OWASP Top 10 for LLM Applications: The 2025 List Explained

The OWASP Top 10 for LLM Applications 2025 lists ten risks: LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM03 Supply Chain, LLM04 Data and Model Poisoning, LLM05 Improper Output Handling, LLM06 Excessive Agency, LLM07 System Prompt Leakage, LLM08 Vector and Embedding Weaknesses, LLM09 Misinformation and LLM10 Unbounded Consumption. A reordered 2026 edition followed in August 2026.

The 2025 edition, dated November 17, 2024 on OWASP’s resource page, reshuffled the first 2023 release meaningfully. Two new categories arrived, several entries were renamed or merged, and the ordering shifted to reflect what teams actually saw in production over the prior year. Threat models and audit findings written between late 2024 and mid-2026 usually carry its 2025 IDs, so the walkthrough below uses them and maps each entry back to 2023 and forward to 2026.

The list is maintained by the OWASP Gen AI Security Project, a community effort distinct from the long-running OWASP Top 10 for web applications. It targets the LLM-specific attack surface: the model, its prompts, its training and retrieval data, and the agentic plumbing wired around it. The text is published under Creative Commons Attribution-ShareAlike 4.0, per the project’s GitHub repository.

The OWASP LLM Top 10 list across 2023, 2025 and 2026

Rows follow the 2025 order.

Sources: OWASP’s archived 2023-24 list, the GenAI-LLM-Top10 repository for 2026, and Pillar Security’s analysis for the two dropped 2023 entries.

Bare numbers are ambiguous. LLM03 meant Training Data Poisoning in 2023, Supply Chain in 2025 and Excessive Agency in 2026, so write the year suffix every time.

The 2025 list, item by item

LLM01:2025 Prompt Injection. Untrusted input that overrides the model’s instructions, either directly through user text or indirectly through content the model retrieves (a web page, a document, an email). It has held the top spot in every edition, 2026 included. Direct and indirect injection are the dominant initial-access technique against LLM apps, and the offensive mechanics are covered in depth on aisec.blog. Mitigations are imperfect: input and output filtering, privilege separation between the model and downstream tools, and treating all model output as untrusted.

LLM02:2025 Sensitive Information Disclosure. The model leaks PII, secrets, proprietary data, or other content it should not surface. This jumped from sixth in 2023 to second, reflecting how often training data, system context, and retrieved documents bleed into responses. Controls include data minimization in training and retrieval corpora, output scrubbing, and strict access control on what the model can read.

LLM03:2025 Supply Chain. Compromise of third-party models, datasets, plugins, or libraries. Pulling a poisoned model off a public hub, or depending on a tampered fine-tuning dataset, falls here. Model provenance, signature verification, and software bills of materials for the ML stack are the relevant defenses.

LLM04:2025 Data and Model Poisoning. Manipulation of training, fine-tuning, or embedding data to introduce backdoors, biases, or degraded behavior. Poisoning can be triggered at pre-training, fine-tuning, or through the retrieval corpus. Provenance tracking, anomaly detection on training data, and robust evaluation against held-out sets reduce exposure.

LLM05:2025 Improper Output Handling. Insufficient validation of model output before it flows into downstream systems. If a model’s response is passed unsanitized into a shell, a SQL query, a browser, or a templating engine, you inherit classic injection vulnerabilities (XSS, SSRF, command injection) with the LLM as the conduit. Treat output as you would any untrusted user input: encode, parameterize, and validate.

LLM06:2025 Excessive Agency. An LLM granted too much functionality, permission, or autonomy (the three root causes OWASP’s entry names), so that a manipulated model can take damaging actions. As agentic systems with tool-calling proliferate, this risk grows. The fix is least privilege: scope each tool tightly, require human approval for high-impact actions, and avoid open-ended capabilities.

LLM07:2025 System Prompt Leakage. A new entry for 2025. It addresses the assumption that system prompts are secret and the harm when they leak — exposed instructions, embedded credentials, or filtering logic that an attacker can then evade. The lesson is to never place secrets or sole authorization controls in the system prompt. The 2026 edition broadened it into Hidden Context Exposure.

LLM08:2025 Vector and Embedding Weaknesses. Another reflection of the RAG era. Risks in how embeddings are generated, stored, and retrieved: data leakage across tenants in a shared vector store, embedding inversion, and poisoned retrieval results. Access control on the vector database and validation of retrieved context are the core controls. Monitoring drift and integrity of retrieval pipelines is an MLOps concern covered at sentryml.com.

LLM09:2025 Misinformation. Misinformation absorbed the former “Overreliance” category. It covers false or misleading output, compounded by users trusting it without verification — confident hallucination that causes real harm in legal, medical, and financial contexts. Retrieval grounding, citation requirements, factual-accuracy evaluation, and human review for high-stakes outputs are the recommended mitigations.

