The OWASP LLM Top 10 is the security industry’s reference list of the most critical security vulnerabilities in large language model applications, and in 2026 the version every AI developer should know is the 2025 release. If you build or govern AI applications, mapping your deployment against these ten categories is the baseline for identifying and mitigating your AI cybersecurity risks.
This guide explains all ten risks in the current 2025 list, the unique reasons LLM security differs from traditional web security, and the practical defenses for each category. It also clears up a common point of confusion: the OWASP LLM Top 10 is distinct from the separate OWASP Top 10 for Agentic Applications, which has its own 2026 edition for autonomous agents.
Why OWASP Built a Separate List for LLMs
OWASP launched the GenAI Security Project in 2023 because organizations were deploying large language models faster than anyone had documented how they fail. The first list arrived that year, built by a global community of contributors, and it quickly became the common vocabulary security teams, developers, and buyers use to weigh the benefits and risks of AI in cybersecurity. Many teams now fold it into a formal AI governance operating model rather than treating it as a one-off checklist.
The reason a separate list was needed is that LLM applications expand the attack surface in ways the classic web Top 10 does not capture. Traditional web security targets a deterministic system: code with defined inputs, outputs, and execution paths, where a vulnerability has a discrete patch. An LLM is probabilistic. Its risks emerge from model behavior, training data, the tools it can call, and the agentic systems built around it. A SQL injection control does not stop a prompt injection, and a web application firewall cannot read semantic intent. Many LLM risks cannot be patched with a code change at all; they require output filtering, architectural separation, fine-tuning, or human oversight.
What Changed in the 2025 Update
The 2025 release is the second major version of the framework. It keeps the LLM01 through LLM10 numbering but reorders the risks to reflect production reality, renames several entries, and introduces new categories driven by the rise of retrieval-augmented generation (RAG) and agentic systems. If you are working from the 2023 list, here is what moved.
| 2023 entry | 2025 equivalent |
|---|---|
| LLM01 Prompt Injection | LLM01:2025 Prompt Injection (still number one) |
| LLM02 Insecure Output Handling | LLM05:2025 Improper Output Handling (renamed, moved) |
| LLM03 Training Data Poisoning | LLM04:2025 Data and Model Poisoning (renamed, broadened) |
| LLM04 Model Denial of Service | LLM10:2025 Unbounded Consumption (broadened to include cost) |
| LLM05 Supply Chain | LLM03:2025 Supply Chain (moved up) |
| LLM06 Sensitive Information Disclosure | LLM02:2025 Sensitive Information Disclosure (moved up to number two) |
| LLM07 Insecure Plugin Design | Folded into Excessive Agency and Improper Output Handling |
| LLM08 Excessive Agency | LLM06:2025 Excessive Agency (moved up) |
| LLM09 Overreliance | LLM09:2025 Misinformation (reframed) |
| LLM10 Model Theft | Folded into LLM10:2025 Unbounded Consumption |
| New in 2025 | LLM07:2025 System Prompt Leakage, LLM08:2025 Vector and Embedding Weaknesses |
LLM01 Prompt Injection
Prompt injection remains the number one risk and the most actively exploited weakness in production. It occurs when crafted input alters the model’s behavior, because an LLM cannot reliably distinguish trusted developer instructions from untrusted user input when both arrive as natural language. Direct injection manipulates the user prompt to override system instructions. Indirect injection is more dangerous: malicious instructions hide inside external content the model consumes, such as a document, web page, or email, and execute when the model processes them. Jailbreaking is a form of prompt injection where the attacker pushes the model to ignore its safety controls entirely.
Defenses: constrain model behavior in the system prompt, enforce least privilege for the model and its tools, require human approval for high-impact actions, clearly segregate and label untrusted external content, validate output formats, and run adversarial testing that treats the model as an untrusted user.
LLM02 Sensitive Information Disclosure
Promoted to the number two position in 2025, this risk covers the exposure of personal data, credentials, proprietary algorithms, or confidential business information through model output. Models can surface sensitive data that entered training or that a user supplied during a session. OWASP documents a well-known case in which prompting a model to repeat a word indefinitely caused it to regurgitate memorized personal information.
Defenses: sanitize data before it enters training, apply least-privilege access to data sources, offer clear opt-out and data-use policies, and use privacy techniques such as differential privacy, tokenization, and redaction. Restrictions placed only in the system prompt are not reliable and can be bypassed.
LLM03 Supply Chain
LLM supply chains extend beyond the traditional software supply chain problem to include third-party pre-trained models, fine-tuning adapters, and training datasets. Fine-tuning methods such as LoRA, open model repositories, and on-device models all add new ways for tampering or poisoning to enter. Risks include vulnerable or deprecated models, weak model provenance, malicious LoRA adapters, licensing exposure, and compromised model-conversion or model-merge services.
Defenses: vet suppliers and their terms and privacy policies, maintain a signed inventory using an AI or ML Bill of Materials, verify model integrity with signing and file hashes, apply AI red teaming when selecting a third-party model, and patch vulnerable components.
