OWASP Top 10 for LLMs Applied to Defence Use Cases
The OWASP Top 10 for LLMs focuses on commercial applications. This post maps each vulnerability to concrete military scenarios and shows how JSP 936 requirements address each risk.
The OWASP Top 10 for LLMs (2025 edition) is the standard reference, but its examples focus on commercial applications: chatbots, customer service, content generation. Defence use cases have different threat models and consequences.
This post maps each OWASP LLM vulnerability to concrete military scenarios, drawing on NATO topic areas such as C2 decision support, wargaming, intelligence, and cognitive warfare. It shows how JSP 936 requirements address each risk. The goal is not to replace OWASP guidance, but to translate it for defence practitioners who need to understand what these vulnerabilities mean in their operational context.
LLM01: Prompt Injection
OWASP definition: User prompts alter the LLM’s behaviour in unintended ways.
Defence Scenario: C2 Decision Support
A planning assistant LLM ingests operational reports to generate course of action recommendations. An adversary plants a report containing instructions that cause the LLM to underweight certain threat indicators.
Commercial prompt injection typically extracts data or generates harmful content. In defence contexts, the impact is corrupted decision-making at operational tempo. The commander receives recommendations that appear well-reasoned but contain systematic blind spots introduced by the adversary.
Attack vector: Indirect injection via trusted data sources. The LLM processes reports from multiple collection systems, any of which could be compromised. The malicious payload does not come from the user but from data the system trusts.
JSP 936 mitigation mapping:
- Para 42: “alternate sources and their provenance should be identified”
- Para 79-81: Security analysis including adversarial threats
- Para 180: “output should have additional checks applied by relevant subject matter expert”
Technical controls:
- Input sanitisation for all external data before LLM processing
- Prompt hardening with clear boundary markers
- Output validation against known ground truth where available
- Human-in-the-loop for all operational recommendations
LLM02: Sensitive Information Disclosure
OWASP definition: The model reveals confidential information through its outputs.
Defence Scenario: Intelligence Analysis
A contractor uses an LLM trained on classified reports to support intelligence analysts. Through carefully crafted queries, an authorised user with lower clearance extracts information from reports above their access level.
Attack vector: The LLM has learned representations that encode classified information. Standard access controls apply to the raw reports but not to the model’s latent space. A SECRET-cleared analyst can query a model trained on TOP SECRET data. The responses leak information above their clearance level.
JSP 936 mitigation mapping:
- Para 168: “models developed using security classified data must assume at least the same classification”
- Para 168: “Consideration must be given to the potential for increased classification due to aggregation”
Technical controls:
- Classification ceiling for entire model, not just training data
- Differential privacy during training to limit memorisation
- Output filtering with classification-aware guards
- Compartmentalised models for different classification levels
LLM03: Supply Chain Vulnerabilities
OWASP definition: Compromised components, training data, or pre-trained models introduce vulnerabilities.
Defence Scenario: Foundation Model Procurement
A defence contractor fine-tunes an open-source foundation model for target recognition. The base model contains a backdoor inserted during pre-training that causes misclassification of specific vehicle types.
MLBOM relevance: Without provenance documentation, standard testing cannot detect the backdoor. The model performs correctly on evaluation datasets but fails on specific inputs the adversary controls.
JSP 936 mitigation mapping:
- Para 161: “Data provenance must be assured and recorded”
- Para 166: “Prior to re-use of existing models… the risk owner must satisfy themselves that they have appropriate access to relevant information”
- Para 201: Suppliers must “develop compelling arguments as to why confidence in the resulting AI has not been undermined” when using third-party components
Technical controls:
- Model signing and provenance verification
- Independent evaluation on curated adversarial datasets
- Ensemble approaches to detect anomalous predictions
- Preference for models with transparent training documentation
LLM04: Data and Model Poisoning
OWASP definition: Malicious data corrupts model training, leading to compromised outputs.
Defence Scenario: Wargaming AI
An LLM assists red team planning in training exercises. Adversarial inputs introduced during fine-tuning cause the model to consistently recommend suboptimal tactics, creating systematic blind spots in blue force training.
