OWASP Top 10 for LLM Applications (2025)
Aligned to the OWASP Top 10 for LLM Applications (2025), these policies provide runtime protection against the framework's attack vectors. Each policy is mapped to its OWASP category (LLM01-LLM10), covering prompt injection, sensitive-information disclosure, insecure output handling, excessive agency, supply-chain integrity and unbounded consumption.
Coverage focus
Detects and blocks user inputs aimed at overriding system instructions ('ignore previous instructions', instruction injection, role-switch commands). Known patterns are caught in under 1 ms by a heuristic pre-check; semantic variants are caught in the context-aware layer.
Detects hidden instructions embedded in external sources such as RAG documents, emails and web content. Context sent to the model is scanned like user input; in agent systems, tool outputs also pass through this policy.
Detects jailbreak attempts based on DAN, persona switching, hypothetical scenarios and gradual manipulation. Runs on a context-aware model benchmarked against a known jailbreak library.
Detects filter-bypass attempts using obfuscation techniques such as Base64, hex, unicode character manipulation, leetspeak and reversed text. Policy evaluation is repeated after the input is normalized.
Detects prompt-injection and jailbreak attempts in Turkish, Arabic, German and French using native language models. Bypassing English-focused security filters via language switching is a known attack vector; this policy uses UMAI's multilingual guardrail engine.
Blocks inputs aimed at disclosing the system prompt, its instructions or its configuration in the PRE_LLM phase, and outputs containing system-prompt fragments in the POST_LLM phase. Output matching is done via a system-prompt fingerprint.
Detects API keys, SSH keys, tokens, passwords and connection strings in both input and output. Employees pasting secret keys into AI tools during debugging is the most common leakage scenario.
Detects sharing of trade secrets, contract details, pricing, production data and classified project names in AI interactions. An organization-specific confidential-term glossary is defined with an Exact Match policy.
Catches and masks personal-data disclosure originating from the model's training data or context in the POST_LLM phase. The security-layer counterpart of the KVKK/GDPR policies.
Detects XSS, SQL injection, command injection and malicious script patterns in model output. Sanitization is applied against the risk of the output being executed in downstream systems (web UI, database, terminal).
Detects phishing links, malicious URLs, hidden markdown images and data-exfiltration link patterns in output. Links to unknown domains are marked with FLAG.
Allows AI agents to call only the tools on the project-defined whitelist. Calls to tools outside the list and access to MCP servers are blocked.
Limits action scope even for permitted tools: an agent with read permission cannot write, and an agent with single-record permission cannot perform bulk operations. Scope-violation attempts are logged as privilege-escalation attempts.
Requires an agent to obtain human approval before proceeding on irreversible or high-impact actions (deletion, sending, payment, configuration change).
Applies project- and permission-based access isolation in RAG vector databases. Pulling context from document sources the user is not authorized for is blocked, and cross-project data leakage is prevented.
Scans documents added to the knowledge base for hidden instructions, manipulative content and anomaly patterns. When a poisoned document is detected, the source is quarantined and an alarm is raised.
Allows only approved models, plugins and MCP servers from the model registry. Components that fail integrity checks or come from unapproved sources are blocked.
Flags outputs on high-risk topics (regulation, technical procedures, financial data) that cannot cite a source or have low confidence. Grounding requirements can be enforced in critical projects.
Applies request-rate, token-budget and maximum-input-length limits per user, project and API key. Prevents resource-exhaustion attacks and cost blow-ups (denial of wallet).
Detects unusual request volumes, repetitive automated query patterns and systematic querying indicative of model extraction. On anomaly, the relevant key is temporarily throttled.
Blocks generation of violence, hate speech, illegal-activity instructions and NSFW content in both input and output phases. Evaluated with a multilingual content-safety model including Turkish.
Prevents each AI application from drifting outside its defined purpose (a customer chatbot giving legal opinions, recommending competitor products, or making statements that damage corporate reputation). Topic-boundary violations are evaluated together with the brand-safety policy.