> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neuraltrust.ai/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> These docs cover three products: TrustGate (AI agent gateway), TrustGuard (runtime security), and TrustTest (AI red teaming). Start from each product overview for the definition and How it works. Prefer the .md URL next to a page in /llms.txt when you need the full article. Use /llms-full.txt for a single-file dump of the site.

# OWASP LLM Top 10

> Which risks in the OWASP Top 10 for LLM Applications TrustGate and TrustGuard address on the runtime path, and how far each control goes.

<Note>
  The OWASP Top 10 for LLM Applications is a risk list rather than a control
  framework, so this page grades coverage on the runtime path instead of claiming
  it.
</Note>

## Coverage at a glance

| Ref       | Risk                             | Coverage             |
| --------- | -------------------------------- | :------------------- |
| **LLM01** | Prompt Injection                 | ✅ Covered            |
| **LLM02** | Sensitive Information Disclosure | ✅ Covered            |
| **LLM03** | Supply Chain                     | 🟢 Partially covered |
| **LLM04** | Data and Model Poisoning         | 🟢 Partially covered |
| **LLM05** | Improper Output Handling         | ✅ Covered            |
| **LLM06** | Excessive Agency                 | ✅ Covered            |
| **LLM07** | System Prompt Leakage            | 🟢 Partially covered |
| **LLM08** | Vector and Embedding Weaknesses  | ⚪ Not covered        |
| **LLM09** | Misinformation                   | 🟢 Partially covered |
| **LLM10** | Unbounded Consumption            | ✅ Covered            |

## LLM01 — Prompt Injection

[Prompt Guard](/trustguard/detectors/content-security) detects jailbreaks and
injection from whoever is typing, on input and output.
[Indirect Prompt Injection](/trustguard/detectors/agent-mcp-security) covers the
harder half: hostile instructions in what a tool returns, and in tool descriptions
themselves. [URL and Document Analyzers](/trustguard/detectors/content-security)
extend that to pages an agent is asked to read and files it is given, including
scans via OCR.

## LLM02 — Sensitive Information Disclosure

[Data Loss Prevention](/trustguard/detectors/data-loss-prevention) detects PII and
secrets — API keys, access tokens, JWTs — on input and output, and masks them where
the Transform action is set. [Regex Replace](/trustgate/policies/regex-replace)
handles values you can state exactly. Separately,
[credential redaction](/trustguard/data-handling#credential-redaction) keeps
credentials out of stored records.

## LLM03 — Supply Chain

The [Registry](/trustgate/registry/overview) is the allowlist: a gateway reaches
only the [model providers](/trustgate/registry/models) and
[MCP servers](/trustgate/registry/mcp) registered on it, each an entry plus the
credential that reaches it. [Indirect Prompt Injection](/trustguard/detectors/agent-mcp-security)
inspects tool descriptions, which is where a malicious server does its work.

Registration bounds *what may be reached*. It does not assess the provenance of the
model or server behind an entry, and there is no code or publisher scan before you
register one.

## LLM04 — Data and Model Poisoning

Training and fine-tuning happen outside the traffic path, so poisoning cannot be
prevented at source. **What a poisoned model produces is still inspected**: every
output-side detector applies regardless of why the model behaved that way, so
[Data Loss Prevention](/trustguard/detectors/data-loss-prevention),
[Toxicity Detection](/trustguard/detectors/content-security) and
[Custom Moderation](/trustguard/detectors/content-security) catch the effect even
when the cause is upstream and invisible.

That is containment rather than prevention — the model stays compromised — but a
poisoned model does not get a free path to your users.

## LLM05 — Improper Output Handling

Detectors run on the **Output** side, and [guardrails](/trustgate/policies/guardrails)
refuse or rewrite a non-streamed response before it reaches the caller. Masking
rewrites the response in place, so a flagged value is removed rather than the whole
answer lost.

What your own downstream code does with what it receives is outside the traffic
path.

## LLM06 — Excessive Agency

[Access levels](/trustgate/access/overview) decide which people reach which servers,
inherited from the gateway default, with anything outside a selection arriving as a
[request rather than a refusal](/trustgate/access/overview#requests-instead-of-refusals).
The [MCP registry](/trustgate/registry/mcp) bounds which tool servers exist at all,
[Tool Injection](/trustgate/policies/tool-injection) controls what reaches the tool
surface, and the [per-tool rate limiter](/trustgate/policies/per-tool-rate-limiter)
bounds how often any single tool runs. Both always enforce.

## LLM07 — System Prompt Leakage

Output-side detection catches a leak in progress:
[Prompt Guard](/trustguard/detectors/content-security) runs on both sides, and
[Regex Replace](/trustgate/policies/regex-replace) scrubs a known marker string.

There is no detector whose sole purpose is system-prompt disclosure. Adversarial
testing for it lives in [TrustTest](/trusttest/create/system-prompt-disclosure).

## LLM08 — Vector and Embedding Weaknesses

The gateway proxies an [embeddings endpoint](/trustgate/endpoints/embeddings), but
neither product inspects a vector store, its index, or what retrieval returns.
Content retrieved and then placed in a prompt is inspected as prompt content, which
is LLM01.

## LLM09 — Misinformation

[Custom Moderation](/trustguard/detectors/content-security) covers subjects you
define yourself, which keeps a model inside its intended scope and is the control
that most reduces confidently wrong output on topics you never meant it to discuss.

Topic scoping is not factuality: nothing verifies claims or checks groundedness on
the runtime path.

## LLM10 — Unbounded Consumption

[Rate limiter](/trustgate/policies/rate-limiter), with a **Throttle** mode that
delays rather than blocks; [LLM budget](/trustgate/policies/llm-budget) for spend;
[request size limiter](/trustgate/policies/request-size-limiter) for payloads; and
the [per-tool rate limiter](/trustgate/policies/per-tool-rate-limiter) for tool
calls. [Routing fallback](/trustgate/llm/routing#fallback) keeps an application
alive when a provider degrades.

## Where NeuralTrust stops

**Streaming enforcement.** Streamed output is evaluated, but where enforcement can
act depends on the path. Through the gateway the stream is buffered and inspected
after the client drains it, so findings are recorded rather than refused; on the
[LiteLLM](/integrations/litellm) path accumulated output is scanned during the
stream, where `block` stops later chunks. Tokens already delivered cannot be
recalled, so enforce on the request leg when a response must be stopped. A streamed
response above 8 MiB is not inspected and emits no event.

**Tagging.** Findings carry no LLM01–LLM10 identifiers in the API or console. This
page is the mapping.

<Note>
  See also [EU AI Act](/platform/compliance/eu-ai-act), [ISO/IEC 42001](/platform/compliance/iso-42001) and [NIST AI RMF](/platform/compliance/nist-ai-rmf).
</Note>