← All articles

// ai security · guide

Securing AI Chatbots: A Practical LLM Security Checklist

AI assistants introduce model, data and tool boundaries that need explicit security testing alongside ordinary application checks. Use this short list to start an architecture-specific review, not as proof of full OWASP coverage or a safe launch.

The checklist

1. Prompt injection resistance

Can user input — or content the model reads from documents, emails, or web pages — override your system instructions? Include indirect injection through retrieved content when it exists in the architecture.

2. Sensitive data exposure

Does the model have access to more data than the current user should see? Test cross-tenant and cross-role leakage explicitly, with adversarial phrasing.

3. Excessive agency

If the model can call tools — send emails, query databases, execute actions — what is the blast radius when it is manipulated? Every tool call needs authorisation checks independent of the model's judgement.

4. Output handling

Model output rendered into HTML, SQL, or shell commands is untrusted input. Treat it with the same sanitisation discipline as user input, because an attacker controls it indirectly.

5. Guardrail bypass testing

Content filters and system prompts are speed bumps, not walls. Red-team them with role-play framing, encoding tricks, and multi-turn setups before someone on the internet does.

Before launch

Agree an AI/LLM assessment scope around the actual application, data, model dependencies and connected tools. Use the OWASP GenAI guidance to inform scenarios, and record exclusions. Provider controls and your integration both matter; vendor safety claims do not remove your responsibility to validate application boundaries.