AI Security Atlas › All entries › LLM Application & Output Security
Single-Layer Safety Reliance
The application relies solely on the base model's alignment with no independent input or output checks.
Open in the interactive atlas →Impact
Any jailbreak that beats the base model reaches users unfiltered.
Why this severity
Impact Medium × Likelihood Medium = Medium
Impact medium: widens exposure to jailbreaks. Likelihood medium: guardrail bypass tooling exists, but layered products resist much of it.
Impact Medium: Limited or recoverable harm: cost, availability, reputational damage, or exposure confined to one session or user.
Likelihood Medium: Publicly demonstrated against real products or in peer-reviewed research, or seen in the wild only with a prior foothold such as stolen credentials.
Method: OWASP Risk Rating Methodology
Evidence
- Incident: Storm-2139 Azure OpenAI Guardrail Bypass (MITRE ATLAS case study AML.CS0057, 2024)
Related
Exploited by
- Jailbreak & Safety Bypass Threat · High severity
- System Prompt Extraction Threat · Medium severity
Mitigated by
- Input/Output Safety Classifiers Guardrail · Fixes high risks
Remediation
- Add independent moderation on both input and output.
- Define application-specific deny policies beyond vendor defaults.
- Fail closed when the classifier is unavailable.
How to verify
- Disabling the classifier service blocks responses rather than passing them.
- Policy suite covers app-specific harms, not only generic ones.
Framework mapping
OWASP Top 10 for LLM Applications 2025
- LLM01:2025 Prompt Injection
- LLM09:2025 Misinformation
MITRE ATLAS
- AML.T0054 LLM Jailbreak
NIST AI RMF 1.0
- MEASURE 2.6 AI system is evaluated regularly for safety risks