OWASP releases the Top 10 for LLM Applications 2025 edition

OWASP published the Top 10 for LLM Applications 2025 edition, an updated catalog of the most critical security risks facing large language model applications. The project's own revision history lists the release date as 2024-11-18 Version 2025 Release, following earlier 2023 versions.

What it is

The document is a community-produced list maintained by the OWASP GenAI Security Project, not a government law or binding standard. The project has since grown well beyond the Top 10 list itself, now backed by a large contributor base spanning many countries.

What it requires

The 2025 list organizes risks into ten named categories covering issues across the LLM lifecycle, starting with prompt injection. It also covers sensitive data handling, supply chain weaknesses, poisoning, output handling, and agency risk. New entries added for this edition address system prompt exposure, vector and embedding weaknesses, misinformation, and unbounded resource consumption. The document explains that this release expands Excessive Agency guidance given wider use of agent-style architectures that grant models more autonomy.

What security leaders should do

OWASP's own mitigation guidance recommends constraining model behavior through explicit system-prompt instructions. It also calls for restricting model permissions to only what is operationally necessary. For higher-risk actions, the guidance recommends adding a human checkpoint before execution. Security leaders can use the ten categories as a shared vocabulary for scoping LLM application reviews, vendor questionnaires, and red-team exercises.