The OWASP Top 10 for LLM apps, one risk at a time.
The OWASP Top 10 for LLM Applications is the most widely used checklist for AI security. The 2025 edition reflects what went wrong as chatbots became agents. Here is each risk in plain words, with what it looks like in a real product and how to test for it.
- OWASP, the non-profit behind the classic web Top 10, publishes a separate Top 10 for applications built on large language models.
- The 2025 edition added system prompt leakage, vector and embedding weaknesses, and misinformation, and widened denial of service into unbounded consumption.
- Prompt injection is still number one, and excessive agency matters more every year as AI gets tools.
- Most of the ten are about your system, not the model: data access, tools, outputs and costs.
- A complete AI security test should cover all ten, and agent tests should add OWASP’s Top 10 for Agentic Applications.
What the list is
The Open Worldwide Application Security Project (OWASP) is a non-profit community best known for the OWASP Top 10 web risks that most developers learn early on. Its GenAI Security Project maintains a separate Top 10 for LLM Applications, drawn from the experience of hundreds of contributors. The current edition was published in November 2024 as the 2025 list.
It is not a law or a certificate. It is a shared vocabulary: when a tester writes “LLM06 Excessive agency”, every security team knows what that means. That is why buyers increasingly ask that AI security tests cover all ten.
What changed in 2025
The first list, in 2023, was written when most AI products were chatbots. The 2025 edition reflects AI that reads company documents and takes actions:
- New: system prompt leakage (LLM07), vector and embedding weaknesses (LLM08) for RAG systems, and misinformation (LLM09).
- Widened: denial of service became unbounded consumption (LLM10), covering runaway costs and model copying as well as outages.
- Moved up: sensitive information disclosure rose to second place, and excessive agency grew in importance as agents spread.
The ten risks, in plain words
LLM01 Prompt injection
Text the AI reads overrides its instructions, either typed by an attacker or hidden in a document, web page or email. Looks like: a support bot that reveals discount codes after a clever message; an email assistant that forwards mail after reading a booby-trapped message. Test: direct and hidden attacks in every input the AI reads. Our prompt injection guide goes deeper.
LLM02 Sensitive information disclosure
The AI reveals personal data, secrets or confidential business information. Looks like: a chatbot answering questions about another customer’s order; an internal copilot quoting salaries. Test: try to reach data across user boundaries, and check what ends up in logs and training data. Under India’s DPDP Act this is also a personal data breach.
LLM03 Supply chain
Weaknesses in the models, datasets, plug-ins and libraries your AI depends on. Looks like: a downloaded model with a hidden backdoor; a malicious package that copies data. Test: inventory every component (an AI bill of materials), check where each came from, and pin versions.
LLM04 Data and model poisoning
Planted data changes how the model or its knowledge base behaves. Looks like: a fake help article in the knowledge base that tells customers to call a scam number. Test: check who can add content to training data and document indexes, and plant test documents to see what the AI does with them.
LLM05 Improper output handling
The AI’s replies are passed to other systems without checks. Looks like: AI-written text displayed on a web page that runs a script (XSS), or AI-generated queries run straight against a database. Test: treat every AI output as untrusted user input and probe the systems that receive it.
LLM06 Excessive agency
The AI has more tools, permissions or autonomy than its task needs. Looks like: a summariser that can also send email; an agent with an admin token. Test: list every tool and permission, and try to make the AI use each one in harmful ways.
LLM07 System prompt leakage
The hidden instructions, business rules, or worse, API keys placed in the prompt, are exposed. Looks like: a user getting the bot to print its instructions, including internal pricing logic. Test: extraction attempts in many forms; and a design rule: never put secrets in prompts.
LLM08 Vector and embedding weaknesses
Flaws in document search (RAG): missing access checks, poisoned entries, or data leaking between users through a shared index. Looks like: an employee asking the HR bot a question and getting a snippet from the board minutes. Test: ask questions across permission levels and tenants. See our RAG data leak testing.
LLM09 Misinformation
Confident but false answers that people act on. Looks like: a bot inventing a refund policy, a drug interaction or a legal deadline. Test: question the AI on the facts that matter most to your business and check its answers are grounded in your real sources.
LLM10 Unbounded consumption
Abuse that runs up costs, slows the service for others or copies the model through mass querying. Looks like: a script that sends huge prompts all night and leaves a large AI bill. Test: check rate limits, input size limits, spending caps and alerts.
When the AI is an agent
When an AI can plan and take actions on its own, OWASP’s separate Top 10 for Agentic Applications applies as well. Its ten risks are:
- ASI01 Agent goal hijack: Hidden instructions change what the agent is trying to achieve.
- ASI02 Tool misuse and exploitation: The agent uses its legitimate tools in harmful ways.
- ASI03 Identity and privilege abuse: The agent acts with more access than the person it serves.
- ASI04 Agentic supply chain: Malicious or silently changed tools, MCP servers, plug-ins or prompts.
- ASI05 Unexpected code execution: The agent writes or runs code that an attacker controls.
- ASI06 Memory and context poisoning: Planted content in memory or context steers later actions.
- ASI07 Insecure inter-agent communication: Agents trust messages from other agents without checks.
- ASI08 Cascading failures: One bad step spreads across agents and connected systems.
- ASI09 Human-agent trust exploitation: The agent talks a person into approving something harmful.
- ASI10 Rogue agents: Agents that drift outside their intended behaviour.
Many of these play out through MCP servers, the standard way agents connect to tools. Our MCP security guide covers the attacks seen so far.
How to use the list
- As a test scope. Ask your tester to show results for all ten, plus the agentic list if your AI acts. “Not applicable” is a fine answer, if it comes with a reason.
- As a design review. Walk through the ten before you build: where could each one happen in this design?
- As compliance evidence. Mapping test results to the list helps with ISO/IEC 42001, the EU AI Act and customer security questionnaires.
Every LLM red teaming engagement we run covers all ten, and reports findings against them.