OWASP Top 10 for LLM Applications, Explained

The OWASP Top 10 for LLM Applications is the OWASP GenAI Security Project's list of the ten most critical security risks in software built on large language models. The 2025 edition ranks them as: LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM03 Supply Chain, LLM04 Data and Model Poisoning, LLM05 Improper Output Handling, LLM06 Excessive Agency, LLM07 System Prompt Leakage, LLM08 Vector and Embedding Weaknesses, LLM09 Misinformation, and LLM10 Unbounded Consumption. It is the most widely used shared vocabulary for LLM risk, and the official list is maintained at genai.owasp.org.

This guide explains each risk in plain terms, gives a concrete example, and lists the controls that matter.

The list at a glance

LLM01: Prompt Injection

Prompt injection happens when text the model reads changes what it does, against the developer's intent. Direct injection comes from the user typing it. Indirect injection comes from content the application retrieves, such as a web page, email, document or tool result, which an attacker wrote. OWASP's LLM01 entry is explicit that, given how models work, there is no fool-proof prevention.

Example: a hidden line in a web page tells a browsing assistant to send the user's data to an external address.

Controls: constrain the model's permissions, separate trusted instructions from untrusted content, scan inputs for injected instructions, validate tool calls, require human approval for high-risk actions, and test adversarially. See What is prompt injection and how to prevent prompt injection.

LLM02: Sensitive Information Disclosure

The application exposes personal data, credentials, proprietary data or confidential business information, through its outputs, its logs or its training data. OWASP's LLM02 entry covers both what users send in and what the model gives out.

Example: a support assistant, asked the right question, quotes another customer's record that was retrieved into its context.

Controls: minimize and tokenize data before it reaches the model, enforce access control at retrieval, redact logs, and keep secrets out of prompts. LLM data leakage maps the seven paths data takes.

LLM03: Supply Chain

LLM applications depend on pre-trained models, adapters, datasets, Python packages, model servers, plugins and, increasingly, MCP servers. Any of them can be malicious or compromised. Model files in Python's pickle format can execute code when loaded, which is why the ecosystem has moved toward the safetensors format.

Example: a team downloads a fine-tuned model from a public hub whose file runs a payload on load.

Controls: use trusted sources, pin models and packages by hash, prefer safetensors, scan model files, keep an inventory of models and data (an AI bill of materials), and vet plugins and tools before installing them.

LLM04: Data and Model Poisoning

An attacker manipulates pre-training, fine-tuning or embedding data to introduce vulnerabilities, biases or backdoors. A backdoored model behaves normally until it sees a trigger. Research has shown that small amounts of poisoned data can be enough to plant such behavior.

Example: a fine-tuning dataset scraped from the web contains planted examples that make the model recommend an attacker's package for a common task.

Controls: track data provenance, vet and filter training data, evaluate models for anomalous behavior on trigger-like inputs, and limit what a model's output can do downstream.

LLM05: Improper Output Handling

Downstream code treats the model's output as trusted. If output becomes HTML, SQL, a shell command or a file path without validation, the model becomes an injection vector into those systems, and prompt injection becomes cross-site scripting, SQL injection or remote code execution.

Example: a chat interface renders model output as raw HTML, and an injected instruction makes the model emit a script tag.

Controls: treat model output like any other untrusted input. Encode for the context it is used in, use parameterized queries, never pass output to a shell or eval, and validate structured output against a schema.

LLM06: Excessive Agency

The model has more functionality, permissions or autonomy than its task needs, so a manipulated or mistaken model can do real damage. OWASP's LLM06 entry splits this into excessive functionality, excessive permissions and excessive autonomy. It is the risk that grows fastest as applications become agents.

Example: an email-summarizing assistant also has a send-email tool and full mailbox access, so an injected email can make it forward the inbox.

Controls: give each agent only the tools it needs, scope credentials to the requesting user, validate every tool call before it runs, and require confirmation for consequential actions. AI agent security covers this in depth.

LLM07: System Prompt Leakage

System prompts are not secret. Users routinely get models to repeat them. The risk is not the instructions themselves but what developers put in them: credentials, internal URLs, permission rules or details that help an attacker. OWASP's LLM07 entry advises assuming disclosure.

