What the List Is

Lesson 1 of 3 in The OWASP Top 10 for LLM Applications.

OWASP — the Open Worldwide Application Security Project — is the community institution behind the most-cited artifact in application security: the Top 10. The original web-application Top 10 gave a fractious industry something it badly needed — a short, shared list of the risks that actually mattered, written by practitioners, free to use, and stable enough to hang code reviews, training programs, and vendor questionnaires on. When someone says “that’s an injection bug,” the web Top 10 is why everyone in the room knows roughly what they mean.

When LLM applications arrived, they broke that shared vocabulary. Prompt injection is not SQL injection; Hallucination is not a software defect in any classical sense; and a model that ships with memorized training data inside it has no analogue in the web Top 10 at all. So OWASP’s GenAI Security Project built a new list: the OWASP Top 10 for LLM Applications. The 2025 version is the current one, and it is the reference this module teaches — entry ids LLM01 through LLM10, each naming a risk category observed in real LLM-integrated systems.

Before the entries, be clear about the genre. A Top 10 is an awareness and prioritization device. It is for three things: giving your team and your reviewers a common language; turning “did we think about security?” into a walkable checklist; and concentrating scarce review time on the categories practitioners keep seeing. It is not a completeness claim, not a severity ranking for your particular app, and not a certification — “we addressed all ten” is where a review starts, not where it ends. If you are being handed the list as a regulatory checkbox, that is compliance theater; the law-and-obligations view of AI risk is our sister AI Governance Academy’s beat, one link away.

The OWASP Top 10 for LLM Applications, 2025 version. Entry ids and names are verbatim from the published list; the one-sentence glosses are ours.
EntryNameIn plain terms

LLM01

Prompt Injection

Attacker-controlled text — typed directly or hidden in content the model reads — overrides the instructions the developer intended.

LLM02

Sensitive Information Disclosure

The model reveals data it should not: PII, credentials, proprietary text memorized from training, or another user’s context.

LLM03

Supply Chain

Compromised or unvetted components upstream of your app — model weights, datasets, adapters, and the packages that serve them.

LLM04

Data and Model Poisoning

Manipulated training or fine-tuning data plants behaviors, biases, or backdoors inside the model itself.

LLM05

Improper Output Handling

Downstream code trusts model output blindly — rendering, executing, or querying with it as if it were safe.

LLM06

Excessive Agency

The model is granted more capability, permissions, or autonomy than the task needs, so a bad output becomes a bad action.

LLM07

System Prompt Leakage

The hidden instructions — and any secrets foolishly embedded in them — can be extracted through the model’s own outputs.

LLM08

Vector and Embedding Weaknesses

The retrieval layer of RAG systems — embeddings and vector indexes — leaks data, accepts poisoned content, or bypasses access controls.

LLM09

Misinformation

The model produces false but plausible content that users or downstream systems act on.

LLM10

Unbounded Consumption

Requests that consume without limit: runaway token bills, denial of service, or model extraction through mass querying.

Read the ten as a set and a pattern emerges: only a few of these are about the model’s weights. Poisoning (LLM04) and the memorization half of disclosure (LLM02) are baked in during training. Injection (LLM01), leakage of the System prompt (LLM07), and misinformation (LLM09) are properties of how models process one undifferentiated token stream and predict plausible continuations — mechanisms this domain has already taken apart. Everything else — output handling, agency, retrieval weaknesses, consumption — lives in the application around the model. That is the list’s most useful correction to instinct: teams anxious about the model’s behavior routinely under-invest in the ordinary software engineering the model is embedded in.

Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.