LLM10:2025 Unbounded Consumption. Unbounded Consumption broadened the old “Model Denial of Service” entry. It now spans denial-of-service through expensive prompts, denial-of-wallet via runaway API costs, and model extraction through high-volume querying. Extraction relies on the same query access as the evasion attacks in adversarial examples in machine learning explained. Rate limiting, per-user quotas, input size caps, and cost monitoring keep it in check.

What changed from 2023

Three shifts matter most. First, the list moved decisively toward agentic and retrieval architectures: System Prompt Leakage and Vector and Embedding Weaknesses are both new, and Excessive Agency climbed in prominence. Second, several 2023 entries were renamed or merged to remove overlap — “Overreliance” folded into Misinformation, and “Model Denial of Service” expanded into Unbounded Consumption. Two entries lost standalone status: Insecure Plugin Design moved under Excessive Agency, and Model Theft under Unbounded Consumption. Third, Sensitive Information Disclosure rose sharply, acknowledging how frequently data leakage shows up once an LLM is wired into real systems.

The reordering is not arbitrary. The project bases it on community feedback and observed incidents, so the rank is a rough proxy for how often and how severely each category bites teams in production.

Is there an OWASP LLM Top 10 2026?

Yes. OWASP published the 2026 Top 10 for LLM Applications in early August 2026: its resource page is dated August 3 and the GitHub repository gives August 4. Prompt Injection and Sensitive Information Disclosure keep the top two places, Excessive Agency climbs to third, and System Prompt Leakage becomes Hidden Context Exposure.

The full 2026 order:

1. LLM01:2026 Prompt Injection
2. LLM02:2026 Sensitive Information Disclosure
3. LLM03:2026 Excessive Agency
4. LLM04:2026 Supply Chain
5. LLM05:2026 Data and Model Poisoning
6. LLM06:2026 Unbounded Consumption
7. LLM07:2026 Misinformation
8. LLM08:2026 Hidden Context Exposure
9. LLM09:2026 Vector and Embedding Weaknesses
10. LLM10:2026 Improper Output Handling

Help Net Security reports that practitioner consensus carried 75% of the ranking weight and data from 6,639 real incidents the other 25%. That incident weighting matches the shift traced in AI security year in review: 2025, when attack classes moved from research demonstrations into operational incidents. The moves that matter:

• Excessive Agency, sixth to third. The vote and the incident data both pointed at agentic deployments.
• Misinformation up two, Unbounded Consumption up four. Misinformation ranked low in the vote but near the top of the incident data.
• Improper Output Handling, fifth to tenth, while absorbing extra scope.
• Hidden Context Exposure (LLM08:2026) extends System Prompt Leakage to everything the model sees and the user does not: developer instructions, retrieved policy text, tool and function schemas. The entry text says to assume hidden context is discoverable and to keep credentials, connection strings and tokens out of it.
• Wider scope. Prompt Injection now explicitly covers cross-modal attacks hidden in images or audio, and Data and Model Poisoning covers fine-tuning subversion.

Nine names carried over and the tenth was broadened, so the 2025 walkthrough above still describes the ground. What changes is the numbering in every control register, scanner rule and audit finding that cites it.

OWASP LLM Top 10 vs the Agentic Top 10

The LLM Top 10 treats the model as an application component. Once the model acts with tools and memory, Help Net notes, the risk belongs to the separate OWASP Top 10 for Agentic Applications, announced December 9, 2025: ASI01 Agent Goal Hijack, ASI02 Tool Misuse, ASI03 Identity & Privilege Abuse, ASI04 Agentic Supply Chain Vulnerabilities, ASI05 Unexpected Code Execution, ASI06 Memory & Context Poisoning, ASI07 Insecure Inter-Agent Communication, ASI08 Cascading Failures, ASI09 Human-Agent Trust Exploitation and ASI10 Rogue Agents. A tool-calling agent needs both lists: Excessive Agency names the over-permissioned design, and the ASI entries describe what an attacker does with it across a multi-step run.

Official translations: Portuguese, Japanese and more

OWASP publishes official translations of the 2025 list on its LLM Top 10 page. The Brazilian Portuguese edition, OWASP Top 10 para Aplicações de LLM e IA Generativa (2025), was posted March 12, 2025. The Japanese edition, 大規模言語モデル（LLM）アプリケーションに関するOWASP Top 10, followed on July 22, 2025. Spanish, German, Russian, Chinese, Hindi, Greek and Korean editions are listed alongside them. When checked in October 2026, the 2026 resource page offered English only, so any translated copy uses 2025 numbering.

