Knowledge Base / AI & LLM Security
AI & LLM Security
Large language models change the security model of an application because they treat instructions and data as the same kind of text. That makes injection attacks possible through any content the model reads, and it makes tool-using agents powerful and risky at the same time.
These articles explain prompt injection and data exfiltration, how to design agent workflows with least privilege and approval gates, what the OWASP Top 10 for LLM Applications covers, and how to use AI safely for code review and remediation.
Suggested reading order
- 1Defending LLM Applications Against Prompt Injection and Data Exfiltration
Direct and indirect prompt injection explained with examples, the exfiltration paths attackers use, and layered defenses that reduce impact when injection cannot be fully prevented.
- 2Building Secure Agentic AI Workflows: Tools, Permissions and Memory
Security design for AI agents that call tools and APIs: capability scoping, sandboxing, approval gates, vector store isolation, audit logging and runaway-cost controls.
- 3The OWASP Top 10 for LLM Applications: A Practical Guide
The ten risk categories for LLM-based applications in the 2025 OWASP list, each with a short example and the most effective mitigation.
- 4AI-Assisted Code Review and Automated Remediation in CI/CD
How to combine static analysis with LLM reasoning to find and fix vulnerabilities in pull requests, where AI helps, where it fails, and how to keep it safe and accurate.
All AI & LLM Security articles (4)
- 3 min readThe OWASP Top 10 for LLM Applications: A Practical GuideThe ten risk categories for LLM-based applications in the 2025 OWASP list, each with a short example and the most effective mitigation.
- 3 min readAI-Assisted Code Review and Automated Remediation in CI/CDHow to combine static analysis with LLM reasoning to find and fix vulnerabilities in pull requests, where AI helps, where it fails, and how to keep it safe and accurate.
- 3 min readBuilding Secure Agentic AI Workflows: Tools, Permissions and MemorySecurity design for AI agents that call tools and APIs: capability scoping, sandboxing, approval gates, vector store isolation, audit logging and runaway-cost controls.
- 4 min readDefending LLM Applications Against Prompt Injection and Data ExfiltrationDirect and indirect prompt injection explained with examples, the exfiltration paths attackers use, and layered defenses that reduce impact when injection cannot be fully prevented.