OWASP Top 10 for LLM Applications, explained
The ten most critical security risks in applications built on large language models, according to the OWASP GenAI Security Project, with the main control for each one.
Prompt Injection
Inputs, direct or embedded in content the model reads, that change the model's behavior in unintended ways.
Control: Separate trusted instructions from untrusted content, apply least privilege and test adversarially.
Sensitive Information Disclosure
The model reveals personal data, credentials or confidential information.
Control: Minimize data exposed to the model, filter outputs and enforce access control.
Supply Chain
Risks introduced by third-party models, datasets, plugins and components.
Control: Maintain an inventory, verify provenance and use signed artifacts.
Data and Model Poisoning
Manipulated training, fine-tuning or retrieval data that alters model behavior.
Control: Validate data sources, track provenance and monitor behavior.
Improper Output Handling
Model output passed to other systems without validation.
Control: Treat model output as untrusted and validate or encode it before use.
Excessive Agency
The model has more permissions, tools or autonomy than its task requires.
Control: Limit tools and permissions and require human approval for high-impact actions.
System Prompt Leakage
Exposure of system prompts that contain sensitive logic or secrets.
Control: Keep secrets out of prompts and enforce controls outside the model.
Vector and Embedding Weaknesses
Weaknesses in retrieval-augmented generation, such as missing access control in vector stores.
Control: Apply permission-aware retrieval and protect embedding stores.
Misinformation
False or misleading output that users or systems rely on.
Control: Ground responses in verified sources and keep human review where it matters.
Unbounded Consumption
Uncontrolled resource use leading to cost, denial of service or model extraction.
Control: Apply rate limits, quotas and monitoring.
Source: OWASP Top 10 for LLM Applications 2025. Descriptions summarized by I-314.
Frequently asked questions
What is the OWASP Top 10 for LLM Applications?
A list maintained by the OWASP GenAI Security Project of the ten most critical security risks in applications built on large language models. The current edition is 2025.
Is there a version for AI agents?
Yes. OWASP also publishes a Top 10 for Agentic Applications, which covers risks specific to autonomous agents and multi-agent systems.
How do we test our application against it?
Through an AI penetration test or red team exercise that maps each finding to the corresponding OWASP category. AI-Egis covers 100% of the OWASP LLM and Agentic Top 10.
Test your LLM application against the OWASP Top 10
I-314 can assess your AI systems and map every finding to OWASP and MITRE ATLAS.