Docs

Appearance

OWASP Top 10 for Large Language Model Applications (2025) ​

OWASP Top 10 for LLM Applications illustration

Use of the OWASP Top 10 ​

The OWASP Top 10 for Large Language Model Applications (OWASP Top 10 for LLM Applications) comes from the OWASP GenAI Security Project. OWASP identifies the Top 10 as "a community-developed awareness document for developers, architects, data scientists, security practitioners, and organizations building or operating applications that use large language models".

The OWASP Top 10 for LLM Applications is not law, and it does not make obligations in law. Each entry gives "Prevention and Mitigation Strategies". These are measures that OWASP recommends.

OWASP recommends changes to the LLM application, for example output encoding and least privilege. OWASP also recommends that you "Carefully vet data sources and suppliers" and "Educate Users on Safe LLM Usage". Records and test results can show that you use the measures and that the measures operate correctly. A record does not decrease a risk.

The OWASP Top 10 for LLM Applications is different from the OWASP Top 10 for Agentic Applications. The 2025 Top 10 includes some risks of agents. For example, LLM06:2025 Excessive Agency includes an LLM "agent" that selects the extension, and "a malicious/compromised peer agent" in "multi-agent/collaborative systems". For the 2026 Top 10, OWASP writes: "This list owns the risk when the model is a component inside your application." If the model becomes "an actor, with tools it can call, memory it carries between sessions, and consequences it sets in motion downstream", the risk "moves to the OWASP Agentic Top 10". For a model that starts "acting on its own", OWASP recommends: "pair it with the Agentic list, because neither one covers that ground alone."

Changes in 2025 and 2026 ​

OWASP released the 2025 Top 10 on November 18, 2024, as "Version 2025". The "Revision History" gives two releases before it, Version 1.0 on 2023-08-01 and Version 1.1 on 2023-10-16. The 2025 Top 10 also uses the name "OWASP Top 10 for LLM Applications v2.0".

In "What's New in the 2025 Top 10", OWASP gives these changes:

  • Unbounded Consumption — the entry "expands on what was previously Denial of Service to include risks around resource management and unexpected costs".
  • Vector and Embedding Weaknesses — the entry "responds to the community’s requests for guidance on securing Retrieval-Augmented Generation (RAG) and other embedding-based methods".
  • System Prompt Leakage — an entry that OWASP "added" in 2025.
  • Excessive Agency — the entry "has been expanded, given the increased use of agentic architectures that can give the LLM more autonomy".

OWASP released the 2026 Top 10 on August 4, 2026. OWASP identifies the 2026 Top 10 as the "Current release", "published August 4, 2026", and the 2025 Top 10 as an "archived release". The Modulos Framework MFF-11 maps the 2025 Top 10 (see The OWASP Top 10 in the Framework).

The 2026 Top 10 gives new numbers to most entries. Thus the 2025 code of an entry, for example LLM06:2025, is not the code of the 2026 entry with the same name, LLM03:2026:

2026 entry2025 entryChange
LLM01:2026 Prompt InjectionLLM01:2025 Prompt InjectionSame position
LLM02:2026 Sensitive Information DisclosureLLM02:2025 Sensitive Information DisclosureSame position
LLM03:2026 Excessive AgencyLLM06:2025 Excessive AgencyFrom position 6 to position 3
LLM04:2026 Supply ChainLLM03:2025 Supply ChainFrom position 3 to position 4
LLM05:2026 Data and Model PoisoningLLM04:2025 Data and Model PoisoningFrom position 4 to position 5
LLM06:2026 Unbounded ConsumptionLLM10:2025 Unbounded ConsumptionFrom position 10 to position 6
LLM07:2026 MisinformationLLM09:2025 MisinformationFrom position 9 to position 7
LLM08:2026 Hidden Context ExposureLLM07:2025 System Prompt LeakageNew name, from position 7 to position 8
LLM09:2026 Vector and Embedding WeaknessesLLM08:2025 Vector and Embedding WeaknessesFrom position 8 to position 9
LLM10:2026 Improper Output HandlingLLM05:2025 Improper Output HandlingFrom position 5 to position 10

A 2026 entry and a 2025 entry with the same name do not always include the same risks. In "What's New in the 2026 Top 10", OWASP gives these changes:

  • Prompt Injection — "now covers cross-modal attacks, the kind that hide instructions inside an image or an audio track".
  • Supply Chain — "now accounts for the trust failure when a promoted model artifact is not what it claims to be".
  • Data and Model Poisoning — "now absorbs fine-tuning subversion".
  • Improper Output Handling — "now spans the insecure code that assistants generate at scale".
  • Hidden Context Exposure — the new name of System Prompt Leakage, "a broader framework for the same failure to trust information that should have stayed out of reach".