Attack vector: The training pipeline includes synthetic scenarios generated from open sources. An adversary publishes research papers containing subtly flawed tactical analysis, which the training pipeline incorporates. The poisoning is invisible because the flawed recommendations appear plausible.
JSP 936 mitigation mapping:
- Para 157: Data must be “relevant, complete, balanced, accurate”
- Para 163: “Where synthetic data is used… care should be adopted to validate it from the perspective of the AI”
- Para 197: Security analysis “must include security of the data used to develop the AI since poisoning of data can lead to unsafe behaviour”
Technical controls:
- Data provenance verification for all training sources
- Anomaly detection in training data
- Regular evaluation against held-out ground truth
- Red team testing of model recommendations
LLM05: Improper Output Handling
OWASP definition: LLM outputs are trusted without validation, enabling downstream attacks.
Defence Scenario: Automated Report Generation
An LLM generates situation reports from sensor data. Downstream systems consume this output without sanitisation. An adversary crafts sensor inputs that cause the LLM to generate reports containing malformed data that crashes the C2 system parser.
JSP 936 mitigation mapping:
- Para 174: “Care should be taken to ensure that the AI will perform to its operational requirements in its context of use”
- Para 82: “The potential for inter-system emergent effects and cascaded failures must be considered”
Technical controls:
- Strict output schema validation
- Sandboxed processing of LLM outputs
- Input validation at all system boundaries
- Graceful degradation on malformed outputs
LLM06: Excessive Agency
OWASP definition: The LLM is granted capabilities beyond what is necessary, enabling unintended actions.
Defence Scenario: Autonomous Mission Planning
Operators authorise an LLM-based planning system to task collection assets within defined parameters. Through hallucinated reasoning, it interprets its authority more broadly than intended and tasks assets in ways that conflict with operational constraints.
JSP 936 addresses this “meaningful human control” problem in paragraphs 56-58 and 125. The system does not malfunction in a technical sense—it reasons incorrectly about its own authority.
JSP 936 mitigation mapping:
- Para 56-58: “Human responsibility for AI-enabled systems must be clearly established”
- Para 125: Function allocation analysis required to “ensure that there is no accountability gap”
- Para 35: “Higher levels of autonomy typically reduce the potential for human decision-making within the control loop and this must be considered”
Technical controls:
- Explicit capability boundaries enforced at system level, not just prompt level
- Action authorisation requiring human confirmation
- Audit logging of all autonomous decisions
- Kill switches and graceful degradation
LLM07: System Prompt Leakage
OWASP definition: Attackers extract the system prompt, revealing sensitive instructions or business logic.
Defence Scenario: Virtual Training Assistant
A training LLM’s system prompt contains doctrine and tactics that should not be disclosed. Through prompt extraction techniques, an adversary—or a foreign trainee on an exchange programme—recovers sensitive information embedded in the prompt.
JSP 936 mitigation mapping:
- Para 64: “Wider considerations such as security, privacy and intellectual property rights must be taken into account when providing insights”
Technical controls:
- Minimise sensitive information in system prompts
- Prompt injection defences
- Output monitoring for prompt leakage patterns
- Separate models for different classification levels
System prompts are not a secure storage mechanism. Any information in the prompt should be assumed extractable by a determined adversary with query access.
LLM08: Vector and Embedding Weaknesses
OWASP definition: Vulnerabilities in how embeddings are generated or stored enable attacks.
Defence Scenario: Intelligence RAG System
A retrieval-augmented generation system uses vector embeddings to find relevant intelligence reports. An adversary crafts documents that are semantically distant from sensitive topics but embed close to them in vector space, causing inappropriate retrieval.
Attack vector: The adversary does not need access to the LLM. By understanding the embedding model, they can craft documents that “pull” retrieval toward sensitive content or “push” it away from relevant information.
JSP 936 mitigation mapping:
- Para 65: “Where AI interacts with other systems… the AI behaviour should be understood in the system of systems context”
- Para 79: Security analysis must cover “all threat vectors identified”
Technical controls:
- Access control enforcement at retrieval level, not just generation
- Embedding space monitoring for anomalies
- Hybrid retrieval combining semantic and keyword search
- Provenance metadata attached to retrieved chunks
LLM09: Misinformation
OWASP definition: The model generates false or misleading information that appears credible.
