The OWASP Top 10 for LLM Applications is a community-maintained list of the ten most critical security risks in applications built on large language models, published by the OWASP Gen AI Security Project. Security teams use it as a shared vocabulary and as a checklist for threat modelling and testing.
The 2025 list
- LLM01 Prompt Injection: inputs that override the developer's instructions. See prompt injection.
- LLM02 Sensitive Information Disclosure: leaking personal data, credentials or proprietary information. See data exfiltration.
- LLM03 Supply Chain: compromised models, datasets, adapters or dependencies.
- LLM04 Data and Model Poisoning: manipulated training or fine-tuning data that plants backdoors or biases.
- LLM05 Improper Output Handling: passing model output to browsers, shells or databases without validation.
- LLM06 Excessive Agency: more tools, permissions or autonomy than needed. See excessive agency.
- LLM07 System Prompt Leakage: exposing hidden instructions. See system prompt leakage.
- LLM08 Vector and Embedding Weaknesses: attacks on retrieval stores, such as poisoned documents or cross-tenant leakage.
- LLM09 Misinformation: confident false output, including hallucination, that users rely on.
- LLM10 Unbounded Consumption: uncontrolled resource use leading to denial of service or cost blow-ups.
Using it in practice
A team shipping a retrieval-based support agent walks the list: LLM01 and LLM08 apply because it reads customer documents; LLM06 applies because it can issue refunds; LLM10 applies because it is public. For each, they write a test: injected documents, refund attempts above policy, very long inputs. Each test becomes a case in the eval suite with an attack success rate threshold. Items that do not apply are recorded as such, with a reason.
Limits
The list ranks risk categories, not specific attacks, and it does not tell you how likely each is in your system. It complements, rather than replaces, a system-specific threat model and adversary knowledge bases such as MITRE ATLAS.
Why it matters
Security reviewers, auditors and customers increasingly ask "how do you address the OWASP LLM Top 10?". Mapping each entry to a control and a measured test result turns that question from a slide into evidence.
Related terms
Sources
- OWASP Gen AI Security Project. OWASP Top 10 for LLM Applications 2025, 2024. genai.owasp.org
- OWASP Gen AI Security Project. LLMRisks Archive, 2025. genai.owasp.org