Some of these risks are also in the 2025 Top 10. LLM01:2025 includes "Multimodal Injection" (see LLM01:2025 Prompt Injection). LLM09:2025 includes "Unsafe Code Generation". LLM05:2025 includes LLM code with "vulnerabilities like SQL injection" ("Scenario #6"). Thus a change in 2026 does not always show a new risk.

LLM08:2026 Hidden Context Exposure is "the unauthorized extraction, inference, or reconstruction of hidden, non-user-facing system instructions or operational context placed in a model's context". In an LLM application, hidden context "typically includes the system prompt, developer instructions, retrieved policy text" and "the schemas of tools and functions the application exposes to the model". Hidden Context Exposure "becomes security-relevant when that hidden context contains or reveals secrets, policy logic, tools, trust boundaries, workflow criteria, proprietary behavior, or other sensitive implementation details that materially increase attacker capability".

The 2025 risks ​

OWASP gives these ten entries in the 2025 Top 10:

LLM01:2025 Prompt Injection ​

In the 2025 Top 10, OWASP gives this "Description" for LLM01:2025: "A Prompt Injection Vulnerability occurs when user prompts alter the LLM’s behavior or output in unintended ways." These inputs "can affect the model even if they are imperceptible to humans". A prompt injection does not always replace the task of the model, and it does not always come from an attacker.

LLM01:2025 gives two types:

  • Direct prompt injection — "a user's prompt input directly alters the behavior of the model in unintended or unexpected ways".
  • Indirect prompt injection — the input comes from "external sources, such as websites or files".

Each type can be "either intentional or unintentional". LLM01:2025 also includes "Multimodal Injection", for example "hiding instructions in images that accompany benign text". About RAG and fine-tuning, OWASP writes that "research shows that they do not fully mitigate prompt injection vulnerabilities".

OWASP writes that "it is unclear if there are fool-proof methods of prevention for prompt injection". OWASP gives seven measures that "can mitigate the impact of prompt injections":

  1. "Constrain model behavior"
  2. "Define and validate expected output formats", and "use deterministic code to validate adherence to these formats"
  3. "Implement input and output filtering"
  4. "Enforce privilege control and least privilege access"
  5. "Require human approval for high-risk actions"
  6. "Segregate and identify external content"
  7. "Conduct adversarial testing and attack simulations"

LLM02:2025 Sensitive Information Disclosure ​

In the 2025 Top 10, LLM02:2025 identifies sensitive information, for example "personal identifiable information (PII), financial details, health records, confidential business data, security credentials, and legal documents". OWASP writes that LLMs "risk exposing sensitive data, proprietary algorithms, or confidential details through their output". Users can accidentally give sensitive data, "which may later be disclosed in the model's output".

A system prompt can limit the types of data that the LLM gives. This limit can "provide mitigation against sensitive information disclosure". But OWASP writes that "such restrictions may not always be honored and could be bypassed via prompt injection or other methods".

OWASP gives the measures in six groups:

  • "Sanitization" — "Integrate Data Sanitization Techniques" and "Robust Input Validation".
  • "Access Controls" — "Enforce Strict Access Controls" and "Restrict Data Sources".
  • "Federated Learning and Privacy Techniques" — "Utilize Federated Learning" and "Incorporate Differential Privacy".
  • "User Education and Transparency" — "Educate Users on Safe LLM Usage" and "Ensure Transparency in Data Usage". OWASP recommends that users can "opt out of having their data included in training processes".
  • "Secure System Configuration" — "Conceal System Preamble" and "Reference Security Misconfiguration Best Practices".
  • "Advanced Techniques" — "Homomorphic Encryption" and "Tokenization and Redaction".