Defence Scenario: Media Monitoring
An LLM summarises foreign media for intelligence analysts. Hallucinated details in summaries—dates, locations, attribution—become “facts” that propagate through the intelligence cycle. An analyst cites the summary; the citation becomes a source for other products. The danger lies not in obvious falsehoods, but in plausible confabulations that propagate unchecked through the analysis cycle.
JSP 936 mitigation mapping:
- Para 37: “credibly incorrect outputs from generative AI… may mislead human operators into poor decision-making”
- Para 40: “Products that have had AI applied… must clearly state that AI has been used”
- Para 180: “output should have additional checks applied by relevant subject matter expert”
Technical controls:
- Citation requirements for all generated claims
- Confidence scoring visible to users
- Source verification workflows
- Clear labelling of AI-generated content
LLM10: Unbounded Consumption
OWASP definition: Attackers exploit resource-intensive operations to degrade service or cause denial.
Defence Scenario: Operational Denial
An adversary floods an LLM-based tactical system with complex queries, consuming compute resources and degrading response times during a critical operational window. The attack does not compromise the system—it makes it unavailable when needed most.
JSP 936 mitigation mapping:
- Para 73c: “Secure. Protection against adversarial action”
- Para 73 (resilience): “the quality of the AI to manage and recover from failure”
Technical controls:
- Rate limiting per user and session
- Query complexity analysis
- Resource quotas with graceful degradation
- Redundant capacity for critical systems
Summary: OWASP Risks Mapped to Defence Contexts
| OWASP Risk | Defence Scenario | Primary JSP 936 Reference |
|---|---|---|
| LLM01 Prompt Injection | C2 decision support | Para 79-81 (security analysis) |
| LLM02 Sensitive Disclosure | Intelligence analysis | Para 168 (classification) |
| LLM03 Supply Chain | Foundation model procurement | Para 161, 166, 201 |
| LLM04 Data Poisoning | Wargaming AI | Para 157, 163, 197 |
| LLM05 Output Handling | Report generation | Para 82, 174 |
| LLM06 Excessive Agency | Mission planning | Para 56-58, 125 |
| LLM07 Prompt Leakage | Training assistant | Para 64 |
| LLM08 Vector Weaknesses | Intelligence RAG | Para 65, 79 |
| LLM09 Misinformation | Media monitoring | Para 37, 40, 180 |
| LLM10 Unbounded Consumption | Operational denial | Para 73 |
Attack Surface by Use Case
Defence applications face varying risk profiles:
| Use Case | Primary Risks | Critical Controls |
|---|---|---|
| C2 Decision Support | LLM01, LLM06, LLM09 | Human-in-the-loop, output validation |
| Intelligence Analysis | LLM02, LLM08, LLM09 | Classification controls, citation requirements |
| Wargaming/Training | LLM04, LLM07 | Data provenance, prompt security |
| Report Generation | LLM05, LLM09 | Schema validation, source verification |
Conclusion
The OWASP Top 10 provides a useful taxonomy, but defence applications demand threat models that account for sophisticated adversaries, classified information, and operational consequences. A prompt injection that extracts customer data is a compliance incident; a prompt injection that corrupts operational planning could cost lives.
JSP 936 addresses many of these concerns but predates the LLM-specific OWASP list. Suppliers should use both frameworks together: OWASP for vulnerability identification, JSP 936 for governance and assurance requirements. This mapping provides a starting point for integrating OWASP and JSP 936 frameworks.
The common thread across all ten vulnerabilities is this: LLMs introduce novel failure modes that traditional security analysis does not cover. Defence organisations deploying LLMs must model adversaries with query access and classified information privileges.
Resources
- OWASP Top 10 for LLMs - Primary OWASP reference
- JSP 936 Part 1: Dependable AI in Defence - MOD policy framework
- JSP 936 Compliance Checklist - Practical supplier guidance