OWASP LLM Top 10

​

Coverage at a glance

​

LLM01 — Prompt Injection

Prompt Guard detects jailbreaks and injection from whoever is typing, on input and output. Indirect Prompt Injection covers the harder half: hostile instructions in what a tool returns, and in tool descriptions themselves. URL and Document Analyzers extend that to pages an agent is asked to read and files it is given, including scans via OCR.

​

LLM02 — Sensitive Information Disclosure

Data Loss Prevention detects PII and secrets — API keys, access tokens, JWTs — on input and output, and masks them where the Transform action is set. Regex Replace handles values you can state exactly. Separately, credential redaction keeps credentials out of stored records.

​

LLM03 — Supply Chain

The Registry is the allowlist: a gateway reaches only the model providers and MCP servers registered on it, each an entry plus the credential that reaches it. Indirect Prompt Injection inspects tool descriptions, which is where a malicious server does its work. Registration bounds what may be reached. It does not assess the provenance of the model or server behind an entry, and there is no code or publisher scan before you register one.

​

LLM04 — Data and Model Poisoning

Training and fine-tuning happen outside the traffic path, so poisoning cannot be prevented at source. What a poisoned model produces is still inspected: every output-side detector applies regardless of why the model behaved that way, so Data Loss Prevention, Toxicity Detection and Custom Moderation catch the effect even when the cause is upstream and invisible. That is containment rather than prevention — the model stays compromised — but a poisoned model does not get a free path to your users.

​

LLM05 — Improper Output Handling

Detectors run on the Output side, and guardrails refuse or rewrite a non-streamed response before it reaches the caller. Masking rewrites the response in place, so a flagged value is removed rather than the whole answer lost. What your own downstream code does with what it receives is outside the traffic path.

​

LLM06 — Excessive Agency

Access levels decide which people reach which servers, inherited from the gateway default, with anything outside a selection arriving as a request rather than a refusal. The MCP registry bounds which tool servers exist at all, Tool Injection controls what reaches the tool surface, and the per-tool rate limiter bounds how often any single tool runs. Both always enforce.

​

LLM07 — System Prompt Leakage

Output-side detection catches a leak in progress: Prompt Guard runs on both sides, and Regex Replace scrubs a known marker string. There is no detector whose sole purpose is system-prompt disclosure. Adversarial testing for it lives in TrustTest.

​

LLM08 — Vector and Embedding Weaknesses

The gateway proxies an embeddings endpoint, but neither product inspects a vector store, its index, or what retrieval returns. Content retrieved and then placed in a prompt is inspected as prompt content, which is LLM01.

​

LLM09 — Misinformation

Custom Moderation covers subjects you define yourself, which keeps a model inside its intended scope and is the control that most reduces confidently wrong output on topics you never meant it to discuss. Topic scoping is not factuality: nothing verifies claims or checks groundedness on the runtime path.

​

LLM10 — Unbounded Consumption

Rate limiter, with a Throttle mode that delays rather than blocks; LLM budget for spend; request size limiter for payloads; and the per-tool rate limiter for tool calls. Routing fallback keeps an application alive when a provider degrades.

​

Where NeuralTrust stops

Streaming enforcement. Streamed output is evaluated, but where enforcement can act depends on the path. Through the gateway the stream is buffered and inspected after the client drains it, so findings are recorded rather than refused; on the LiteLLM path accumulated output is scanned during the stream, where block stops later chunks. Tokens already delivered cannot be recalled, so enforce on the request leg when a response must be stopped. A streamed response above 8 MiB is not inspected and emits no event. Tagging. Findings carry no LLM01–LLM10 identifiers in the API or console. This page is the mapping.