For the GDPR and personal data, see GDPR.

LLM03:2025 Supply Chain ​

In the 2025 Top 10, OWASP gives this "Description" for LLM03:2025: "LLM supply chains are susceptible to various vulnerabilities, which can affect the integrity of training data, models, and deployment platforms." The risks also "extend to third-party pre-trained models and data". OWASP writes that fine-tuning methods such as LoRA and PEFT, and "on-device LLMs", add supply-chain risks. An attack at runtime is not necessary for a supply-chain risk.

The "Common Examples of Risks" of LLM03:2025 are:

  1. "Traditional Third-party Package Vulnerabilities", "with increased risks when components are used during model development or finetuning"
  2. "Licensing Risks"
  3. "Outdated or Deprecated Models"
  4. "Vulnerable Pre-Trained Model"
  5. "Weak Model Provenance"
  6. "Vulnerable LoRA adapters"
  7. "Exploit Collaborative Development Processes"
  8. "LLM Model on Device supply-chain vulnerabilities"
  9. "Unclear T&Cs and Data Privacy Policies"

Some of these risks are also in LLM04:2025 Data and Model Poisoning. LLM03:2025 "focuses on the supply-chain aspect of the risks".

OWASP recommends these measures:

  1. "Carefully vet data sources and suppliers, including T&Cs and their privacy policies, only using trusted suppliers."
  2. Apply the mitigations of "A06:2021 – Vulnerable and Outdated Components", also in "development environments with access to sensitive data".
  3. "Apply comprehensive AI Red Teaming and Evaluations when selecting a third party model."
  4. Keep "an up-to-date inventory of components using a Software Bill of Materials (SBOM)".
  5. "create an inventory of all types of licenses involved using BOMs and conduct regular audits of all software, tools, and datasets".
  6. "Only use models from verifiable sources and use third-party model integrity checks with signing and file hashes".
  7. "Implement strict monitoring and auditing practices for collaborative model development environments".
  8. Do anomaly detection and "adversarial robustness tests on supplied models and data".
  9. "Implement a patching policy to mitigate vulnerable or outdated components."
  10. "Encrypt models deployed at AI edge with integrity checks and use vendor attestation APIs".

LLM04:2025 Data and Model Poisoning ​

In the 2025 Top 10, OWASP gives this "Description" for LLM04:2025: "Data poisoning occurs when pre-training, fine-tuning, or embedding data is manipulated to introduce vulnerabilities, backdoors, or biases." The risk is high with external data sources, "which may contain unverified or malicious content".

LLM04:2025 also includes models "distributed through shared repositories or open-source platforms". These models can contain "malware embedded through techniques like malicious pickling, which can execute harmful code when the model is loaded". A backdoor can "leave the model's behavior untouched until a certain trigger causes it to change". This can make the change "hard to test for and detect".

OWASP recommends these measures:

  1. "Track data origins and transformations using tools like OWASP CycloneDX or ML-BOM."
  2. "Vet data vendors rigorously, and validate model outputs against trusted sources to detect signs of poisoning."
  3. "Implement strict sandboxing to limit model exposure to unverified data sources."
  4. "Tailor models for different use cases by using specific datasets for fine-tuning."
  5. "Ensure sufficient infrastructure controls to prevent the model from accessing unintended data sources."
  6. "Use data version control (DVC) to track changes in datasets and detect manipulation."
  7. "Store user-supplied information in a vector database, allowing adjustments without re-training the entire model."
  8. "Test model robustness with red team campaigns and adversarial techniques".
  9. "Monitor training loss and analyze model behavior for signs of poisoning."
  10. "During inference, integrate Retrieval-Augmented Generation (RAG) and grounding techniques to reduce risks of hallucinations."

LLM05:2025 Improper Output Handling ​

In the 2025 Top 10, OWASP gives this "Description" for LLM05:2025: "Improper Output Handling refers specifically to insufficient validation, sanitization, and handling of the outputs generated by large language models before they are passed downstream to other components and systems." Because prompt input can control LLM output, this is "similar to providing users indirect access to additional functionality".

