OWASP Top 10 for LLM Applications
Last updated: November 5, 2026
The OWASP Top 10 for LLM Applications (2025) lists the most important security risks for software built on large language models. Here is how pAIring handles each one, and what stays with your team. Every point can be checked in the source code.
LLM01 Prompt injection
What pAIring does: Only admins can add MCP tool servers, and a reply can call tools for a limited number of rounds (5 by default, at most 20). Tool output is treated as text for the model, never run as code by pAIring.
What you should do: Connect only tool servers you trust, and give each one the smallest access it needs.
LLM02 Sensitive information disclosure
What pAIring does: Everything runs on your servers, so prompts and documents never reach us or a public AI service. Each user's chats are private, admins included, and a channel chat never sees a member's private documents.
What you should do: Put confidential documents in private or channel scopes, not in the shared knowledge base.
LLM03 Supply chain
What pAIring does: The code is open source and checked by GitHub's Dependabot and CodeQL. Chat models use the GGUF format, which holds weights only, and models are read by the engines' own file parsers, never by running Python code from the model file.
What you should do: Download models from publishers you trust, and keep pAIring and Matricxon updated.
LLM04 Data and model poisoning
What pAIring does: pAIring never trains or fine-tunes models on your data. Only admins can add documents to the shared knowledge base that every user's answers draw on.
What you should do: Review what goes into shared documents, as you would for an internal wiki.
LLM05 Improper output handling
What pAIring does: Model replies are sanitized with DOMPurify before they are shown, so HTML or scripts in a reply cannot run in the browser.
What you should do: If you pass replies on to other systems through the API, validate them there too.
LLM06 Excessive agency
What pAIring does: The model can act only through the tools an admin has connected, and the number of tool rounds per reply is capped.
What you should do: Prefer read-only tools, and avoid connecting tools that can delete or send things on their own.
LLM07 System prompt leakage
What pAIring does: API keys and other secrets are never placed in prompts. They are encrypted in the database and sent only by the server, in its own requests.
What you should do: Keep secrets out of skills and system prompts, and assume users can see their text.
LLM08 Vector and embedding weaknesses
What pAIring does: Document search is limited by owner: a personal chat sees its owner's private documents and shared ones, and a channel chat sees shared ones only. Embeddings stay in your own database.
What you should do: Use the private and shared scopes to match who should see each document.
LLM09 Misinformation
What pAIring does: Answers drawn from your documents show their sources, so users can check them.
What you should do: Teach users that AI answers need checking, and pick models that suit the task.
LLM10 Unbounded consumption
What pAIring does: Admins can set daily limits per user, for replies and tokens. Replies have a maximum length, and repeated failed logins are blocked for 15 minutes.
What you should do: Set usage limits that match your hardware, and keep the engines on a private network.
More: Security · pAIring security docs and go-live checklist