OWASP Top 10 for LLM Applications, 2025
LLM01: Prompt Injection
Prompt injection happens when input to a model, including input a person cannot see, changes how the model behaves or what it outputs. OWASP separates direct injection, where the user's own input alters behavior, from indirect injection, where content the model reads, such as a web page or a file, carries the instructions.
Prompt Injection in more detail
The result can be policy violations, harmful content, unauthorized access or skewed decisions. Retrieval-augmented generation and fine-tuning do not fully prevent it, and the OWASP page says it is unclear whether fool-proof prevention exists, so the controls below reduce impact rather than remove the risk. Jailbreaking is a related attack that tries to remove the model's safety behavior entirely, and OWASP notes that the two overlap. Tools in our guardrails, red teaming and agent security categories are scored on how they address this risk.
The risk and its name come from OWASP; the summary, examples and controls on this page are our plain-English reading of OWASP's page. Source: Source, checked October 21, 2026: genai.owasp.org (opens in a new tab)
How it shows up
- A support chatbot is told to ignore its rules, read private data and send it out by email.
- A web page or document the model summarizes hides instructions that make it leak the conversation through a link.
- A poisoned document in a retrieval repository steers the answers the model gives.
- Instructions hidden in an image, written in another language or encoded (for example as Base64) slip past simple filters.
- A string of meaningless characters appended to a prompt (an adversarial suffix) bypasses the model's safety behavior.
Controls that reduce it
- Describe the model's role and limits in the system prompt, and treat that as one layer, not the control.
- Filter inputs and outputs, and check output formats with deterministic code.
- Give the application its own least-privilege API tokens and run functions in code rather than through the model.
- Require human approval before high-risk actions.
- Keep untrusted external content clearly separated and labeled.
- Run regular adversarial tests and treat the model as an untrusted user.
Controls reduce risk, they do not remove it
No single control covers prompt injection on its own. Combine controls, and treat any tool as one layer.
Categories that address it
Our analysisThese are the directory categories whose tools we score on this risk. The mapping is our analysis.
Layers that address this risk
Our AI security layers are an editorial model, not a standard. Source states means OWASP's own text for LLM01 names the control the layer delivers. Our analysis means we drew the link.
- L4 Testing and red teaming Source states
- L6 Runtime guardrails Source states
- L7 Agent and tool access Source states
Tools mapped to LLM01
Our analysis61 tools are mapped. Each tool is mapped only where a documented capability supports it. Open a tool page to see the capability and its source. Coverage Score compares tools within one category.
| Tool | Type | Deployment | Pricing model | OWASP risks | Coverage Score | Last reviewed |
|---|---|---|---|---|---|---|
| garakNVIDIA · Red teaming | Open sourceApache-2.0 |
| Free |
| 82 out of 100 | |
| GiskardGiskard AI · Red teaming | Open sourceApache-2.0 |
| Freemium |
| 81 out of 100 | |
| PromptfooOpenAI (Promptfoo) · Red teaming | Open sourceMIT |
| Freemium |
| 80 out of 100 | |
| DefenseClawCisco · Agent security | Open sourceApache-2.0 |
| Free |
| 76 out of 100 | |
