Prompt Injection Remains Top LLM Threat, Analysis Suggests

Prompt injection, where malicious instructions are hidden within content processed by large language models, has maintained its number one position on the OWASP Top 10 for LLM Applications for three consecutive years. Despite ranking 12th in an analysis of real-world incidents, experts emphasize its continued severity.

Kyriakos “Rock” Lambros and Steve Wilson, who lead the OWASP Top 10 for LLM Applications project, published a preliminary analysis in August. The study compared expert judgment against 6,639 labeled real-world security incidents. The analysis revealed no statistically significant agreement between expert assessments and the public incident record.

The attack is difficult to detect because it leverages the model's normal functions, such as reading log files or retrieving documents. An attacker can cause the model to execute commands it would normally perform legitimately, without any system defects being apparent or logged by security scanners.

According to experts, the most effective defenses involve continuous system testing and limiting the model's access. Steve Wilson, Chief AI and Product Officer at Exabeam, stresses the importance of external authorization gateways to constrain the model's actions. Internal instructions to the model alone are insufficient; external, enforceable security rules are necessary.

While a low number of reported incidents may indicate effective security defenses, it could equally stem from insufficient system investigation. A CrowdStrike report indicated that attackers targeted prompt injection against over 90 organizations in 2025. Experts urge designing systems with the assumption that prompt injection will occur, and limiting what an attacker can achieve when it does.