Generate custom courses on any topic — with hands-on practice, AI guidance, and visuals built in.
Already have an account?
A mid size fintech runs a customer support Retrieval Augmented Generation (RAG) chatbot that can pull snippets from internal runbooks and past tickets. A customer pastes a message that looks like a normal billing question, but it contains an embedded instruction that tells the model to reveal internal escalation guidance and then summarize it back to the user. The model complies, and the chatbot returns content that was never meant for external disclosure. This is the failure we are preventing in this course, where LLM01 Prompt Injection is the entry point and LLM02 Sensitive Information Disclosure is the impact.
The immediate deliverable for Lesson 1 is a reliable classification habit. Given one observed chatbot transcript, we should be able to label the root cause as LLM01 or something adjacent, and then predict which other OWASP categories will usually be involved in the same incident chain so we can design layered controls instead of single point fixes. The next widget visualizes the injection to disclosure path at system level so we can anchor later mitigations in a concrete flow.
OWASP Top 10 for LLM Applications 2026 is a ranked list of ten common failure modes for LLM powered applications. We will use it as the shared language for requirements, threat modeling, testing, and reporting across this program. The full list is LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM03 Excessive Agency, LLM04 Supply Chain, LLM05 Data and Model Poisoning, LLM06 Unbounded Consumption, LLM07 Misinformation, LLM08 Hidden Context Exposure, LLM09 Vector and Embedding Weaknesses, and LLM10 Improper Output Handling.
This course directly covers LLM01 Prompt Injection end to end, including direct and indirect injection, defense in depth controls, and how to test them. It also directly touches LLM02 Sensitive Information Disclosure, LLM03 Excessive Agency, LLM08 Hidden Context Exposure, and LLM10 Improper Output Handling because they are frequent downstream impacts or amplifiers in real architectures. We treat the remaining entries as adjacent dependencies, meaning we will reference them when a control choice for LLM01 creates exposure elsewhere, or when your program needs a boundary statement for what is out of scope for a given review. Use the next widget to lock in the full list and see what this program covers most deeply.