| NeMo GuardrailsNVIDIA · Guardrails | Open sourceApache-2.0 |
| Free |
| 76 out of 100 | |
| AugustusPraetorian · Red teaming | Open sourceApache-2.0 |
| Free |
| 75 out of 100 | |
| PyRITMicrosoft · Red teaming | Open sourceMIT |
| Free |
| 73 out of 100 | |
| Agentic RadarZscaler (SPLX) · Red teaming | Open sourceApache-2.0 |
| Free |
| 71 out of 100 | |
| DeepTeamConfident AI · Red teaming | Open sourceApache-2.0 |
| Free |
| 71 out of 100 | |
| PortkeyPalo Alto Networks (Portkey) · Guardrails Now Prisma AIRS AI Gateway | Open sourceMIT |
| Freemium |
| 69 out of 100 | |
| SpikeeReversec · Red teaming | Open sourceApache-2.0 |
| Free |
| 69 out of 100 | |
| NeuralTrustNeuralTrust · Agent security | Open sourceApache-2.0 |
| Freemium |
| 68 out of 100 | |
| Kong AI GatewayKong · Guardrails | Open sourceApache-2.0 |
| Usage-based |
| 65 out of 100 | |
| Evo AI-SPMSnyk · AI-SPM | Commercial |
| Usage-based |
| 64 out of 100 | |
| AktoAkto · Agent security | Open sourceMIT |
| Contact sales |
| 63 out of 100 | |
| MCP-ScanSnyk (Invariant Labs) · Agent security Now Snyk Agent Scan | Open sourceApache-2.0 |
| Not published |
| 63 out of 100 | |
| Cisco MCP ScannerCisco · Agent security | Open sourceApache-2.0 |
| Free |
| 61 out of 100 | |
| FuzzyAIPalo Alto Networks (CyberArk) · Red teaming | Open sourceApache-2.0 |
| Free |
| 61 out of 100 | |
| Agentic Securitymsoedov (open-source maintainer) · Red teaming | Open sourceApache-2.0 |
| Free |
| 60 out of 100 | |
| Bedrock GuardrailsAmazon Web Services · Guardrails | Commercial |
| Usage-based |
| 60 out of 100 | |
| Cisco Skill ScannerCisco · Agent security | Open sourceApache-2.0 |
| Free |
| 60 out of 100 | |
| MindgardMindgard · Red teaming | Commercial |
| Not published |
| 59 out of 100 | |
| Uber ADRUber · Agent security | Open sourceApache-2.0 |
| Free |
| 59 out of 100 | |
| Granite GuardianIBM · Guardrails | Open sourceApache-2.0 |
| Free |
| 57 out of 100 | |
| Lakera GuardCheck Point (Lakera) · Guardrails Now Check Point AI Guardrails | Commercial |
| Not published |
| 57 out of 100 | |
| Lasso MCP GatewayLasso Security · Agent security | Open sourceMIT |
| Free |
| 57 out of 100 | |
| Llama ProtectionsMeta · Guardrails | Open, custom license |
| Free |
| 56 out of 100 | |
| promptmaputkusen · Red teaming | Open sourceGPL-3.0 |
| Free |
| 56 out of 100 | |
| AgentCore PolicyAmazon Web Services · Agent security | Commercial |
| Usage-based |
| 55 out of 100 | |
| Azure AI Content SafetyMicrosoft · Guardrails Renamed | Commercial |
| Freemium |
| 55 out of 100 | |
| Invariant GuardrailsSnyk (Invariant Labs) · Agent security | Open sourceApache-2.0 |
| Free |
| 54 out of 100 | |
| Wiz AI-SPMGoogle (Wiz) · AI-SPM | Commercial |
| Not published |
| 54 out of 100 | |
| AI Red Teaming AgentMicrosoft · Red teaming | Commercial |
| Usage-based |
| 53 out of 100 | |
| b3 benchmarkCheck Point (Lakera) and UK AI Security Institute · Red teaming | Open sourceMIT |
| Free |
| 53 out of 100 | |
| mcp-context-protectorTrail of Bits · Agent security | Open sourceApache-2.0 |
| Free |
| 53 out of 100 | |
| Gray SwanGray Swan · Red teaming | Commercial |
| Not published |
| 52 out of 100 | |
| SPLXZscaler (SPLX) · Red teaming | Commercial |
| Contact sales |
| 51 out of 100 | |
| Adversa AIAdversa AI · Red teaming | Commercial |
| Not published |
| 50 out of 100 | |
| Agent GatewayGoogle Cloud · Agent security | Commercial |
| Not published |
| 50 out of 100 | |
| Qwen3GuardAlibaba Cloud · Guardrails | Open sourceApache-2.0 |
| Free |
| 50 out of 100 | |
| AQtive Guard AI-SPMSandboxAQ · AI-SPM | Commercial |
| Not published |
