What is the OWASP Top 10 for LLM applications?
By Nick Jang, founder of MINERVA Studio ·
The short answer
The OWASP Top 10 for LLM Applications is a list, kept by the OWASP GenAI Security Project, of the ten most important security risks in software built on large language models. The current edition is 2025: prompt injection, sensitive information disclosure, supply chain, data and model poisoning, improper output handling, excessive agency, system prompt leakage, vector and embedding weaknesses, misinformation, and unbounded consumption. It’s free, widely used as a checklist, and is about the application around the model, not only the model.
The ten, with an example each
| ID | Risk | In plain English, with an example |
|---|---|---|
| LLM01 | Prompt injection | Text that changes what the model does. A customer pastes "ignore your instructions and…", or a web page the assistant reads hides instructions in white text. |
| LLM02 | Sensitive information disclosure | The model reveals what it shouldn’t: another customer’s details from its context, internal documents, or secrets in its training data. |
| LLM03 | Supply chain | A weak link in what you built on: a tampered open-source model, a compromised library, a plugin from an unknown publisher. |
| LLM04 | Data and model poisoning | Someone corrupts training, fine-tuning or retrieval data so the model learns something wrong or carries a hidden trigger. |
| LLM05 | Improper output handling | The app trusts what the model writes. Model output passed straight into a database query, a web page or a shell command. |
| LLM06 | Excessive agency | The model can do more than it needs to: an email assistant that can also delete mail, or an agent with a payments permission it never uses. |
| LLM07 | System prompt leakage | The hidden instructions get exposed, and with them any secrets or rules someone wrongly put there. |
| LLM08 | Vector and embedding weaknesses | Problems in retrieval systems: documents one user shouldn’t see coming back in another’s answer, or planted documents steering answers. |
| LLM09 | Misinformation | Confident, wrong output that people act on, such as an invented policy or a made-up legal case. |
| LLM10 | Unbounded consumption | No limits on use: runaway costs, a service knocked over by huge requests, or a model copied by mass querying. |
What changed from the first list
The first list came out in 2023. The 2025 edition reflects how LLMs are now built, with retrieval, plugins and agents. System prompt leakage and vector and embedding weaknesses are new; misinformation takes in the old "overreliance"; unbounded consumption takes in denial of service and model theft; and excessive agency grew in importance as models were given tools.
LLM apps versus AI agents
OWASP keeps a separate Top 10 for Agentic Applications, published in December 2025, for systems that plan and act across several steps with tools. The two overlap. Excessive agency in the LLM list becomes a whole family of risks in the agentic list: goal hijacking, tool misuse, identity and privilege abuse. If your system takes actions, read both.
How to use it
- As a design checklist. For each of the ten, write down the control: input filtering and separation for injection, least privilege for agency, output encoding before anything downstream, per-user access checks in retrieval, rate and cost limits.
- As a test plan. Each risk is a set of attacks to try. That’s the heart of AI red teaming.
- In vendor due diligence. Ask an AI vendor how they handle each of the ten, and for evidence, not a yes.
- In your risk register. Turn the ones that apply into rows with owners in your AI risk register.
For a bank, the list sits between OSFI’s B-13 on technology and cyber risk and E-23 on models. Security findings from it belong on the model’s record, with an owner and a date. MINERVA keeps findings on each model and won’t let a model be approved while a high-severity finding is still open. See AI governance software.
Related questions
What is the number one risk in the OWASP Top 10 for LLMs?
LLM01:2025, prompt injection: input that changes the model’s behaviour in ways its builders didn’t intend, whether typed by a user or hidden in content the model reads.
What is the latest version of the OWASP Top 10 for LLM applications?
The 2025 edition, published by the OWASP GenAI Security Project. It replaced the 2023 list and its 2024 update.
What is excessive agency in an LLM?
Giving an LLM-based system more functions, permissions or autonomy than it needs, so a manipulated or mistaken model can do real damage. The fix is least privilege and human approval for consequential actions.
Is the OWASP Top 10 for LLMs a standard?
No. It is a free, community-maintained awareness list. Organizations use it as a checklist and a common vocabulary, alongside frameworks such as the NIST AI RMF.
What is the difference between the OWASP LLM top 10 and the agentic top 10?
The LLM list covers applications built on large language models. The agentic list, published in December 2025, covers AI agents that plan and act with tools, where risks such as goal hijacking and tool misuse dominate.
Sources
- OWASP GenAI Security Project — Top 10 for LLM Applications (2025)
- OWASP GenAI Security Project — Top 10 for Agentic Applications (2026)
- NIST — AI Risk Management Framework: Generative AI Profile (NIST AI 600-1)
New answers are posted on MINERVA on LinkedIn. Follow along, or send the question you’d like answered next to minerva@minerva.studio.
A plain-language explanation, not legal advice. The regulator’s own text is the source; read it, and take advice on how it applies to your institution.