LLM04 Data and Model Poisoning
Renamed and broadened in 2025, this category covers manipulation of pre-training, fine-tuning, or embedding data to introduce backdoors, biases, or degraded performance. Poisoning is an integrity attack: a backdoor can leave behavior untouched until a trigger appears, effectively turning a model into a sleeper agent that is hard to detect in testing. Research from Anthropic, the UK AI Security Institute, and the Alan Turing Institute found that a small fixed number of malicious documents, on the order of 250, can implant a backdoor regardless of model size, which means absolute count matters more than the percentage of the dataset.
Defenses: track data origins with versioning and a Bill of Materials, vet data vendors, sandbox and validate untrusted data, use anomaly detection, monitor training behavior for signs of poisoning, and ground inference with retrieval and verification.
LLM05 Improper Output Handling
Formerly Insecure Output Handling, this risk is about insufficient validation of what the model produces before it reaches another system. Because model output can be steered by input, treating it as trusted gives users indirect access to downstream functionality. The consequences are the same classes of vulnerability the web has fought for decades: cross-site scripting, SQL injection, command injection, path traversal, and phishing payloads, now generated by the model.
Defenses: adopt a zero-trust stance toward model output, apply context-aware encoding, use parameterized queries for any database operation involving model output, enforce a strict Content Security Policy, and follow the OWASP Application Security Verification Standard.
Map your AI deployment against all ten risks
Elevate runs structured AI risk assessments and red-team style reviews that map your LLM and agentic systems to the OWASP Top 10 and to NIST and ISO 42001 controls, then turn the findings into a defensible governance program. Talk to Elevate about AI risk
LLM06 Excessive Agency
Moved up in 2025 as agentic architectures have spread, excessive agency is the risk that an LLM-based system performs damaging actions in response to ambiguous, hallucinated, or manipulated output. It also absorbs much of what the 2023 list called insecure plugin design. The root causes are excessive functionality (tools the system does not need), excessive permissions (broader downstream access than required), and excessive autonomy (high-impact actions taken without human verification).
Defenses: minimize the extensions and functions available to the agent, grant least-privilege permissions, execute actions in the individual user’s authenticated context, require human approval for high-impact actions, and enforce authorization in downstream systems rather than relying on the model to decide what is allowed.
LLM07 System Prompt Leakage
New in 2025, this entry addresses a widespread architectural mistake: treating the system prompt as a secret or a security control. Prompts often contain credentials, connection strings, role and permission structures, or filtering rules. OWASP is blunt that the system prompt should never be considered confidential, because attackers can usually infer its guardrails through normal interaction. The real risk is not the disclosure itself but the design that placed sensitive data or security decisions in the prompt to begin with.
Defenses: keep credentials and sensitive data out of the prompt entirely, enforce privilege separation and authorization in deterministic external systems, and use independent guardrails to check model behavior rather than relying on prompt instructions.
LLM08 Vector and Embedding Weaknesses
Also new in 2025, this category responds to the rise of RAG. Weaknesses in how vectors and embeddings are generated, stored, or retrieved can be exploited to inject content, leak data, or alter behavior. Risks include unauthorized access to embeddings, cross-context leakage in multi-tenant vector databases, embedding inversion attacks that reconstruct source text, data poisoning through hidden instructions in retrieved documents, and behavior alteration where retrieval quietly strips empathy or nuance from responses.
Defenses: implement permission-aware vector stores with strict tenant partitioning, validate and authenticate knowledge sources, review and classify combined datasets, detect hidden content in ingested documents, and keep immutable logs of retrieval activity.
LLM09 Misinformation
The 2025 reframing of the old overreliance entry, this risk covers false or misleading output that appears credible, driven largely by hallucination and amplified when users trust output without verification. The business consequences are real: OWASP cites Air Canada being held liable for its chatbot’s misinformation, and lawyers sanctioned after a model fabricated legal citations. A particularly dangerous pattern is hallucinated software package names, which attackers can register and weaponize.
Defenses: ground responses with retrieval from trusted sources, require cross-verification and human oversight for high-stakes output, validate generated code and suggested packages, clearly label AI-generated content and its limitations, and train users to evaluate output critically.
LLM10 Unbounded Consumption
This entry replaces the 2023 Model Denial of Service category and absorbs Model Theft. It covers excessive and uncontrolled inference, which can produce denial of service, runaway cloud cost (sometimes called denial of wallet), service degradation, and model theft through extraction. Because LLM cost scales with tokens rather than request count, a single runaway agent or malicious user can burn through a large budget quickly, and attackers can clone a model’s behavior by harvesting its outputs through the API.
Defenses: enforce strict input limits, rate limiting, and per-user quotas, manage resource allocation and timeouts dynamically, restrict exposure of logit and probability data, sandbox model access to internal resources, watermark outputs, and monitor for the query patterns that indicate extraction.
