The threat landscape: prompt injection, jailbreaks, and OWASP

Before going deep, get the vocabulary right — because two terms, prompt injection and jailbreaking, are constantly conflated, and the field's central reference, the OWASP Top 10 for LLM Applications, is often cited in an outdated form. Getting these right is the foundation for everything else.

Prompt injection vs. jailbreaking — related but distinct:

• Prompt injection is an input-handling / architectural vulnerability: untrusted text gets mixed with trusted instructions, and the model can't reliably tell them apart. OWASP defines it as occurring "when user prompts alter the LLM's behavior or output in unintended ways." It's the AI analogue of SQL injection — code and data sharing one channel.
• Jailbreaking is a goal — specifically getting a model to violate its safety training or policy (produce disallowed content). OWASP treats jailbreaking as a form of prompt injection that subverts safety guardrails. The distinction matters: not all prompt injection is a jailbreak (exfiltrating data via a poisoned web page needn't break content policy), and the defenses differ.

Keeping these separate keeps your thinking clear: prompt injection is about who controls the instructions; jailbreaking is about defeating safety guardrails.

The OWASP Top 10 for LLM Applications (2025) — cite the current list. The OWASP Gen AI Security Project maintains the field's canonical risk list. The 2025 version is:

1. LLM01 Prompt Injection
2. LLM02 Sensitive Information Disclosure
3. LLM03 Supply Chain
4. LLM04 Data and Model Poisoning
5. LLM05 Improper Output Handling
6. LLM06 Excessive Agency
7. LLM07 System Prompt Leakage
8. LLM08 Vector and Embedding Weaknesses
9. LLM09 Misinformation
10. LLM10 Unbounded Consumption

The 2025 update notably added System Prompt Leakage (LLM07) and Vector and Embedding Weaknesses (LLM08, reflecting how widely RAG is now used), and broadened the old "denial of service" into Unbounded Consumption. A common mistake is citing an older version of this list — always use the current one and verify OWASP hasn't revised it again.

How to use the list: it's a checklist for threat modeling. For any LLM system, walk the ten categories and ask "how is my system exposed to this, and what mitigates it?" Prompt injection (LLM01) is nearly always the top concern; Excessive Agency (LLM06) becomes critical the moment your system can act; Improper Output Handling (LLM05) matters whenever model output flows into another system.

The mindset: get the vocabulary right — prompt injection is a channel/architecture problem (who controls the instructions), jailbreaking is a goal (defeating safety guardrails), and they're related but distinct. Anchor your threat modeling on the current OWASP Top 10 for LLM Applications (2025), walking each category against your system. This shared vocabulary and checklist is the foundation the rest of the course builds on — precise terms and the right reference list keep your security thinking sharp.