OWASP Top 10 for LLM Applications

The OWASP Top 10 for LLM Applications originated in 2023 as a standalone OWASP project and is now maintained by the OWASP GenAI Security Project, which according to the project involves more than 600 experts from over 18 countries. The current release is the 2025 version; it superseded the previous version 1.1 (2023) and labels the risks uniformly as LLM01:2025 through LLM10:2025. It is an awareness and prioritisation document, not a certifiable standard: the list ranks the risk classes the community considers most critical, but it replaces neither a threat model nor a control framework such as the NIST AI RMF. Its scope covers applications that embed an LLM – from a simple chat interface through RAG systems to copilots with tool integrations.

LLM01 Prompt Injection refers to manipulating model behaviour through inputs – directly by users or indirectly via processed content such as documents, web pages and emails; since it cannot be fully prevented with today's techniques, the core defences are restricted privileges, input and output filtering, and human approval for critical actions. LLM02 Sensitive Information Disclosure describes the exposure of sensitive information in model outputs, such as personal data, trade secrets or credentials; effective countermeasures include data minimisation and sanitisation in training and context, strict access controls, and output filtering. LLM03 Supply Chain covers risks from pre-trained models, training datasets, fine-tuning adapters and third-party platforms; typical mitigations are provenance and integrity checks, an inventory of all model and data artefacts, and sourcing exclusively from trusted providers.

LLM04 Data and Model Poisoning means the deliberate manipulation of training, fine-tuning or embedding data to plant backdoors or biases; countermeasures include validating data provenance, anomaly detection, and systematic evaluation including red teaming before going to production. LLM05 Improper Output Handling arises when model outputs are processed without scrutiny and trigger cross-site scripting, SQL injection or code execution downstream; the core rule is to treat outputs like untrusted user input – with validation, context-aware encoding and parameterised calls. LLM06 Excessive Agency describes LLM components granted too many functions, overly broad permissions or too much autonomy; effective defences are minimal tool sets, least-privilege permissions per tool, and mandatory approval steps before consequential actions.

LLM07 System Prompt Leakage addresses the disclosure of system prompts – critical when they contain credentials or security logic; secrets therefore never belong in the prompt, and security controls must be enforced outside the model. LLM08 Vector and Embedding Weaknesses concerns RAG pipelines and vector databases, including unauthorised access to embeddings, injected content or the mixing of contexts across multiple tenants; mitigations include fine-grained document-level access controls, clean tenant separation and validation of knowledge sources. LLM09 Misinformation refers to factually wrong yet plausible-sounding outputs that users trust because of the authoritative tone; effective countermeasures are RAG with curated sources, source citations in responses and human review in critical processes. LLM10 Unbounded Consumption, finally, covers uncontrolled resource usage up to denial of service, cost explosion and model extraction; it is contained through rate limits, quotas, input size limits and continuous cost monitoring.

On 9 December 2025, the OWASP GenAI Security Project additionally published the OWASP Top 10 for Agentic Applications (version 2026) – ten risks from ASI01 "Agent Goal Hijack" to ASI10 "Rogue Agents" for autonomous agent systems; both lists come from the same project and are designed to be complementary. The rule of thumb for choosing between them: the LLM list applies to applications that embed a model and process its inputs and outputs. As soon as the system goes further – planning autonomously, invoking tools, persisting state or communicating with other agents – the agentic risk classes come into play, while the LLM list remains valid for the model and prompt layer, since many ASI risks have prompt injection (LLM01) at their root. A detailed discussion of the ASI list is available on our knowledge page on the OWASP Top 10 for Agentic Applications.

In assessment practice, the list serves above all as a shared framework for scoping and reporting: client and testers agree which of the ten risk classes are relevant to the target system and map findings traceably to LLM01–LLM10. Which risks can be actively tested depends on the architecture – prompt injection, output handling, system prompt leakage and unbounded consumption can be probed directly on the running system, whereas supply chain and poisoning risks call for architecture and process reviews rather than pure attack simulation. A RAG system additionally needs tests for LLM08, an application with tool integrations a focus on LLM06; for genuine agent systems, the scoping should be extended with the ASI taxonomy. An LLM pentest does not replace a classic web or API test – it complements it with the model-specific attack surface.