OWASP Top 10 for LLM Applications (2025) Explained
The OWASP Top 10 for LLM Applications highlights the most important risks when building products on large language models. The 2025 edition reflects how teams now use LLMs: with retrieval, tools and agents, not just chat.
LLM01: Prompt Injection
Attacker-controlled input, direct or hidden in processed content, alters the model's behaviour. Control: least privilege, authorisation outside the model and human confirmation for risky actions. See our prompt injection guide.
LLM02: Sensitive Information Disclosure
The model reveals personal data, secrets, proprietary information or other users' data, through training data, context or retrieval. Control: keep secrets out of prompts, scope retrieval to the user's permissions and filter outputs.
LLM03: Supply Chain
Risks from third-party models, datasets, plugins and libraries, including tampered models and unsafe model file formats. Control: use trusted sources, verify integrity and prefer safe formats.
LLM04: Data and Model Poisoning
Manipulated training, fine-tuning or embedding data introduces backdoors or biases. Control: vet data sources, track provenance and test model behaviour.
LLM05: Improper Output Handling
Treating model output as trusted, for example rendering it as HTML, executing it as code or passing it into SQL. This turns injection into XSS, SSRF or RCE. Control: treat output as untrusted input, validate and encode it.
LLM06: Excessive Agency
The model has more tools, permissions or autonomy than necessary. An injected instruction can then do real damage. Control: minimal tools, scoped permissions, and approvals for impactful actions.
LLM07: System Prompt Leakage
System prompts are extracted, revealing internal logic, and worse, any secrets or rules placed there. Control: assume system prompts will leak; never put credentials or security decisions in them.
LLM08: Vector and Embedding Weaknesses
Retrieval-augmented generation (RAG) systems leak data across users or tenants, or are manipulated through poisoned documents. Control: enforce access control at retrieval, separate tenants and validate ingested content.
LLM09: Misinformation
The model produces false or misleading content that users rely on. Control: grounding, citations, human review for high-stakes outputs and clear communication of limitations.
LLM10: Unbounded Consumption
Uncontrolled usage drives up costs or causes denial of service, including attempts to extract the model through mass querying. Control: rate limits, quotas, input size limits and spending alerts.
Summary
| ID | Risk | Key control |
|---|---|---|
| LLM01 | Prompt injection | Least privilege, external authorisation |
| LLM02 | Sensitive disclosure | Scoped context and retrieval |
| LLM03 | Supply chain | Trusted, verified components |
| LLM04 | Poisoning | Data provenance |
| LLM05 | Output handling | Treat output as untrusted |
| LLM06 | Excessive agency | Minimal tools, approvals |
| LLM07 | Prompt leakage | No secrets in prompts |
| LLM08 | Vector weaknesses | Access-controlled retrieval |
| LLM09 | Misinformation | Grounding and review |
| LLM10 | Consumption | Limits and quotas |
Classic security still applies
Most real-world LLM application incidents also involve traditional weaknesses: missing authorisation on the API that calls the model, unsanitised output rendered in the browser, or leaked API keys. SecurityInfinity tests AI features alongside the rest of your application, covering both LLM-specific and classic vulnerabilities. Start free.
Frequently asked questions
Is the LLM Top 10 only for companies training models?
No. It applies to anyone building on LLMs, including teams using hosted model APIs.
Which risk should we focus on first?
Prompt injection combined with excessive agency. Together they determine how much damage a manipulated model can do.
Does using a major model provider remove these risks?
Providers handle some model-level risks, but application design, permissions, retrieval and output handling remain your responsibility.