| 50 out of 100 | |
| StraikerStraiker · Agent security | Commercial |
| Not published |
| 49 out of 100 | |
| Pangea AI GuardCrowdStrike (Pangea) · Guardrails | Commercial |
| Not published |
| 48 out of 100 | |
| Pillar SecurityPillar Security · Agent security | Commercial |
| Not published |
| 48 out of 100 | |
| Vigildeadbits · Guardrails | Open sourceApache-2.0 |
| Free |
| 48 out of 100 | |
| Cisco AI DefenseCisco · Guardrails | Commercial |
| Not published |
| 47 out of 100 | |
| Lakera RedCheck Point (Lakera) · Red teaming | Commercial |
| Contact sales |
| 45 out of 100 | |
| Model ArmorGoogle Cloud · Guardrails | Commercial |
| Usage-based |
| 44 out of 100 | |
| AliceAlice · Guardrails | Commercial |
| Not published |
| 42 out of 100 | |
| Radware LLM FirewallRadware · Guardrails | Commercial |
| Not published |
| 41 out of 100 | |
| Orca AI-SPMOrca Security · AI-SPM | Commercial |
| Not published |
| 40 out of 100 | |
| Lasso SecurityLasso Security · Guardrails | Commercial |
| Not published |
| 39 out of 100 | |
| Operant AIOperant AI · Agent security | Commercial |
| Not published |
| 39 out of 100 | |
| HiddenLayer AIDRHiddenLayer · Guardrails | Commercial |
| Not published |
| 37 out of 100 | |
| ModelOp CenterModelOp · Governance | Commercial |
| Not published |
| 33 out of 100 | |
| CalypsoAIF5 (CalypsoAI) · Guardrails Now F5 AI Guardrails | Commercial |
| Not published |
| 32 out of 100 | |
| Falcon GuardianCrowdStrike · Agent security | Commercial |
| Not published |
| 31 out of 100 | |
| Firewall for AICloudflare · Guardrails Now AI Security for Apps | Commercial |
| Contact sales |
| 29 out of 100 | |
| Prompt SecuritySentinelOne (Prompt Security) · Guardrails | Commercial |
| Not published |
| 29 out of 100 | |
| LLM GuardPalo Alto Networks (Protect AI) · Guardrails Archived | Open sourceMIT |
| Free |
| 66 out of 100 | |
| RebuffPalo Alto Networks (Protect AI) · Guardrails Archived | Open sourceApache-2.0 |
| Free |
| 42 out of 100 |
No tools match these filters. Clear a filter to see more.
Why each tool is mapped
- garak: Runs prompt injection and jailbreak probes against a target model.
- Giskard: Scans an agent for prompt injection and jailbreaks, including multi-turn attacks.
- Promptfoo: Scans a target for jailbreaks and injections as part of its red team run.
- DefenseClaw: Inspects prompts, completions and tool calls for injection attacks and can block at a set severity in action mode.
- NeMo Guardrails: Jailbreak protection screens adversarial prompts before they reach the model.
- Augustus: Ships prompt injection and jailbreak probes, plus multi-turn strategies.
- PyRIT: Ships a Jailbreak scenario that tests a model against jailbreak templates.
- Agentic Radar: The test command sends simulated prompt injection attacks to OpenAI Agents workflows.
- DeepTeam: Runs prompt injection and jailbreak attacks, single-turn and multi-turn, against a target.
- Portkey: LLM-based input guardrails include prompt injection scanning.
- Spikee: Generates and runs prompt injection and jailbreak test cases against a target.
- NeuralTrust: Inspects prompts inline for injections and jailbreaks, and tests agents for them with TrustTest.
- Kong AI Gateway: The AI Semantic Prompt Guard targets jailbreak and prompt injection attempts.
- Evo AI-SPM: Snyk's mapping ties its role deviation test and every indirect injection goal to LLM01.
- Akto: Probes AI agents and MCP servers with security probes aimed at prompt injection.
- MCP-Scan: Looks for prompt injection and hidden instructions in MCP tool definitions and agent skills.
