Security & governance · AI Security
OWASP Top 10: the main risks in LLM applications
The OWASP Top 10 for 2025 shows that LLM application security extends beyond the model. Injection, sensitive data, supply chain, tools and cost must be controlled across the architecture.
Securing an LLM application involves much more than preventing a user from bypassing a system prompt. The model receives data, retrieves documents, may call tools and sends its outputs to other components. Every boundary can turn a plausible answer into a data leak, unauthorised action or operational incident.
The OWASP Top 10 for LLM Applications 2025 provides a useful taxonomy for these risks. It is neither a certification nor a sufficient checklist on its own. It is a starting point for threat modelling, control selection and testing of the complete application.
Key points
The most important controls cut across categories:
- treat prompts, retrieved documents and model outputs as untrusted data;
- isolate data by user and enforce least privilege;
- validate every output in code before action or interpretation;
- limit the tools, parameters, volume and budgets available to the model;
- govern models, datasets, embeddings and third-party components;
- log security decisions without exposing sensitive data;
- test attack paths regularly, including RAG and agent workflows.
OWASP risks cross the full application chain. Controls must cover boundaries between components.
The OWASP Top 10 for 2025
The 2025 edition, also known as version 2.0, reorganises the previous list. It notably adds system prompt leakage and vector and embedding weaknesses, while unbounded consumption broadens the former model denial-of-service category.
| Reference | Risk | Typical scenario | Priority control |
|---|---|---|---|
| LLM01 | Prompt injection | An instruction in a message or document redirects behaviour | Separate data from instructions, limit possible effects and test injections |
| LLM02 | Sensitive information disclosure | The system exposes personal data, secrets or internal context | Minimisation, access control, filtering and retention rules |
| LLM03 | Supply chain | A compromised model, dataset, adapter or component enters the system | Inventory, provenance, artifact and supplier verification |
| LLM04 | Data and model poisoning | Modified data introduces a backdoor, bias or dangerous behaviour | Source governance, validation, versioning and regression tests |
| LLM05 | Improper output handling | An unvalidated LLM output becomes an executed query, command or script | Contextual validation, encoding and interpreter separation |
| LLM06 | Excessive agency | The model has too many tools, permissions or autonomy | Least privilege, approval, action limits and reversibility |
| LLM07 | System prompt leakage | Internal instructions are exposed or treated as a secret | Keep secrets out of prompts and enforce controls outside the model |
| LLM08 | Vector and embedding weaknesses | A RAG system retrieves unauthorised or malicious content | Isolation, pre-retrieval authorisation, validation and source traceability |
| LLM09 | Misinformation | A false or ungrounded answer influences a decision | Grounding, uncertainty, verification and human oversight |
| LLM10 | Unbounded consumption | An input or loop causes excessive cost, compute or volume | Quotas, timeouts, depth limits, budgets and automatic termination |
LLM01: prompt injection
A prompt injection attempts to alter model behaviour using a crafted input. It can be direct, when a user writes the instruction, or indirect, when it is hidden in a document, web page, email or data retrieved by the system.
The fundamental problem is that the model processes instructions and data in the same semantic channel. A word filter or a prompt telling the model to ignore attacks is insufficient.
The strongest measures reduce possible impact: explicitly authorised tools, validated parameters, minimum permissions, data separation, human approval for sensitive actions and continuous adversarial testing.
LLM02: sensitive information disclosure
Data can leak through the prompt, RAG context, logs, conversation memory, output or model provider. The application must classify data before the model call and decide what is actually necessary.
Apply minimisation, resource-level access control, encryption, retention rules and secret prevention. Review provider contracts and the destination of technical traces.
Automated masking should not be assumed perfect. Indirect identifiers, attachments and structured data require context-specific tests.
LLM03 and LLM04: supply chain and poisoning
An LLM application often depends on a model, libraries, vector database, datasets, adapters, plugins, embedding models and APIs. A compromise or uncertain origin can change behaviour without a visible application code change.
Maintain an inventory of components and versions, verify artifact origin and integrity, review licences and assess suppliers. For training, fine-tuning and RAG data, document sources, modification rights and validation.
