Skip to content
Contexor

Security

Preventive controls for the OWASP LLM Top 10.

Enterprise AI introduces new ways to attack. Here is how Contexor's controls map to each risk in the OWASP Top 10 for LLM Applications 2026, all running inside your own cloud.

Inside your boundary

Security starts with where the engine runs.

Contexor is deployed in your own cloud, so the controls below protect data that never leaves your environment.

Runs in your VPC

Every control on this page runs inside your own cloud account and network, not in a shared Contexor service.

Data never leaves

Documents, indexes, the knowledge graph, prompts, and logs stay within your boundary and under your security controls.

Your keys

Encryption keys are held in your own key management service. You control access, rotation, and revocation.

Audit you own

Audit and lineage records are written to storage you own, so your security team can review them with its own tools.

OWASP Top 10 for LLM Applications 2026

Ten risks, and the controls that address them.

Each risk below has a plain-language description of the attack and the Contexor controls designed to prevent it or limit its impact, labelled by the plane that provides them.

  • Control plane What AI is allowed to know and do
  • Context plane What AI knows
  • Action plane What AI can do

  1. LLM01:2026

    Prompt Injection

    The attack

    Malicious instructions hidden in a user message, document, web page, tool result, or memory hijack the model and make it do something its builders never intended.

    Preventive controls

    • Context planeContent isolation: retrieved documents and tool results are passed as clearly marked, untrusted data, kept separate from system instructions.
    • Context planeSource provenance and trust scores travel with every chunk, so low-trust content can be down-ranked or excluded.
    • Action planeTool-call allowlists per use case and role, so an injected instruction cannot reach tools that were never permitted.
    • Control planeHuman approval for risky or irreversible actions, plus input and retrieval guardrails that screen for injection patterns.

  2. LLM02:2026

    Sensitive Information Disclosure

    The attack

    Confidential, personal, or regulated data leaks to someone who shouldn't see it, through answers, tool-call arguments, logs, or other side channels.

    Preventive controls

    • Context planePermission enforcement at retrieval: the ACL-aware knowledge graph and RAG index only return content the requesting user is entitled to see.
    • Control planeA policy engine (such as Cedar or OPA) decides which data each role and use case may access.
    • Control planeDLP and PII redaction on inputs, assembled context, and outputs, with the same rules applied to logs.
    • Control planeModel routing keeps sensitive workloads on the model endpoints your organization has approved.

  3. LLM03:2026

    Excessive Agency

    The attack

    An agent has more tools, permissions, or autonomy than it needs, so a confused or manipulated model can take damaging actions on real systems.

    Preventive controls

    • Action planeLeast-privilege tool and agent scopes through MCP: each agent sees only the tools and operations its use case requires.
    • Control planeActions run under the requesting user's identity and entitlements from your SSO, not a broad service account.
    • Control planeApproval checkpoints for high-impact actions, with every tool call recorded in the audit trail.
    • Action planeStep limits and circuit breakers stop runaway agent loops.

  4. LLM04:2026

    Supply Chain

    The attack

    A compromised model, dataset, adapter, library, or container slips in a backdoor or vulnerability before your AI system ever runs.

    Preventive controls

    • Control planeSigned container images, verified before deployment, with a software bill of materials (SBOM) for every release.
    • Control planeImages and model artifacts pulled from private registries inside your cloud.
    • Control planeThe model gateway only allows models and endpoints on your approved list.
    • Action planeOnly vetted, version-pinned MCP servers and tool packages are connected.

  5. LLM05:2026

    Data and Model Poisoning

    The attack

    Tampered training, fine-tuning, or ingested data quietly teaches the system wrong, biased, or malicious behavior that is hard to spot.

    Preventive controls

    • Context planeSource provenance and trust scoring for all ingested content, with ingestion limited to approved sources.
    • Context planeChange tracking on the knowledge graph and indexes, so unexpected edits can be reviewed and rolled back.
    • Control planeLineage links each answer to its sources, so poisoned content can be traced and purged.
    • Control planeEvals run as regression tests to catch behavior that drifts after content or model changes.

