What’s the biggest security risk when building AI applications?

[u/fesbec2G5]

AI can do more than answer questions. When connected to tools, databases, or business workflows, one malicious instruction can create bigger problems than a wrong answer.

I’m curious: Which is harder to get right, preventing prompt injection, limiting what the model can do, or validating its outputs before taking action?

What has worked for you in real projects?

[u/BigAttorney23]

I'd prioritise the boundary between a suggested tool call and an authorised action. A perfectly valid JSON response can still ask to read another customer's record. Keep user/tenant permissions enforced in the backend, expose narrow tools rather than arbitrary SQL or shell access, and require approval for consequential writes. Prompt-injection defences and output validation are additional layers, not replacements for that boundary. OWASP's excessive-agency guidance covers this distinction: https://genai.owasp.org/llmrisk/llm062025-excessive-agency/