, plugins or downstream functions).  Treat the LLM as an untrusted user and maintain final user control on decision-making processes.  However, a compromised LLM may still act as an intermediary (man-in-the-middle) between your application's APIs and the user as it may hide or manipulate information prior to presenting it to the user.  Highlight potentially untrustworthy responses visually to the user.  OWASP