A tiny threat model: entry points and OWASP risks
The risk names are from the OWASP Top 10 for LLM Applications, 2025 edition. Extend the table for your own app.
A threat model lists what you must protect, who might attack it, and every place untrusted text can enter. For an LLM app the entry points are wider than a normal web app: user text, documents, web pages, tool output and the model's own reply.
Change the code and press Run (Ctrl+Enter). Predict what will happen first, then break it on purpose and read what changes. Your edits are saved and match the lesson page.
Ready for more? This phase has 5 hands-on exercises with automatic checks.
Practice questions
Write the code in the editor, run it, then open the model answer to compare.
Add risks_for(app) to the program: it takes the list of (name, kind) pairs and returns the sorted list of distinct risk names. Call it with the app from the example and print how many there are.
Write worst_case(app) that returns the parts of the app whose kind is "tools", as a list of names, so a reviewer sees first what can act in the world.
Explain it without notes
What is a threat model and what three things does it list?
Why is an LLM app's attack surface larger than the chat box?
How do you decide which defence to build first?
How can you use the OWASP Top 10 for LLM Applications without treating it as a checklist?
Expected output
chat box [user text]: LLM01 Prompt Injection, LLM10 Unbounded Consumption
uploaded PDF [document text]: LLM01 Prompt Injection
web search result [tool output]: LLM01 Prompt Injection
answer shown on the page [model output]: LLM05 Improper Output Handling
hidden system prompt [system prompt]: LLM02 Sensitive Information Disclosure, LLM07 System Prompt Leakage
send_email tool [tools]: LLM06 Excessive Agency
6 distinct risks to design for:
LLM01 Prompt Injection
LLM02 Sensitive Information Disclosure
LLM05 Improper Output Handling
LLM06 Excessive Agency
LLM07 System Prompt Leakage
LLM10 Unbounded Consumption