Short answer: The OWASP Top 10 for LLM Applications is a widely used list of the most important security risks in software built on large language models (LLMs), such as chatbots, AI assistants, and AI features inside products. The 2025 edition covers prompt injection, sensitive information disclosure, supply chain, data and model poisoning, improper output handling, excessive agency, system prompt leakage, vector and embedding weaknesses, misinformation, and unbounded consumption. Business leaders don’t need to know the technical details. They need to make sure each risk was considered in the design before an LLM application ships, and that someone owns the answers.
What is the OWASP Top 10 for LLM Applications?
OWASP (the Open Worldwide Application Security Project) is a nonprofit known for the original OWASP Top 10 for web applications. Its GenAI Security Project publishes the Top 10 for LLM Applications. The current list is the 2025 edition, released in November 2024, which added system prompt leakage and vector and embedding weaknesses and broadened the old denial-of-service entry into unbounded consumption.
The list is useful beyond engineering teams. It gives leadership, product, and security a shared vocabulary for asking whether an AI feature is ready for customers.
The 2025 list, in plain English
| # | Risk | What it means | Question for your team |
|---|---|---|---|
| LLM01 | Prompt Injection | Instructions hidden in user input, documents, emails, or web pages change what the model does | What untrusted content can reach the model, and what can it make the system do? |
| LLM02 | Sensitive Information Disclosure | The application reveals confidential data, personal information, or secrets in its responses | What data can the model see, and how do we stop it reaching the wrong user? |
| LLM03 | Supply Chain | Risks from third-party models, datasets, plugins, and libraries | Which model providers and components do we depend on, and how were they vetted? |
| LLM04 | Data and Model Poisoning | Manipulated training, fine-tuning, or reference data skews the model’s behavior | Where does our training and reference data come from, and who can change it? |
| LLM05 | Improper Output Handling | Model output is passed to other systems (web pages, databases, code) without validation | Do we treat model output as untrusted before it reaches other systems? |
| LLM06 | Excessive Agency | The model has more permissions, tools, or autonomy than it needs | What actions can the AI take on its own, and which require human approval? |
| LLM07 | System Prompt Leakage | Hidden instructions are exposed, sometimes along with secrets or business logic placed in them | Are any credentials or sensitive rules stored in prompts? |
| LLM08 | Vector and Embedding Weaknesses | Weaknesses in retrieval (RAG) systems let users access or inject content they shouldn’t | Does retrieval respect the same access permissions as the source documents? |
| LLM09 | Misinformation | The model produces confident but false or misleading output that people rely on | Where could a wrong answer cause harm, and how is output checked? |
| LLM10 | Unbounded Consumption | Uncontrolled usage drives runaway costs, outages, or model extraction | Do we have usage limits, cost alerts, and abuse monitoring? |
Which risks matter most for business leaders?
Every application is different, but three risks tend to drive the biggest business impact:
- Prompt injection (LLM01). There is no complete fix, because models can’t reliably separate instructions from data. Good designs assume injection will happen and limit what a manipulated model can do.
- Sensitive information disclosure (LLM02) and vector and embedding weaknesses (LLM08). If an assistant can search all company documents, it may reveal documents to people who were never allowed to see them. Retrieval must respect existing access controls.
- Excessive agency (LLM06). The more an AI can do without a human, such as send email, issue refunds, change records, or run code, the larger the impact of any mistake or manipulation.
What about AI agents? The OWASP Top 10 for Agentic Applications
AI agents plan and take actions across tools and systems, which creates risks the LLM list doesn’t fully cover. In December 2025, the OWASP GenAI Security Project published the OWASP Top 10 for Agentic Applications. Its themes include:
- Agent goal hijack: manipulated inputs redirect what the agent is trying to achieve
- Tool misuse: legitimate tools used in harmful or unintended ways
- Identity and privilege abuse: agents acting with excessive or borrowed permissions
- Memory and context poisoning: stored memory or retrieved content manipulated to influence later decisions
- Cascading failures and rogue agents: errors or compromised agents spreading across connected systems
If your team is building agents, review designs against both lists.
How should you use the list before launch?
Use the Top 10 as a design review checklist, ideally before development is finished, when changes are cheapest:
- Map the system. Users, data sources, model providers, tools, and every place output goes.
- Walk each risk. For each of the ten items, document whether it applies, the design control, and the owner.
- Limit authority. Least-privilege access for the model and its tools, with human approval for consequential actions.
- Plan oversight. Logging that lets you reconstruct what the system did and why, plus a way to stop it.
- Record residual risk. Add accepted risks to your risk register with an owner.
Pair the review with governance: an AI acceptable use policy for staff and a broader AI governance program. If you’re pursuing ISO/IEC 42001, design reviews provide useful evidence for its AI life-cycle controls.
Frequently Asked Questions
Is the OWASP Top 10 for LLM Applications a compliance requirement?
No. It’s free, community-developed guidance, not a regulation or certifiable standard. Customers and auditors increasingly reference it, and it maps well to frameworks such as ISO/IEC 42001 and the NIST AI Risk Management Framework.
Does the list apply if we only use a vendor’s AI tool?
Partly. Many risks are the vendor’s to manage, but you still control what data you connect, what permissions you grant, and how output is used. Ask vendors how they address the list, and review your own configuration.
What changed in the 2025 edition?
The 2025 edition added system prompt leakage and vector and embedding weaknesses, expanded denial of service into unbounded consumption, and reflected the growing use of retrieval-augmented generation and AI agents.
Who should own LLM application security?
The product or engineering owner of the application, with security review before launch and leadership accepting any significant residual risk. For smaller teams, a vCISO or security lead often coordinates the review.
How USCIBER can help
USCIBER’s AI Security & Governance service includes secure design reviews of LLM and agentic applications against the OWASP Top 10 for LLM Applications and for Agentic Applications, alongside AI policies, AI risk assessment, and NIST AI RMF and ISO/IEC 42001 readiness. AI work is scoped after a short call. Engagements are led by security leadership holding CISSP, CISA, and CISM credentials. Book a free consultation.
Sources
- OWASP GenAI Security Project — Top 10 for LLM Applications (2025)
- OWASP GenAI Security Project — OWASP Top 10 for Agentic Applications
- OWASP GenAI Security Project — 2025 Top 10 announcement
- NIST — AI Risk Management Framework (AI RMF 1.0)
This article is general information, not legal advice.