The OWASP LLM Top 10

The OWASP Top 10 for Large Language Model Applications is a community-driven list of the most critical security risks specific to systems built on LLMs. It mirrors the well-known OWASP Web Top 10 but addresses threats that classic AppSec lists miss.

It exists because LLM apps introduce new attack surface: natural-language control flow, non-deterministic output, model supply chains, and autonomous agents. The list gives security teams a shared vocabulary and a checklist for threat modeling.

The codes below use the LLM01-LLM10 numbering from the 2025 edition.

LLM01: Prompt Injection is consistently the number-one risk. Attacker-controlled text overrides the developer's instructions because the model cannot separate trusted instructions from untrusted data.

• Direct: the user types override instructions.
• Indirect: instructions hide in retrieved web pages, files, or tool output.

Mitigations: enforce least privilege on tools, treat all retrieved content as data, add human checkpoints for sensitive actions, and break the data-exfiltration path.

LLM02: Sensitive Information Disclosure covers the model revealing data it should not: PII, secrets, proprietary training data, or another tenant's information.

Leaks happen through memorized training data, over-broad context injection, or system prompts that contain credentials.

• Sanitize and minimize data placed in context.
• Never put live secrets in prompts; use scoped, short-lived tokens out of band.
• Apply output filtering and data-loss-prevention checks before returning responses.

LLM03: Supply Chain risks come from third-party models, datasets, plugins, and libraries. A poisoned base model, a backdoored fine-tune from a model hub, or a malicious Python dependency can compromise the whole app.

• Verify model provenance and checksums.
• Pin versions and review licenses.
• Scan pickled model files (pickle can execute code on load) and prefer safe formats like safetensors.

LLM04: Data and Model Poisoning targets the training or fine-tuning pipeline. An attacker who can influence training data can implant backdoors (hidden triggers), bias outputs, or degrade quality.

RAG pipelines that ingest user-submitted documents are a live poisoning surface even after deployment.

• Vet and sign training data sources.
• Use anomaly detection on datasets.
• Isolate and review user-contributed content before indexing.

LLM05: Improper Output Handling occurs when downstream components trust model output without validation. Because output is attacker-influenceable via injection, passing it unvalidated into a shell, SQL query, browser, or eval is a direct path to XSS, SSRF, or RCE.

Rule: treat LLM output exactly like untrusted user input. Encode, validate, and sandbox before it touches any interpreter.

LLM06: Excessive Agency is harm caused by giving the model too much functionality, too many permissions, or too much autonomy. When the model can call tools, an injection becomes an action, not just text.

• Excessive functionality: tools the app does not actually need.
• Excessive permissions: a tool with write/delete when read suffices.
• Excessive autonomy: high-impact actions with no human approval.

Apply least privilege per tool and require confirmation for irreversible operations.

LLM07: System Prompt Leakage recognizes that system prompts are not a secure secret store. Attackers can often extract them, and they sometimes contain credentials, hidden business logic, or filtering rules that aid further attacks.

• Assume the system prompt is recoverable; never embed secrets or keys in it.
• Enforce authorization in your backend, not by hoping a prompt rule holds.
• Treat any security control as broken if it lives only in the prompt text.

The remaining entries:

• LLM08 Vector and Embedding Weaknesses: risks in RAG embeddings, such as cross-tenant leakage, embedding inversion, and indexing poisoned documents. Enforce access control at retrieval time.
• LLM09 Misinformation: confident hallucinations and overreliance. Add grounding, citations, and human review for high-stakes outputs.
• LLM10 Unbounded Consumption: denial-of-wallet and DoS from expensive or runaway queries. Apply rate limits, token budgets, timeouts, and cost alerts.

The Top 10 is most useful as a structured checklist during design review:

• Map each component (input, retrieval, tools, output) to relevant LLM risks.
• For each risk, identify a concrete control and an owner.
• Write abuse cases and turn them into automated tests.

Combine it with existing frameworks like the standard OWASP Top 10, MITRE ATLAS for ML-specific tactics, and the NIST AI Risk Management Framework for governance.

No single control covers these risks. Layer them:

• Input layer: validation, classification, rate limits.
• Model layer: least-privilege tools, scoped context, guard models.
• Output layer: validation, encoding, DLP, human approval.
• Platform layer: logging, monitoring, supply-chain verification, cost controls.

Assume any one layer can fail and design so a single failure does not become a breach.

Test your grasp of the OWASP LLM categories.

The OWASP LLM Top 10 at a glance:

• LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM03 Supply Chain, LLM04 Data and Model Poisoning, LLM05 Improper Output Handling.
• LLM06 Excessive Agency, LLM07 System Prompt Leakage, LLM08 Vector and Embedding Weaknesses, LLM09 Misinformation, LLM10 Unbounded Consumption.
• Treat model output and the system prompt as untrusted and non-secret.
• Use the list as a threat-modeling checklist, pair it with MITRE ATLAS and NIST AI RMF, and enforce defense in depth across input, model, output, and platform layers.