AI Integrations,
Actually Reviewed.
Strata Security's repository scans detect 8 of the 10 OWASP Top 10 for LLM Applications (2025) categories — the pattern-based risks that appear when application code integrates directly with an AI provider.
What Is the OWASP Top 10 for LLM Applications?
The OWASP Top 10 for LLM Applications is the OWASP GenAI Security Project's community-curated list of the most critical security risks specific to applications built on large language models — distinct from the general OWASP Top 10, which wasn't designed with AI-integration risk in mind.
As more products connect an AI platform directly to their existing data and infrastructure, the integration boundary itself — how data reaches the model, how the model's output is trusted, and what capabilities the model is given — has become a real, underscoped source of risk.
Strata Security automatically maps applicable findings to the relevant OWASP LLM Top 10 category during a repository scan, alongside the existing OWASP Web Top 10 and CWE mappings — no separate scan or manual tagging required.
8 of 10 Categories Covered
The two categories not covered — Data and Model Poisoning, and Misinformation — are training-pipeline and model-output-quality concerns that aren't visible in application source code, so they're left off rather than stretched for weak findings.
| ID | Category | Python | JS / TS | Typical Severity |
|---|---|---|---|---|
| LLM01 | Prompt Injection | ✓ | ✓ | High |
| LLM02 | Sensitive Information Disclosure | ✓ | ✓ | High |
| LLM03 | Supply Chain | ✓ | ✓ | High |
| LLM05 | Improper Output Handling | ✓ | ✓ | High |
| LLM06 | Excessive Agency | ✓ | ✓ | Medium |
| LLM07 | System Prompt Leakage | ✓ | ✓ | High |
| LLM08 | Vector and Embedding Weaknesses | ✓ | ✓ | Medium |
| LLM10 | Unbounded Consumption | ✓ | ✓ | Medium |
How Strata Detects Each Category
Pattern-based static analysis applied to every repository scan, across Python and JavaScript/TypeScript.
Prompt Injection
HighIdentification of untrusted request data interpolated directly into a prompt, with no separation between trusted instructions and user-controlled input.
- F-string / concatenation of request data into a prompt-shaped variable (Python)
- Template-literal interpolation of request data into a prompt string (JS/TS)
- Flags the same construction pattern already used to catch SQL injection, applied to prompt building instead of query building
system_prompt = f"You are helpful. {request.json['msg']}"Prompt injection is the entry point for most other LLM attacks — an attacker who can override your instructions can often chain into data exposure or unintended tool use.
Sensitive Information Disclosure
HighDetection of PHI/PII-shaped data — or entire raw request objects — passed directly into a third-party AI API call with no visible redaction.
- OpenAI/Anthropic SDK calls receiving a raw request.json / request.form / req.body object
- PHI/PII-named identifiers (patient, diagnosis, ssn, medical_record, credit_card) passed directly into an AI API call
openai.chat.completions.create(messages=[{"content": patient_diagnosis}])The most compliance-relevant category — this is what a HIPAA- or PCI-adjacent application needs caught before sensitive data ever leaves the application boundary.
Supply Chain
HighUnsafe ML model loading patterns that risk arbitrary code execution on load, or an unpinned model whose exact weights can change without notice.
- torch.load() without weights_only=True — defaults to pickle-based deserialization
- HuggingFace from_pretrained() without a pinned revision (commit hash or tag)
weights = torch.load("model.pt") # no weights_only=TrueA compromised or tampered model file is functionally equivalent to a malicious dependency — it just doesn't look like one in a typical dependency audit.
Improper Output Handling
HighAI-generated response content flowing into an established dangerous sink — eval(), innerHTML, dangerouslySetInnerHTML — with no sanitization.
- AI response variables passed directly to eval() (Python and JS)
- AI response assigned to innerHTML or rendered via dangerouslySetInnerHTML with no sanitization step
element.innerHTML = aiResponse;The model's output is untrusted data, exactly like any other external input — a prompt-injection attack upstream can indirectly control what ends up here.
Excessive Agency
MediumHeuristic — review before treating as confirmedLLM-callable tools registered with a name that itself suggests a destructive or irreversible capability, with no visible approval gate.
- LangChain Tool() / DynamicTool() registrations named with a destructive verb (delete, remove, drop, exec, shell)
Tool(name="delete_user_account", func=delete_fn)Heuristic and name-based by design — this flags a tool worth a human review, not a confirmed vulnerability. Whether it's actually a problem depends on whether a real approval step exists before the tool fires.
System Prompt Leakage
HighSecrets or API keys embedded directly inside a system prompt string, where they leak if the prompt is ever disclosed or extracted via prompt injection.
- System-role prompt content containing api_key / password / secret-key-shaped strings (Python and JS, quoted or unquoted object keys)
{"role": "system", "content": "use api_key sk-..."}A leaked system prompt hands an attacker both the credential and a blueprint for crafting a more effective prompt-injection attack against your actual instructions.
Vector and Embedding Weaknesses
MediumHeuristic — review before treating as confirmedVector database queries with no visible tenant/user scoping filter — a common way for one user's retrieval to surface another user's embedded documents.
- Pinecone-shaped vector queries with no filter parameter
- Chroma-shaped vector queries with no where clause
results = index.query(vector=embedding, top_k=5) # no filterHeuristic by design — single-tenant applications may not need a filter at all. Deliberately excludes FAISS, which has no built-in filtering concept, since nearly every real FAISS call would otherwise false-positive.
Unbounded Consumption
MediumAI API calls with no token limit set, allowing a single request — or a burst of them — to drive unbounded cost and latency.
- OpenAI-shaped calls (chat.completions.create, ChatCompletion.create, Completion.create) missing max_tokens
- Anthropic deliberately excluded — its API requires max_tokens, so its absence would fail the call rather than allow unbounded generation
openai.chat.completions.create(model="gpt-4", messages=msgs) # no max_tokensA cost-denial-of-service vector as much as an availability one — an unbounded endpoint reachable from user input is a real line item on your AI provider's bill.
What's Deliberately Not Covered
LLM04 — Data and Model Poisoning concerns the integrity of training and fine-tuning data — a training-pipeline and MLOps concern, not something visible in application source code.
LLM09 — Misinformation concerns the model's output quality and factual accuracy — a model-behavior and product-design question, not a code vulnerability a static scanner can detect.
We'd rather leave these off entirely than stretch for weak, high-noise findings just to claim a checkbox. If that changes — new tractable signal, or customer demand that justifies the trade-off — we'll revisit it.
Detection Confidence, by Category
AI/LLM detection is newer ground than the OWASP Web and Mobile Top 10 rules Strata has run for years, and we'd rather be upfront about where confidence is lower than let a report imply more certainty than the underlying analysis actually has.
- LLM01, LLM02, LLM03, LLM05, LLM07, LLM10 — pattern-matched against a specific, well-defined code shape (a known SDK call, a known unsafe function, a missing required parameter). Higher confidence.
- LLM06 and LLM08 — name- and shape-based heuristics that flag something worth a human look, not a confirmed vulnerability on their own. Both are marked directly on their finding cards above, and in every report they appear in.
As with every Strata finding, file path, line number, and surrounding code are included so a reviewer can make a fast, informed call.
Scan Your AI Integration
Free Today
Connect a repository and get OWASP LLM Top 10 mapping alongside standard OWASP Web Top 10 and CWE coverage. No credit card required.