LLM05:2025 includes risks to other systems. An attack "can result in XSS and CSRF in web browsers as well as SSRF, privilege escalation, or remote code execution on backend systems". The examples include "remote code execution", "XSS", "SQL injection", "path traversal vulnerabilities", and "phishing attacks". Some conditions "can increase the impact of this vulnerability", for example when "The application grants the LLM privileges beyond what is intended for end users".

OWASP recommends these measures:

  1. "Treat the model as any other user, adopting a zero-trust approach". Apply input validation to the output of the model.
  2. Follow the OWASP ASVS guidelines for "effective input validation and sanitization".
  3. "Encode model output back to users to mitigate undesired code execution by JavaScript or Markdown."
  4. "Implement context-aware output encoding based on where the LLM output will be used".
  5. "Use parameterized queries or prepared statements for all database operations involving LLM output."
  6. "Employ strict Content Security Policies (CSP) to mitigate the risk of XSS attacks".
  7. "Implement robust logging and monitoring systems to detect unusual patterns in LLM outputs".

LLM06:2025 Excessive Agency ​

In the 2025 Top 10, OWASP identifies agency in LLM06:2025: "the ability to call functions or interface with other systems via extensions … to undertake actions in response to a prompt". An LLM "agent" can select the extension. "Agent-based systems will typically make repeated calls to an LLM".

LLM06:2025 continues: "Excessive Agency is the vulnerability that enables damaging actions to be performed in response to unexpected, ambiguous or manipulated outputs from an LLM, regardless of what is causing the LLM to malfunction." The "Common triggers" include "hallucination/confabulation caused by poorly-engineered benign prompts", a model that operates incorrectly, and "direct/indirect prompt injection from a malicious user, an earlier invocation of a malicious/compromised extension, or (in multi-agent/collaborative systems) a malicious/compromised peer agent".

The "root cause" is usually one or more of these:

  • Excessive functionality — an extension has functions that are "not needed for the intended operation of the system".
  • Excessive permissions — "An LLM extension has permissions on downstream systems that are not needed for the intended operation of the application."
  • Excessive autonomy — "An LLM-based application or extension fails to independently verify and approve high-impact actions."

OWASP gives these measures, which "can prevent Excessive Agency":

  1. "Minimize extensions"
  2. "Minimize extension functionality"
  3. "Avoid open-ended extensions"
  4. "Minimize extension permissions"
  5. "Execute extensions in user's context"
  6. "Require user approval" before "high-impact actions"
  7. "Complete mediation", with the authorization in downstream systems and not in the LLM
  8. "Sanitise LLM inputs and outputs"

OWASP gives two other measures, which "will not prevent Excessive Agency, but can limit the level of damage caused": "Log and monitor the activity of LLM extensions and downstream systems" and "Implement rate-limiting".

LLM07:2025 System Prompt Leakage ​

In the 2025 Top 10, LLM07:2025 identifies "the risk that the system prompts or instructions used to steer the behavior of the model can also contain sensitive information that was not intended to be discovered". OWASP writes that "the system prompt should not be considered a secret, nor should it be used as a security control".

OWASP also writes that "disclosure of the system prompt itself does not present the real risk". The "fundamental security risk" is "that the application allows bypassing strong session management and authorization checks by delegating these to the LLM, and that sensitive data is being stored in a place that it should not be". OWASP adds: "Even if the exact wording is not disclosed, attackers interacting with the system will almost certainly be able to determine many of the guardrails and formatting restrictions that are present in system prompt language".

OWASP recommends these measures:

  1. "Separate Sensitive Data from System Prompts"
  2. "Avoid Reliance on System Prompts for Strict Behavior Control"
  3. "Implement a system of guardrails outside of the LLM itself"
  4. "Ensure that security controls are enforced independently from the LLM". OWASP adds: "if those tasks require different levels of access, then multiple agents should be used, each configured with the least privileges needed to perform the desired tasks".

For LLM08:2026 Hidden Context Exposure, see Changes in 2025 and 2026.

LLM08:2025 Vector and Embedding Weaknesses ​

In the 2025 Top 10, LLM08:2025 is about systems that use retrieval augmented generation (RAG) with LLMs. LLM08:2025 also writes: "Weaknesses in how vectors and embeddings are generated, stored, or retrieved can be exploited by malicious actions (intentional or unintentional) to inject harmful content, manipulate model outputs, or access sensitive information."