Example: a system prompt includes an internal API key "so the model can call the service", and a user extracts it.

Controls: keep secrets and authorization out of prompts entirely, and enforce access decisions in code.

LLM08: Vector and Embedding Weaknesses

Retrieval-augmented generation adds a vector store, an embedding pipeline and a retrieval step, each with its own weaknesses: retrieval that ignores document permissions, poisoned documents planted in the index, data from different tenants mixed in one store, and research showing embeddings can sometimes be inverted to recover source text.

Example: a shared index returns a confidential HR document to an employee who asked a loosely related question.

Controls: enforce permissions at retrieval, partition indexes by tenant, validate and track the provenance of indexed content, and scan retrieved text for injected instructions. See indirect prompt injection in RAG pipelines.

LLM09: Misinformation

Models produce fluent, confident output that can be wrong: invented facts, fake citations, insecure code, and packages that do not exist. People and systems that act on it without checking turn a model error into a real one. Hallucinated package names are a supply-chain risk of their own, because attackers can register them.

Example: a coding assistant suggests installing a package name it made up, which an attacker has since registered.

Controls: ground answers in retrieved sources, show citations, verify generated code and dependencies, and design workflows so a human checks consequential output.

LLM10: Unbounded Consumption

Uncontrolled use of an LLM application drains money, capacity or both, through very long inputs, request floods, expensive recursive agent loops, or "denial of wallet" attacks that run up a provider bill. It also covers extracting a model's behavior through mass querying.

Example: an agent loop with no step limit calls itself thousands of times on a crafted input.

Controls: rate limits and quotas per user and key, input size limits, step and time budgets for agents, spend alerts, and monitoring for abnormal usage.

What changed from the 2023 list

The 2025 edition reflects the move from chatbots to agents and RAG:

• New: System Prompt Leakage (LLM07) and Vector and Embedding Weaknesses (LLM08).
• Expanded: Excessive Agency, to cover agents and tool use; Sensitive Information Disclosure moved up to second.
• Renamed or merged: Model Denial of Service became Unbounded Consumption; Overreliance folded into Misinformation; Insecure Plugin Design and Model Theft were absorbed into other entries.

OWASP also publishes separate guidance on agentic AI threats and mitigations for risks specific to autonomous agents.

How to use the list

1. Threat model with it. For each LLM feature, walk through the ten entries and note which apply and how.
2. Map controls to risks. Most entries share a few controls: least privilege, validation of inputs and outputs outside the model, data minimization, and monitoring.
3. Test against it. Build red-team cases for each relevant entry, especially LLM01, LLM02, LLM05 and LLM06. AI red teaming shows how.
4. Pair it with frameworks. Use the NIST AI RMF for governance and MITRE ATLAS for adversary techniques.

FrostWolf Guard addresses the runtime side of LLM01, LLM02 and LLM06: it inspects prompts and retrieved content for injection, validates tool calls before they run, and keeps personal data out of the model.

Frequently asked questions

What is the OWASP Top 10 for LLM Applications?

It is a list of the ten most critical security risks in applications built on large language models, published by the OWASP GenAI Security Project. It gives developers and security teams a shared vocabulary and a starting set of mitigations, in the same way the classic OWASP Top 10 does for web applications.

What is number one on the OWASP LLM Top 10?

LLM01, Prompt Injection, has held the top spot in every edition. It covers both direct injection by a user and indirect injection through content the model reads, and OWASP notes there is no fool-proof prevention with current models.

What changed in the 2025 edition?

The 2025 list added System Prompt Leakage and Vector and Embedding Weaknesses, broadened Excessive Agency for agents, renamed Model Denial of Service to Unbounded Consumption, and folded Overreliance into Misinformation. Insecure Plugin Design and Model Theft were merged into other entries.

Is the OWASP LLM Top 10 a compliance standard?

No. It is an awareness document and a starting point. Auditors and frameworks increasingly reference it, but meeting it does not certify anything. Use it to structure threat modeling and testing, alongside frameworks such as the NIST AI RMF and MITRE ATLAS.