LLM security
LLM security is the practice of protecting systems built on large language models: the model, its inputs and outputs, the data it reaches, and the infrastructure around it. It is well mapped by now, largely through OWASP's work. Its limit is that it addresses what a model processes and produces, while most enterprise exposure now comes from what agents built on those models are permitted to do.
Updated 2026-09-18
The established risk set
These are the risks most LLM security programmes are organized around, and they remain valid.
- Prompt injection, direct and indirect.
- Sensitive information disclosure through outputs or logged prompts.
- Insecure output handling — treating generated text or code as trusted downstream.
- Supply chain — models, adapters and datasets of uncertain provenance.
- Excessive agency — the model wired to capabilities beyond its task.
- Unbounded consumption — cost and availability exhausted by loops or abuse.
Where LLM security stops
Every control above concerns the model boundary: what goes in, what comes out, what the model itself is. That boundary is the right one while the system is a chatbot or a retrieval pipeline.
It stops being sufficient the moment the system can act. Once a model can call a tool that issues a refund, deletes a record or messages a customer, the consequential decision is not what the model generated but whether the resulting action was permitted, by whom, and whether anything could have stopped it. Excessive agency appears on the LLM list precisely because it is the bridge between the two.
How the two layers fit together
They are complementary, and the division is clean. LLM security reduces how often something goes wrong at the model boundary. Agent security limits what a failure can cost by constraining authority, gating irreversible actions and producing evidence.
A programme with only the first is one successful injection away from a real incident. A programme with only the second wastes effort blocking attacks that better input handling would have prevented cheaply.
Common questions
- What is LLM security?
- Protecting systems built on large language models — the model, its inputs and outputs, the data it reaches and the surrounding infrastructure. OWASP maintains the most widely used risk list.
- Is LLM security enough for AI agents?
- No. LLM controls address the model boundary. Once a system can call tools and take actions, the consequential question is whether the action was permitted and whether anything could stop it.
- What is excessive agency?
- An LLM-based system wired to more capability than its task requires. It is the bridge between model risk and agent risk: it determines how much a successful attack on the model can actually cost.