Beyond LLMs: The OWASP Agentic Top 10
As applications move from passive chatbots to autonomous agents that reason, remember, and call tools across multiple steps, OWASP created a separate framework: the Top 10 for Agentic Applications, often abbreviated ASI. Its 2026 edition addresses risks that extend beyond prompt-level attacks, including goal hijacking, tool misuse, agent identity and privilege abuse, memory and context poisoning, insecure communication between agents, cascading multi-agent failures, and rogue agent behavior. If your system is a traditional LLM application, the LLM Top 10 is the right framework. If it combines reasoning, memory, tools, and multi-step execution, the two lists work together and belong inside the same set of AI governance best practices.
Conclusion
The OWASP Top 10 for LLM Applications is most useful as a coverage framework, not a compliance checklist. The goal is not to confirm that each category has been considered in theory, but that each one has been tested against your specific deployment and that the findings drove real control decisions. The 2025 update reflects how quickly the landscape has moved, from standalone chatbots to RAG pipelines and tool-using agents, and auditors increasingly reference it when validating AI controls inside frameworks such as SOC 2, HIPAA, ISO 42001, and FedRAMP. Teams already managing CMMC or ISO 27001 will recognize the same control themes, and internal audit functions are beginning to test against the list directly. For defense contractors, an AI framework is now coming to CMMC, which makes this groundwork even more timely.
Start where the impact is highest. Treat prompt injection and sensitive information disclosure as baseline risks for any application, give special attention to output handling wherever model output is executed or rendered, and tighten excessive agency controls wherever an agent can write to internal systems. Build monitoring across all ten categories, and revisit the list as both the framework and your architecture evolve. Tooling such as AI Guardian can help teams move from awareness to audit-ready evidence.
Turn the OWASP Top 10 into an operating program
Elevate helps security and compliance leaders move from awareness to evidence, aligning LLM and agentic risk controls with ISO 42001, SOC 2, and FedRAMP so your AI systems hold up under audit. Build your AI governance program
Key Takeaways
The OWASP Top 10 for LLM Applications gives AI builders and governance teams a shared map of the most critical risks, and the 2025 list reflects the shift to RAG and agentic systems.
- Use the current 2025 version. It reorders the 2023 list, renames several entries, and adds System Prompt Leakage and Vector and Embedding Weaknesses.
- Prompt injection is still number one. Treat every input, including content the model retrieves, as untrusted, and never let the prompt itself act as a security boundary.
- Treat model output as untrusted data. Improper output handling reintroduces classic web vulnerabilities like injection and cross-site scripting through the model.
- Control agency before you scale agents. Minimize functionality, permissions, and autonomy, and enforce authorization outside the model.
- The Agentic Top 10 is a separate framework. The 2026 ASI list complements the LLM Top 10 for systems with memory, tools, and multi-step autonomy.
Map your deployment against all ten categories, test each one against your real configuration, and align the controls with the audit frameworks you already report against.
FAQs
Q1. What is the OWASP Top 10 for LLM Applications?
It is a community-maintained list of the ten most critical security and safety risks in large language model applications, published by OWASP as part of its GenAI Security Project. It serves as a shared vocabulary and a coverage framework for threat modeling, red teaming, and control design. The current version is the 2025 release.
Q2. What changed between the 2023 and 2025 lists?
The 2025 version keeps the LLM01 to LLM10 numbering but reorders the risks, renames several entries, and adds new ones. Sensitive Information Disclosure and Supply Chain moved up, Insecure Output Handling became Improper Output Handling, Training Data Poisoning became Data and Model Poisoning, Model Denial of Service became the broader Unbounded Consumption, Overreliance was reframed as Misinformation, and two new entries appeared: System Prompt Leakage and Vector and Embedding Weaknesses.
Q3. Is there a 2026 version of the OWASP LLM Top 10?
The current LLM Top 10 is the 2025 release. OWASP also publishes a separate framework, the Top 10 for Agentic Applications, which has a 2026 edition focused on autonomous agents. The two are complementary: the LLM list covers model-level risks, and the agentic list covers risks specific to systems that reason, remember, and use tools over multiple steps.
Q4. How is the LLM Top 10 different from the OWASP Top 10 for web applications?
The web Top 10 addresses a deterministic attack surface, where vulnerabilities live in code with defined inputs and outputs and can be patched. The LLM Top 10 addresses a probabilistic attack surface, where risks emerge from model behavior, training data, and the tools the model can invoke. Many LLM risks cannot be fixed with a code change and instead require output filtering, architectural separation, or human oversight.
Q5. Which OWASP LLM risks should be prioritized first?
Priority depends on your application. Prompt injection and sensitive information disclosure are high priority for almost any deployment. Improper output handling becomes critical when model output is executed or rendered, such as code assistants and tool-using agents. Excessive agency becomes critical when an agent can write to internal systems, and vector and embedding weaknesses rise in importance for multi-tenant RAG. A prior risk analysis, ideally using a framework like the NIST AI Risk Management Framework, should order the work.