What is the OWASP Top 10 for LLM Applications? The 2025 list explained

The OWASP Top 10 for LLM Applications is a community-built ranking of the ten most critical security risks in software that uses large language models, maintained by the OWASP GenAI Security Project. The 2025 edition, published on November 17, 2024, runs from LLM01 Prompt Injection to LLM10 Unbounded Consumption.

OWASP says the project began in 2023, and that developers and security professionals keep finding new vulnerabilities as LLMs are built more deeply into customer interactions and internal operations. The risks it ranks are not theoretical: the UK NCSC wrote in December 2025 that prompt injection attacks are regularly reported in systems that use generative AI.

What are the ten risks on the 2025 list?

The ten entries cover how models are manipulated, what they leak, where their components come from, and what happens to their output. Each is summarised below from its OWASP page.

LLM01 Prompt Injection. Inputs alter the model's behaviour in unintended ways, and they need not be readable by people as long as the model parses them.

LLM02 Sensitive Information Disclosure. Models can expose personal data, financial details, health records, confidential business data, credentials and legal documents. OWASP warns that system prompt restrictions on what data to return can be bypassed through prompt injection.

LLM03 Supply Chain. Beyond code dependencies, the risk extends to third-party pre-trained models and datasets. OWASP recommends using only models from verifiable sources, backed by signing and file-hash integrity checks.

LLM04 Data and Model Poisoning. Training, fine-tuning or embedding data is manipulated to plant vulnerabilities, backdoors or biases. A backdoor can stay dormant until triggered, which makes it hard to test for.

Which risks arise after the model responds?

Most of the second half of the list, LLM05 to LLM10, concerns what happens once a model has produced output: that output flowing into other software, agents acting on it, prompts and retrieval stores exposing data, users trusting false answers, and usage running out of control.

LLM05 Improper Output Handling. Model output passed to other systems without validation or sanitisation can lead to XSS, CSRF, SSRF, privilege escalation or remote code execution. OWASP's first mitigation is to treat the model like any other user under a zero-trust approach.

LLM06 Excessive Agency. Damaging actions follow from unexpected, ambiguous or manipulated model outputs. OWASP's examples involve extensions with functions or downstream permissions the application does not need, and extensions that carry out high-impact actions without independent approval.

LLM07 System Prompt Leakage. OWASP's position is that a system prompt should never be treated as a secret or used as a security control, so credentials and connection strings do not belong in it.

LLM08 Vector and Embedding Weaknesses. In retrieval augmented generation (RAG) systems, flaws in how embeddings are generated, stored or retrieved can be used to inject content, steer outputs or reach sensitive data. The recommended control is fine-grained, permission-aware vector stores.

LLM09 Misinformation. Models produce false or misleading content that looks credible, and the harm grows with overreliance, when users trust output without checking it.

LLM10 Unbounded Consumption. Applications that allow excessive, uncontrolled inference face denial of service, economic loss, model theft and degraded service. Rate limits and per-user quotas are among OWASP's listed defences.

Is there a newer edition than the 2025 list?

Yes. OWASP published a 2026 edition on August 3, 2026, which it says brings updated rankings, broader threat coverage and research drawn from thousands of real-world AI security incidents.

The 2026 guide maps its risks to NIST, MITRE ATLAS, CWE and the separate OWASP Top 10 for Agentic Applications, and names CISOs among its intended readers alongside developers, architects and security teams. Teams whose policies, contracts or audit checklists cite OWASP entry numbers should confirm which edition each requirement refers to.

How should security leaders use the OWASP list?

Use it as a shared vocabulary for threat modelling and vendor review, not as a compliance certificate. A practical approach is to map each production LLM application against the ten entries, record which controls cover each one, and ask suppliers the same questions.

Several entries point to the same underlying control. Least privilege for tools addresses excessive agency, keeping secrets out of prompts addresses system prompt leakage, and validating model output before it reaches other systems addresses improper output handling. Prompt injection sits across all of them, which is why OWASP lists human approval for high-risk actions among its mitigations.