What the List Is
Lesson 1 of 3 in The OWASP Top 10 for LLM Applications.
OWASP — the Open Worldwide Application Security Project — is the community institution behind the most-cited artifact in application security: the Top 10. The original web-application Top 10 gave a fractious industry something it badly needed — a short, shared list of the risks that actually mattered, written by practitioners, free to use, and stable enough to hang code reviews, training programs, and vendor questionnaires on. When someone says “that’s an injection bug,” the web Top 10 is why everyone in the room knows roughly what they mean.
When LLM applications arrived, they broke that shared vocabulary. Prompt injection is not SQL injection; Hallucination is not a software defect in any classical sense; and a model that ships with memorized training data inside it has no analogue in the web Top 10 at all. So OWASP’s GenAI Security Project built a new list: the OWASP Top 10 for LLM Applications. The 2025 version is the current one, and it is the reference this module teaches — entry ids LLM01 through LLM10, each naming a risk category observed in real LLM-integrated systems.
Before the entries, be clear about the genre. A Top 10 is an awareness and prioritization device. It is for three things: giving your team and your reviewers a common language; turning “did we think about security?” into a walkable checklist; and concentrating scarce review time on the categories practitioners keep seeing. It is not a completeness claim, not a severity ranking for your particular app, and not a certification — “we addressed all ten” is where a review starts, not where it ends. If you are being handed the list as a regulatory checkbox, that is compliance theater; the law-and-obligations view of AI risk is our sister AI Governance Academy’s beat, one link away.
| Entry | Name | In plain terms |
|---|---|---|
LLM01 | Prompt Injection | Attacker-controlled text — typed directly or hidden in content the model reads — overrides the instructions the developer intended. |
LLM02 | Sensitive Information Disclosure | The model reveals data it should not: PII, credentials, proprietary text memorized from training, or another user’s context. |
LLM03 | Supply Chain | Compromised or unvetted components upstream of your app — model weights, datasets, adapters, and the packages that serve them. |
LLM04 | Data and Model Poisoning | Manipulated training or fine-tuning data plants behaviors, biases, or backdoors inside the model itself. |
LLM05 | Improper Output Handling | Downstream code trusts model output blindly — rendering, executing, or querying with it as if it were safe. |
LLM06 | Excessive Agency | The model is granted more capability, permissions, or autonomy than the task needs, so a bad output becomes a bad action. |
LLM07 | System Prompt Leakage | The hidden instructions — and any secrets foolishly embedded in them — can be extracted through the model’s own outputs. |
LLM08 | Vector and Embedding Weaknesses | The retrieval layer of RAG systems — embeddings and vector indexes — leaks data, accepts poisoned content, or bypasses access controls. |
LLM09 | Misinformation | The model produces false but plausible content that users or downstream systems act on. |
LLM10 | Unbounded Consumption | Requests that consume without limit: runaway token bills, denial of service, or model extraction through mass querying. |
Read the ten as a set and a pattern emerges: only a few of these are about the model’s weights. Poisoning (LLM04) and the memorization half of disclosure (LLM02) are baked in during training. Injection (LLM01), leakage of the System prompt (LLM07), and misinformation (LLM09) are properties of how models process one undifferentiated token stream and predict plausible continuations — mechanisms this domain has already taken apart. Everything else — output handling, agency, retrieval weaknesses, consumption — lives in the application around the model. That is the list’s most useful correction to instinct: teams anxious about the model’s behavior routinely under-invest in the ordinary software engineering the model is embedded in.
Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.