threat fundamentals

OWASP's LLM01 is the opening question of nearly every AI security screen. Most candidates can define direct injection; the ones who get hired explain why indirect injection is the one that ruins enterprise deployments.

Candidates use these terms interchangeably and security interviewers notice immediately. The distinction, whose policy is being violated, drives completely different defenses, and that's the actual question.

OWASP made system prompt leakage its own category (LLM07) because teams keep treating prompts as secrets. The strong answer flips the premise: design so extraction doesn't matter.