LLM Security
LLM security is the discipline of identifying, managing, and mitigating risks specific to applications built on large language models. It is not a subset of conventional application security. It is an extension of it, applied to systems that accept natural language as instructions, generate outputs that other systems act on, and can be manipulated through the content they process rather than only through the interfaces they expose.
The threat model is different. The controls are different. The failure modes are different. An organization that secures its LLM-powered application the same way it secures a conventional web application will miss most of what matters.
What Makes LLM Security Distinct
Management
Conventional application security assumes a clear boundary between trusted instructions and untrusted data. In an LLM, that boundary does not exist by default. Instructions and data arrive as tokens in the same context window. The model processes them together and responds to whatever it finds most directive. An attacker who understands this does not need to find a vulnerability in code. They need to write better instructions than the developer did.
This architectural property is the root cause of prompt injection, the top-ranked risk in the OWASP GenAI Security Project Top 10 for LLM Applications, and it cascades into nearly every other risk category on the list.
Autonomy compounds the problem. An LLM connected only to a user interface has a limited attack surface. An LLM agent with access to email, file systems, APIs, and code execution has an attack surface proportional to the extent of what it can touch. Securing the model without securing the action space it operates in is not LLM security. It is half of it.
What is LLM security?
LLM security is the practice of managing risks specific to applications built on large language models. It addresses attack surfaces and failure modes that conventional application security frameworks were not designed to handle, including prompt injection, insecure output handling, and autonomous agent behavior.
Why is LLM security different from conventional application security?
Conventional application security assumes a clear boundary between trusted instructions and untrusted data. LLMs process both in the same input stream with no native trust hierarchy. This makes the input itself the primary attack surface and requires a fundamentally different threat model.
What is the single most impactful LLM security control?
Privilege minimization. Restricting what an LLM agent can access and act on limits what any attack can achieve, regardless of how it is delivered. A model with no access to tools cannot be weaponized through prompt injection. Every additional permission granted to an agent is an additional blast radius that must be secured.