Prioritizing the list for a real deployment

The list is ranked by the project’s read of community feedback and observed incidents, which is a reasonable global prior and a poor substitute for your own context. For the common case — a production application on a commercial model API, no fine-tuning of your own, retrieval in the mix — a defensible working order looks like this (IDs use 2025 numbering):

1. Prompt Injection (LLM01). Immediate. Documented operational exploitation, no complete defense, and it is the entry point for most of the others.
2. Sensitive Information Disclosure (LLM02). Immediate if any PII or proprietary data sits in system prompts or retrieval context. Data minimization in the corpus does more here than output scrubbing.
3. Improper Output Handling (LLM05). Weight it by what your downstream systems actually do with the output. A response rendered as plain text is a different problem from one that reaches a shell, a SQL layer, or a templating engine.
4. Supply Chain (LLM03) and Data and Model Poisoning (LLM04). Medium for pure API consumers, high the moment you run open-weight models or fine-tune on third-party data. Pin and hash ML dependencies, verify model checksums, and audit fine-tuning dataset provenance.
5. Excessive Agency (LLM06). High priority the moment you build agents, and close to irrelevant before that. This is the risk that scales directly with the capability you grant.
6. Unbounded Consumption (LLM10). Rate limiting, per-user quotas, and query-pattern monitoring cover both the cost-exhaustion and the model-extraction halves of the category, and neither control is consistently implemented in practice.

Two categories are routinely underweighted. Misinformation (LLM09) is as much product design as security: uncertainty communicated in the interface, citations on factual claims, and honest calibration of where the model is reliable do more than any filter. And Vector and Embedding Weaknesses (LLM08) is easy to skip right up until the retrieval corpus turns out to be writable by more parties than anyone enumerated.

Putting the list to work

The Top 10 is a scoping tool, not a checklist that guarantees security. It is most useful as a framework for structuring a conversation about risk coverage, and most misleading when treated as a deployment checklist that can be signed off. A practical way to apply it: map each category to your architecture, mark which are in scope (a RAG chatbot with no tool-calling can largely deprioritize Excessive Agency but must take Vector and Embedding Weaknesses seriously), then assign a concrete control and an owner to each in-scope item.

Several categories map directly to a defensive guardrail layer — input and output filtering for prompt injection, content validation for improper output handling, and policy enforcement for excessive agency. Tooling for that layer is surveyed at guardml.io. The remainder, particularly supply chain and poisoning, are governance and pipeline-integrity problems that sit with the MLOps and platform teams rather than the application layer.

None of the ten have a single silver-bullet fix. Prompt injection in particular remains an open research problem with no complete defense. The value of the framework is that it forces a structured review of the full LLM attack surface rather than the one or two risks that happen to be top of mind.

The list also composes with the other two references worth having open. MITRE ATLAS supplies the adversary technique catalog, the OWASP Top 10 supplies the application risk checklist, and a governance framework wraps both in a structure auditors recognize. That division of labour — including where ISO/IEC 42001 and the EU AI Act sit relative to both — is set out side by side in AI security frameworks compared. To keep these categories in front of you week to week, the personalized AI-Sec digest builder filters our tagged coverage by the Prompt injection, Agent security and Defenses topics.

Related across the network

• OWASP LLM Top 10 2026: Mitigations for Every Risk — aisecreviews.com

FAQ

which owasp llm top 10 version should i use?

Use the 2026 edition for new threat models, design reviews and test plans, since it is OWASP’s current release. Keep 2025 IDs where an existing contract, audit finding or scanner mapping already cites them, and re-map deliberately rather than silently. Always write the year suffix, as in LLM01:2025, because the same number names different risks across editions.

is prompt injection still number one in the owasp llm top 10?

Yes. Prompt Injection is LLM01 in the 2023, 2025 and 2026 editions. The 2026 text explicitly covers cross-modal attacks hidden in images or audio. No complete defense exists, so the working controls are privilege separation between the model and its tools, filtering on input and output, and treating every model response as untrusted input.

how is the owasp llm top 10 different from the owasp top 10?

The classic OWASP Top 10 ranks web application risks, while the LLM Top 10 is a separate list from the OWASP GenAI Security Project covering prompts, models, training and retrieval data, and agent tooling. They meet at Improper Output Handling: unsanitized model output reaching a browser, shell or SQL layer becomes ordinary XSS, command injection or SQL injection.

what does owasp llm top 10 compliance mean?

OWASP does not certify against it. The Top 10 is a community awareness document published under CC BY-SA 4.0, not an auditable standard. In practice, compliance means a documented mapping: each in-scope ID, with its edition year, tied to a control, a test and an owner. Auditable assurance comes from ISO/IEC 42001 or regulation layered on top.