The OWASP Top 10 for LLM Applications: A Practical Guide

The OWASP GenAI Security Project maintains a Top 10 list of risks specific to applications built on large language models. The 2025 edition is summarized below. Names and ordering may change in future editions, so check the OWASP site for the current list.

LLM01: Prompt Injection

Inputs, direct or hidden in retrieved content, alter the model's behavior. Mitigate by limiting model privileges, validating output, requiring approval for sensitive actions and testing with adversarial inputs. Full treatment: Defending LLM Applications Against Prompt Injection.

LLM02: Sensitive Information Disclosure

The model reveals personal data, credentials or proprietary information from its training data, context window or connected systems. Mitigate by keeping secrets out of prompts, minimizing data sent to the model, enforcing access control before retrieval and filtering outputs.

LLM03: Supply Chain

Risks from third-party models, datasets, plugins and libraries: a tampered model file, a malicious plugin, or a poisoned dependency. Mitigate by verifying sources and checksums, pinning versions, scanning model artifacts, preferring safe serialization formats, and maintaining an inventory of AI components (an "AI bill of materials").

LLM04: Data and Model Poisoning

Malicious or low-quality data is introduced into training, fine-tuning or retrieval sources, creating backdoors or bias. Mitigate by controlling and tracking data provenance, validating datasets, restricting who can write to retrieval indexes and monitoring model behavior for anomalies.

LLM05: Improper Output Handling

Model output is passed to other systems without validation, enabling cross-site scripting, SQL injection, command execution or server-side request forgery. Mitigate by treating output as untrusted input: encode for the context, use parameterized queries and validate against strict schemas.

LLM06: Excessive Agency

The model has too much functionality, permission or autonomy, so errors or attacks lead to damaging actions. Mitigate by removing unneeded tools, using per-user least-privilege credentials, and requiring human approval for high-impact actions. See Secure Agentic Workflows.

LLM07: System Prompt Leakage

Instructions in the system prompt contain secrets or sensitive rules that can be extracted. Mitigate by assuming the prompt is public: never store credentials or security-critical logic in it, and enforce controls in code.

LLM08: Vector and Embedding Weaknesses

Flaws in retrieval systems: missing access controls on stored chunks, cross-tenant leakage, poisoned documents and information leaking through embeddings. Mitigate with permission-aware retrieval, tenant isolation, source validation and access logging.

LLM09: Misinformation

The model produces plausible but false content, including invented citations or code packages that do not exist, which attackers can register to distribute malware. Mitigate with grounding in trusted sources, citations that can be verified, human review for high-stakes use and checks that dependencies exist and are legitimate.

LLM10: Unbounded Consumption

Excessive or abusive use leads to denial of service, runaway cost or model extraction. Mitigate with rate limits, per-user quotas, input size limits, timeouts, spend alerts and monitoring for scraping patterns.

Using the list

The list is a starting point, not a complete program. A practical approach for a team:

1. Map each of your LLM features to the ten categories and note which apply.
2. Rank by impact: what data and tools does the feature touch?
3. Implement the mitigation with the highest risk reduction first, which is usually reducing privilege and adding approvals.
4. Add adversarial test cases for each applicable category to your regression suite.
5. Review when you add a new tool, data source or model.

Combine this with a general risk framework such as the NIST AI RMF for governance and documentation.