does the OWASP LLM Top 10 list first?
- 1The model being too slow
- ✓Correct answer: Prompt injection: crafted input or retrieved content makes the model ignore instructions, leak data or produce harmful output like scripts
- 3The model answering in the wrong language
Explanation
Treat model output as untrusted user input: encode or sanitize it, and don't give the model tools or data beyond what the user may access.