  6. LLM06:2026

    Unbounded Consumption

    The attack

    Floods of requests, oversized prompts, or runaway agents drive up costs, degrade service for everyone, or are used to copy a model's behavior.

    Preventive controls

    • Control planeA model gateway with per-user and per-application rate limits and token budgets.
    • Control planeCost controls with budgets, quotas, and hard spending caps by team and use case.
    • Action planeAgent step limits and circuit breakers keep one request from fanning out without bound.
    • Control planeUsage attribution and anomaly alerts surface unusual consumption early.

  7. LLM07:2026

    Misinformation

    The attack

    The model produces confident but wrong or unsupported output, and people or automated workflows trust it and act on it.

    Preventive controls

    • Context planeGrounding in a cited context package, so answers point to the sources they rely on.
    • Context planeA knowledge graph and business ontology keep facts and definitions consistent across assistants.
    • Control planeOutput guardrails flag unsupported claims, and the assistant can decline when context is insufficient.
    • Control planeEvals against reference answers and a plain-RAG baseline, plus human review for high-impact decisions.

  8. LLM08:2026

    Hidden Context Exposure

    The attack

    Attackers extract or infer the system prompt, tool schemas, or other hidden instructions, revealing secrets or logic that make further attacks easier.

    Preventive controls

    • Action planeSecrets stay out of prompts: credentials live in your secrets manager and are used by the action plane outside the model's context.
    • Control planeAuthorization is enforced by the policy engine, never by instructions in a prompt, so revealing a prompt doesn't grant access.
    • Control planeSystem prompt protection, with output checks for prompt and configuration leakage.
    • Action planeTool schemas are exposed per user scope, so the model only sees tools that user is allowed to use.

  9. LLM09:2026

    Vector and Embedding Weaknesses

    The attack

    Weaknesses in how content is embedded and searched let attackers retrieve data they shouldn't see, reconstruct text from vectors, or skew what gets retrieved.

    Preventive controls

    • Context planeVector store tenancy: separate indexes or namespaces by tenant, domain, or sensitivity.
    • Context planeAccess-control metadata enforced on every vector and graph query, not filtered after retrieval.
    • Context planeProvenance checks on what gets embedded, so untrusted content doesn't enter shared indexes.
    • Control planeVector stores run privately inside your VPC, encrypted with your keys, and are never exposed publicly.

  10. LLM10:2026

    Improper Output Handling

    The attack

    Model output is passed unchecked to browsers, databases, shells, or APIs, opening the door to attacks such as XSS, SQL injection, or remote code execution.

    Preventive controls

    • Action planeOutput validation against typed schemas before anything reaches a downstream system.
    • Action planeTyped, validated tool APIs instead of raw model-generated SQL or shell commands against systems of record.
    • Action planeContext-aware encoding and sanitization for every output destination.
    • Control planeOutput guardrails and DLP on responses, with outputs logged for review.

Across all ten

Audit and lineage for every request.

The control plane records who asked, what context was assembled, which sources and models were used, which tools were called, and which policies and approvals applied. When something looks wrong, your team can trace it end to end.

Defense in depth, not a guarantee

These controls are designed to reduce the likelihood and impact of each risk. They don't eliminate it. Some attacks, prompt injection in particular, have no complete technical fix today, which is why Contexor layers several controls across all three planes.

Security is also shared: how controls are configured, your cloud security posture, and your operating processes all matter. We configure and review the controls for each deployment with your security team.

Risk IDs and names are from the OWASP Top 10 for LLM Applications 2026 by the OWASP Gen AI Security Project, licensed under CC BY-SA 4.0. The attack descriptions are Contexor's plain-language summaries, and the control mappings are our own. Neither is endorsed by OWASP. See the OWASP document for full definitions, attack scenarios, and mitigations.

Review these controls with your security team.

We'll walk through how each control would be configured in your environment, and where your existing tools fit in.

Talk to usHow engagements work