Treat retrieved content and tool output as untrusted inputs. Protect business data with scoped actions, authorization checks and deliberate output handling.
Separate content from authority
An email, document or retrieved page may contain instructions that conflict with the task. Its presence in a workflow does not give it authority to change system behavior. Keep user goals, business rules and external content distinct in the application design.
A practical review asks what damage would be possible if the model followed a malicious passage. If the answer includes exporting sensitive records or changing access controls, the tool boundary is too broad for an ordinary content task.
Control tools outside the model
Validate operations, arguments and permissions on the server. Never assume a model’s proposed identifier belongs to the current user or tenant. Minimize data returned by tools and keep dangerous actions behind explicit checks.
OWASP’s current LLM guidance is a useful starting point for reviewing these systems. Application authorization, secure secrets handling and audit trails remain necessary alongside model-specific defenses.
Test realistic attack paths
Include malicious instructions in documents, tool responses and user-supplied fields. Observe whether the application exposes data, changes state or mishandles output. A refusal in one conversation is not proof of a durable control. Record the actual permitted actions and recovery behavior for each scenario.
A practical next step
- Inventory tool permissions and data exposure.
- Test injected instructions in retrieved material.
- Validate every state-changing request on the server.
- Require explicit approval for sensitive operations.
Primary reference
OWASP LLM Applications 2026. Product features and availability can change; check the relevant documentation for your environment.
How Codeiz can help
Discuss the scope, integration constraints and delivery priorities with our cybersecurity team. We start with your business problem and an agreed definition of success.
Comments