An LLM in production is a new kind of attack surface: it takes untrusted natural-language input, reasons over sensitive context, and — increasingly — calls tools that do things. Traditional input validation doesn't cover it. Shipping AI safely means adding guardrails at the boundaries, with the same rigor you'd apply to any other untrusted-input system.
The threats, concretely
- Prompt injection — user (or retrieved) text that hijacks the model's instructions ("ignore previous instructions and…"). The #1 LLM-specific risk.
- Data leakage — the model exposes secrets, other users' data, or internal context it shouldn't.
- Unsafe tool use — an agent calls a destructive or money-moving tool with attacker-influenced arguments.
- Harmful / off-policy output — content that violates your policy or brand.
- Cost/DoS abuse — adversarial inputs that drive huge token usage.
Guardrails by layer
Input. Treat all input as untrusted — including retrieved documents (indirect injection hides there). Separate instructions from data with clear delimiters, keep the trusted system prompt isolated, and don't blindly concatenate user text into a position of authority.
Tool / action. This is where injection turns into damage. Enforce permissions in code, not the prompt: allowlist callable tools, validate every argument, require confirmation/human approval for irreversible actions, and make writes idempotent. The model proposes; your code decides.
Output. Validate before use — schema-check structured output, scan for leaked secrets/PII, and apply content filtering. Never render model output as trusted HTML or execute it without sanitization.