The 2025 list at a glance#
Version 2025 of the list was published by the OWASP GenAI Security Project in November 2024 [1]. Two entries are new compared with the 2023 edition: System Prompt Leakage and Vector and Embedding Weaknesses. "Excessive Agency" was expanded to reflect agentic architectures, and "Unbounded Consumption" now covers cost-exhaustion as well as denial of service.
| ID | Risk | Agent-era example | How we test | Primary control |
|---|---|---|---|---|
| LLM01 | Prompt Injection | Instructions in an email make an inbox agent forward data. | Indirect-injection corpus per channel; action assertions. | Provenance rules, tool-call policy, least privilege. |
| LLM02 | Sensitive Information Disclosure | RAG returns another tenant's document; output leaks PII. | Cross-tenant retrieval probes; PII egress graders. | Tenant-scoped retrieval, output DLP, redaction. |
| LLM03 | Supply Chain | A compromised model, dataset, plugin or MCP server. | Inventory and provenance checks; behavioural diffing of new model versions. | Pinned, signed artefacts; allow-listed tools; SBOM for AI components. |
| LLM04 | Data and Model Poisoning | Poisoned fine-tuning data plants a backdoor trigger. | Trigger scans; eval suites on held-out data after each fine-tune. | Data provenance, filtering, post-training regression suites. |
| LLM05 | Improper Output Handling | Model output rendered as HTML/markdown executes or exfiltrates; output passed to a shell. | Payloads that produce script, links, SQL; check downstream sinks. | Treat output as untrusted: encode, sandbox, never auto-render URLs. |
| LLM06 | Excessive Agency | Support agent can issue unlimited refunds. | Tool-misuse scenarios against limits and scopes. | Narrow tools, argument limits, human approval for high impact. |
| LLM07 | System Prompt Leakage | Prompt reveals internal tool names, rules or secrets. | Extraction attacks, including encoded and multi-turn. | No secrets in prompts; assume the prompt is public. |
| LLM08 | Vector and Embedding Weaknesses | Embedding inversion; poisoned documents engineered to be retrieved. | Retrieval-poisoning tests; access-control checks on vector stores. | Per-tenant indexes, ingestion filtering, ACL-aware retrieval. |
| LLM09 | Misinformation | Confident, fabricated citations in a legal or medical answer. | Groundedness and citation-faithfulness graders with expert gold sets. | Retrieval grounding checks, abstention, human review in high stakes. |
| LLM10 | Unbounded Consumption | Token floods, recursive agent loops, cost-exhaustion attacks. | Load and loop-induction tests; per-user cost tracking. | Rate limits, step budgets, max tokens, spend alerts. |
Which ones matter most for agents#
For systems that call tools, three entries account for most of the material risk we find in engagements, and they chain together: LLM01 (an injected instruction) exploits LLM06 (a tool with too much authority) to cause LLM02 (data leaves the boundary). Breaking any link in the chain prevents the incident, and LLM06 is the cheapest link to break, because it is a design decision rather than a detection problem.
LLM05 is the most underrated. Teams treat model output as trusted data and pipe it into renderers, shells, SQL or downstream agents. Every place that consumes model output is an injection sink in the traditional application-security sense, and should be reviewed like one.
Mapping to other frameworks#
The OWASP list is a developer-facing risk catalogue. For adversary techniques, MITRE ATLAS [2] provides an ATT&CK-style matrix that red teams use for coverage. For governance, the NIST AI RMF and its generative AI profile describe the risk-management process, which we map in NIST AI RMF Measure. A practical programme uses all three: OWASP for engineering backlog, ATLAS for red-team coverage, NIST or the EU AI Act for evidence and governance.
Using the list well#
- Don't treat it as a checklist to tick. It is a starting taxonomy. Your threat model, built from your tools, data and users, decides priority and severity.
- Write tests, not policies. For each relevant entry, maintain an adversarial corpus and an assertion that runs in CI. A risk you can't test is a risk you can't show you've reduced.
- Tag findings. Tagging red-team findings with OWASP IDs makes trends visible to security leadership and makes coverage gaps obvious.
Frequently asked questions#
What is the OWASP Top 10 for LLM Applications 2025?
It is a list of the ten most critical security risks for applications built on large language models, published by the OWASP GenAI Security Project in November 2024: Prompt Injection, Sensitive Information Disclosure, Supply Chain, Data and Model Poisoning, Improper Output Handling, Excessive Agency, System Prompt Leakage, Vector and Embedding Weaknesses, Misinformation, and Unbounded Consumption.
What changed in the 2025 OWASP LLM Top 10?
System Prompt Leakage (LLM07) and Vector and Embedding Weaknesses (LLM08) were added, Excessive Agency was expanded for agentic systems, and Unbounded Consumption broadened the earlier denial-of-service entry to include cost exhaustion.
Sources#
- OWASP GenAI Security Project. OWASP Top 10 for LLM Applications 2025, released November 2024. genai.owasp.org
- MITRE ATLAS: Adversarial Threat Landscape for Artificial-Intelligence Systems. atlas.mitre.org