An engineering team building a customer-support chatbot that can call internal tools has already learned OWASP's distinction between direct prompt injection (attacker text typed straight into the chat) and indirect prompt injection (malicious instructions hidden in a document, webpage, or tool result the model later reads). Separately from that classification, what defense-in-depth mitigations does the OWASP Top 10 for LLM Applications (2025) recommend for reducing the risk and blast radius of a successful prompt injection?
- A combination of layered controls: constraining model behavior and output format through the system prompt, segregating untrusted external content so it cannot be interpreted as an instruction, restricting the model's tools and permissions to the minimum needed for the task, and requiring human approval before any high-risk or irreversible action is carried out
- Relying on a single measure, training a dedicated classifier that scans every user message for injection attempts, which OWASP describes as sufficient on its own once deployed, without any additional tool-permission or output controls
- Disabling all tool use entirely for any model that might ever process text from an external source, since OWASP states this is the only mitigation that fully eliminates the risk
- Encrypting the model's system prompt so that it cannot be extracted through prompt leaking, which OWASP identifies as its primary recommended defense against prompt injection specifically
Why A? And why not the others?
Correct answer: A. A combination of layered controls: constraining model behavior and output format through the system prompt, segregating untrusted external content so it cannot be interpreted as an instruction, restricting the model's tools and permissions to the minimum needed for the task, and requiring human approval before any high-risk or irreversible action is carried out
OWASP's guidance treats prompt injection as a risk that cannot be fully eliminated by any single control, so it recommends layering several mitigations together: constraining what the model is allowed to do and what output format it must follow through the system prompt, segregating content pulled in from untrusted external sources so the model does not treat it as an instruction, restricting the tools and permissions available to the model to only what a given task actually needs, and requiring a human to approve any action that would be high-risk or hard to reverse before it is carried out. The option describing a single injection-scanning classifier as sufficient on its own is wrong because OWASP explicitly frames defense in depth, combining several layers, as necessary rather than relying on one filter. The option describing disabling all tool use for any model touching external text is wrong because OWASP's recommendations focus on constraining and monitoring tool use, not eliminating it outright, and does not present blanket disabling as the only real mitigation. The option describing system-prompt encryption as OWASP's primary recommended defense is wrong because encrypting the system prompt addresses prompt leaking, a related but separate risk, and is not the mitigation OWASP centers for prompt injection itself.
Source: OWASP, 'OWASP Top 10 for LLM Applications 2025', LLM01: Prompt Injection