The OWASP Top 10 for LLM Applications: A 2025 Field Guide

Every enterprise racing to ship AI features is quietly inheriting a new attack surface — one that traditional application security tools were never built to see. A SQL injection scanner won't catch a prompt injection. A dependency checker won't flag a poisoned fine-tuning dataset. To close that gap, the OWASP Gen AI Security Project maintains the Top 10 for LLM Applications — the industry's consensus list of the most critical risks in systems built on large language models. Here's the 2025 edition, what each risk means in practice, and how to defend against it.

Why This List Changed

The 2025 revision reflects how fast the threat landscape has moved since the first list in 2023. Retrieval-augmented generation (RAG) is now everywhere, so Vector and Embedding Weaknesses earned a dedicated entry. Autonomous agents went mainstream, sharpening the focus on Excessive Agency. And two new entries — System Prompt Leakage and Unbounded Consumption — capture risks that only became obvious once LLMs hit production at scale. The list is no longer theoretical; it maps directly to how real systems get breached.

The Ten Risks, Explained

LLM01: Prompt Injection. The signature LLM vulnerability. Attacker-controlled text — typed directly or hidden in a document, web page, or email the model reads — overrides the developer's instructions, causing data exfiltration, unauthorized actions, or jailbreaks. Because the model can't reliably tell instructions from data, this is the hardest risk to fully eliminate. Mitigate with: input/output filtering, privilege separation, and human approval for sensitive actions.

LLM02: Sensitive Information Disclosure. Models can leak PII, credentials, proprietary data, or fragments of their training set through targeted queries or careless outputs. Mitigate with: data sanitization, strict access controls on retrieval sources, and scrubbing sensitive data before it ever reaches the model.

LLM03: Supply Chain. Compromised base models, tampered fine-tunes from public hubs, malicious LoRA adapters, or vulnerable dependencies. A poisoned model downloaded from a public repository can carry a backdoor. Mitigate with: model provenance verification, signed artifacts, and an AI Bill of Materials (AIBOM).

LLM04: Data and Model Poisoning. Tampering with pre-training, fine-tuning, or embedding data to plant backdoors, biases, or degraded behavior. Mitigate with: vetting training-data sources, anomaly detection on datasets, and tracking data lineage.

LLM05: Improper Output Handling. Treating model output as trusted before it hits a downstream system. An LLM response passed unsanitized into a shell, SQL query, or browser can trigger remote code execution or XSS. Mitigate with: treat all model output as untrusted user input — encode, validate, and sanitize before use.

🚨

These risks compound. The most damaging real-world incidents chain several together: a prompt injection (LLM01) manipulates an agent with excessive agency (LLM06), whose output is improperly handled (LLM05) — turning a clever text trick into remote code execution. Defending each risk in isolation isn't enough; assume they'll be combined.

LLM06: Excessive Agency. Granting an LLM too much autonomy, too many tools, or too broad a set of permissions. When an agent can delete records, send money, or run code without checks, a single bad decision becomes a serious incident. Mitigate with: least-privilege tool access, scoped permissions, and human-in-the-loop gates for high-impact actions.

LLM07: System Prompt Leakage. New for 2025. Attackers coax the model into revealing its system prompt, exposing hidden instructions, business logic, or — worst case — secrets mistakenly embedded in it. Mitigate with: never put credentials or sensitive logic in prompts, and enforce controls outside the model rather than relying on prompt secrecy.

LLM08: Vector and Embedding Weaknesses. The RAG-era risk. Weaknesses in how vectors are generated, stored, or retrieved enable data leakage across tenants, embedding inversion attacks, or injection via poisoned documents in the knowledge base. Mitigate with: tenant isolation in vector stores, access controls on retrieved content, and validation of ingested documents.

LLM09: Misinformation. Hallucinations and confidently wrong outputs that users trust and act on — a genuine security risk in legal, medical, or financial contexts, and a path to bad code when developers accept fabricated package names. Mitigate with: grounding via retrieval, citation of sources, and human review for high-stakes outputs.

LLM10: Unbounded Consumption. Also new for 2025. Uncontrolled resource use leading to denial of service, runaway cloud bills ("denial of wallet"), or model theft through mass querying. Mitigate with: rate limiting, quotas, spend caps, and monitoring for extraction-style query patterns.

Turning the List Into a Defense Strategy

The Top 10 is most useful as a checklist across the LLM lifecycle rather than a set of isolated fixes. Three principles tie the mitigations together.

Trust nothing the model touches. Both inputs (LLM01, LLM08) and outputs (LLM05) must be treated as untrusted. The model is not a security boundary — it's a component that sits between untrusted data and your systems, and controls belong on either side of it.

Constrain what the model can do. Excessive Agency (LLM06) and Sensitive Information Disclosure (LLM02) both shrink dramatically under least-privilege design. If an agent only has the permissions it strictly needs, the blast radius of any compromise stays small.

Secure the pipeline, not just the prompt. Supply Chain (LLM03) and Data Poisoning (LLM04) happen long before a user sends a message. Provenance, signing, and an AI Bill of Materials matter as much as runtime guardrails.

ℹ️

Map it to what you already do. The OWASP LLM Top 10 isn't a replacement for your existing AppSec program — it's an extension. Fold these risks into threat modeling, add LLM-specific test cases to CI, and include prompt injection and output-handling checks in code review. OWASP also publishes a companion LLM Cybersecurity & Governance Checklist to operationalize this.

Why It Matters Now

These aren't hypothetical risks. Autonomous AI agents that plan and execute multi-step tasks are moving into production across finance, customer service, and software development — and each new capability maps onto an entry in this list. For fully autonomous systems, OWASP now also runs a dedicated Agentic Security Initiative with a companion Top 10 for agentic threats, alongside this LLM-focused list. Regulators have taken notice: frameworks like Singapore's runtime safeguards for agentic finance are, in effect, LLM06 and LLM05 mitigations turned into policy. The first fully autonomous LLM-driven ransomware, disclosed in mid-2026, chained prompt-driven behavior with excessive agency to devastating effect. The organizations that treat the OWASP Top 10 as a live engineering checklist — not a compliance afterthought — are the ones that will ship AI safely.

The Bottom Line

The OWASP Top 10 for LLM Applications gives security and engineering teams a shared vocabulary for a threat surface that didn't exist a few years ago. You don't need to solve all ten at once, but you do need to know which ones your architecture exposes. Start with the risks tied to your design — prompt injection and output handling for any user-facing app, excessive agency and vector weaknesses for agentic and RAG systems — and build the mitigations into your pipeline rather than bolting them on later. In LLM security, the cost of retrofitting is always higher than the cost of designing it in.

The OWASP Top 10 for LLM Applications: A 2025 Field Guide