- Cisco MCP Scanner: Looks for prompt injection and tool poisoning in MCP tool, prompt and resource definitions.
- FuzzyAI: Runs jailbreak attack methods against a target LLM API.
- Agentic Security: Replays jailbreak datasets and multi-step jailbreak attacks against the target.
- Bedrock Guardrails: The prompt attack content filter targets prompt injections and jailbreaks.
- Cisco Skill Scanner: Looks for prompt injection in skill instructions and scripts before an agent loads the skill.
- Mindgard: Runs prompt injection, jailbreak and multi-turn attacks against a target model or application.
- Uber ADR: The detector is evaluated on prompt injection scenarios, including the public AgentDojo benchmark, in recorded agent sessions.
- Granite Guardian: Jailbreak attempts are one of the built-in risk categories.
- Lakera Guard: Screens direct and indirect prompt attacks, including jailbreaks and prompt injections.
- Lasso MCP Gateway: The lasso plugin checks content for prompt injection, using Lasso's API and a Lasso API key.
- Llama Protections: Prompt Guard 2 classifiers detect prompt injections and jailbreaks.
- promptmap: Runs prompt injection and jailbreak rules against a target application.
- AgentCore Policy: Policies can forbid a tool call when a Bedrock Guardrails prompt attack score for the input passes a threshold.
- Azure AI Content Safety: Prompt Shields detect user prompt attacks and document attacks.
- Invariant Guardrails: Example rules flag prompt injection in tool output.
- Wiz AI-SPM: The page lists runtime protection for prompt injection.
- AI Red Teaming Agent: Runs jailbreak, indirect prompt injection and multi-turn attack strategies against a target.
- b3 benchmark: Measures how models resist direct and indirect instruction override attacks.
- mcp-context-protector: Scans tool responses for prompt injection and blocks calls to a server whose setup changed.
- Gray Swan: The managed service covers prompt injection among its attack types.
- SPLX: Docs name a Jailbreak probe among the probe runs.
- Adversa AI: Prompt injection and jailbreaks are named among its vulnerability categories.
- Agent Gateway: Optional Model Armor screening checks prompts and tool responses for prompt injection.
- Qwen3Guard: Jailbreak is a built-in input category.
- AQtive Guard AI-SPM: The AI Gateway's jailbreak guardrail detects prompt injection and attempts to bypass safety controls.
- Straiker: Defend AI stops direct and indirect prompt injection.
- Pangea AI Guard: Recipes block prompt injection with a Malicious Prompt detector.
- Pillar Security: Runtime guardrails address prompt injection for apps, agent endpoints and gateways.
- Vigil: Detects prompt injections and jailbreaks with similarity search, YARA rules and a classifier.
- Cisco AI Defense: Runtime protection blocks prompt injection and prompt extraction attempts.
- Lakera Red: Expert-led tests cover prompt injection and jailbreaks.
- Model Armor: A filter detects prompt injection and jailbreak attempts in prompts.
- Alice: Prompt injection is a named example of a policy detector.
- Radware LLM Firewall: Screens prompts for injection and jailbreak attempts before they reach the model.
- Orca AI-SPM: The page says runtime monitoring flags prompt injection patterns.
- Lasso Security: Flags direct and indirect prompt injection in gateway traffic.
- Operant AI: Dashboards surface prompt injection risks and detections.
- HiddenLayer AIDR: Detects prompt injection and indirect attacks through retrieved content or tool output.
- ModelOp Center: Monitoring includes checks for prompt vulnerabilities.
- CalypsoAI: Protects against prompt injection and jailbreak attacks at runtime.
- Falcon Guardian: Inspects direct and indirect prompt injection and can block malicious interactions.
- Firewall for AI: Prompt injection scoring flags prompts that try to subvert the model.
- Prompt Security: The AI firewall blocks adversarial prompts, and jailbreaks are listed among the risks covered.
- LLM Guard: A Prompt Injection input scanner screens prompts before they reach the model.
- Rebuff: Heuristic and LLM-based checks screen incoming prompts for injection attempts.