Regression tests should cover critical behaviours after every model, dataset or component change.
LLM05: improper output handling
A model output is untrusted data. If it is inserted directly into HTML, SQL, a command, an email template or an interpreter, it can trigger a conventional downstream vulnerability.
Validate the output for its destination. A JSON schema validates structure, not authorisation or business meaning. Use allowlists for actions, encode for the display context and maintain a clear boundary between generation and execution.
LLM06: excessive agency
An agent becomes dangerous when it combines too many capabilities, permissions and autonomy. The model may select the wrong tool, generate incorrect parameters or be manipulated through indirect input.
Give every tool a dedicated identity and minimum permissions. Limit resources, amounts, recipients and frequency. Require human approval for irreversible or sensitive actions and show a preview before execution. Design compensation or cancellation where possible.
The model must never decide by itself whether it is authorised to act. That decision belongs to a deterministic component governed by company policy.
LLM07: system prompt leakage
A system prompt can be exposed in whole or in part, so it should be treated as non-secret. API keys, passwords, confidential authorisation rules and sensitive information must never be stored there.
Real protection comes from identity, access, validation and execution controls outside the model. Instruction leakage remains a useful signal to monitor, but it should not be enough to compromise the system.
LLM08: vector and embedding weaknesses
RAG adds attack surface. Malicious documents can influence an answer, shared stores can leak data between users and incorrect metadata can bypass retrieval rules.
Apply authorisation before search and again before using a document. Isolate collections where risk requires it. Preserve the provenance of every excerpt, filter accepted content types and test indirect injections embedded in documents.
LLM09: misinformation
A grammatically correct answer can be false, outdated or fabricated. The risk becomes critical when the answer is presented as certain or used automatically in a decision.
Ground answers in authorised sources, expose references, measure faithfulness and provide abstention when information is missing. High-impact decisions require human review or a deterministic check.
Evaluation should distinguish correctness, completeness and source faithfulness. An answer that happens to be correct does not prove that the system used the right evidence.
LLM10: unbounded consumption
Long inputs, repeated outputs, tool calls, retrieval loops and parallel attempts can cause denial of service or disproportionate bills. Agents amplify this risk when they create their own next steps.
Set limits for size, time, rate, recursion, calls and budget. Detect loops, expire tasks and provide a termination mechanism. Monitor cost per user and process, not only the monthly total.
A five-layer control architecture
| Layer | Essential controls |
|---|---|
| Input | Authentication, validation, data classification and size limits |
| Context and RAG | Document-level authorisation, isolation, provenance and content filtering |
| Model | Versioned configuration, refusal policies and robustness tests |
| Tools and output | Schemas, business validation, least privilege and pre-action approval |
| Operations | Logs, metrics, quotas, alerts, incident response and regression testing |
Every layer should fail safely. If retrieval cannot verify an authorisation, it must not return the document. If a tool cannot validate a parameter, it must not execute the action.
How to use the list in a project
- Map the complete flow of data and actions.
- Connect each OWASP risk to the relevant components.
- Describe a concrete abuse scenario and its business impact.
- Select preventive, detective and corrective controls.
- Turn the scenarios into reproducible tests.
- Name an owner and define the evidence required.
- Rerun tests after every material change.
Do not try to tick all ten rows uniformly. Prioritise based on data, system capabilities and failure consequences. A chatbot with no tools and an agent authorised to change an ERP have different threat profiles.
Security is a system property
The main lesson from the OWASP Top 10 is architectural. An LLM cannot enforce confidentiality, authorisation, output validation and action control on its own. Deterministic components, permissions and human processes must impose those properties.
A secure LLM application limits what the model can see, decide and trigger. It then observes what actually happens and reassesses controls when the model, data or tools change.
Official sources
- OWASP Top 10 for LLM Applications 2025, official publication and complete guide.
- OWASP LLM01:2025 Prompt Injection, official pages linking to all ten categories and suggested mitigations.
- NIST AI 600-1: Generative AI Profile, cross-sector framework for governing, mapping, measuring and managing generative AI risk.
Sources verified on 6 August 2026.