The "Common Examples of Risks" of LLM08:2025 are:

  1. "Unauthorized Access & Data Leakage"
  2. "Cross-Context Information Leaks and Federation Knowledge Conflict", which includes an LLM that "can’t supersede old knowledge that it has learned while training"
  3. "Embedding Inversion Attacks"
  4. "Data Poisoning Attacks", which "can occur intentionally by malicious actors … or unintentionally"
  5. "Behavior Alteration", for example with less "emotional intelligence or empathy"

Some of these risks occur without an attacker, for example a "knowledge conflict" or a "Behavior Alteration".

OWASP recommends these measures:

  1. "Permission and access control": use "permission-aware vector and embedding stores". Keep "strict logical and access partitioning of datasets" in the vector database between "different classes of users or different groups".
  2. "Data validation & source authentication"
  3. "Data review for combination & classification"
  4. "Monitoring and Logging": keep "detailed immutable logs of retrieval activities".

For "Behavior Alteration", OWASP writes that "The impact of RAG on the foundational model's behavior should be monitored and evaluated".

LLM09:2025 Misinformation ​

In the 2025 Top 10, LLM09:2025 writes: "Misinformation occurs when LLMs produce false or misleading information that appears credible." It is not necessary that a user accepts the information. Misinformation "can lead to security breaches, reputational damage, and legal liability". Hallucination is "One of the major causes", and "biases introduced by the training data and incomplete information can also contribute".

Overreliance is "A related issue". In overreliance, users "place excessive trust" in the output of the LLM and do not make sure that it is correct. Overreliance "exacerbates the impact of misinformation".

Misinformation can occur without an attacker. In "Scenario #2" of LLM09:2025, "A company provides a chatbot for medical diagnosis without ensuring sufficient accuracy." OWASP writes that "the safety and security breakdown did not require a malicious attacker". Attackers can also cause misinformation or use it:

  • In "Scenario #1" of LLM09:2025, attackers "experiment with popular coding assistants to find commonly hallucinated package names". Then "they publish malicious packages with those names".
  • In "Scenario #1" of LLM04:2025, an attacker "biases the model's outputs by manipulating training data or using prompt injection techniques, spreading misinformation".

OWASP recommends these measures:

  1. "Retrieval-Augmented Generation (RAG)": use "relevant and verified information from trusted external databases" during "response generation".
  2. "Model Fine-Tuning"
  3. "Cross-Verification and Human Oversight": OWASP recommends that users check LLM outputs against "trusted external sources". Use "human oversight and fact-checking processes, especially for critical or sensitive information". "Ensure that human reviewers are properly trained to avoid overreliance on AI-generated content."
  4. "Automatic Validation Mechanisms"
  5. "Risk Communication"
  6. "Secure Coding Practices"
  7. "User Interface Design", for example "clearly labeling AI-generated content" and the "intended field of use limitations"
  8. "Training and Education"

LLM10:2025 Unbounded Consumption ​

In the 2025 Top 10, LLM10:2025 writes: "Unbounded Consumption occurs when a Large Language Model (LLM) application allows users to conduct excessive and uncontrolled inferences, leading to risks such as denial of service (DoS), economic losses, model theft, and service degradation." One large input is not necessary for this risk. In "Scenario #2: Repeated Requests", "a high volume of requests" makes "the service unavailable to legitimate users".

The "Common Examples of Vulnerability" of LLM10:2025 are:

  1. "Variable-Length Input Flood"
  2. "Denial of Wallet (DoW)"
  3. "Continuous Input Overflow"
  4. "Resource-Intensive Queries"
  5. "Model Extraction via API"
  6. "Functional Model Replication"
  7. "Side-Channel Attacks"

OWASP recommends these measures:

  1. "Input Validation"
  2. "Limit Exposure of Logits and Logprobs"
  3. "Rate Limiting"
  4. "Resource Allocation Management"
  5. "Timeouts and Throttling"
  6. "Sandbox Techniques"
  7. "Comprehensive Logging, Monitoring and Anomaly Detection"
  8. "Watermarking": "Implement watermarking frameworks to embed and detect unauthorized use of LLM outputs."
  9. "Graceful Degradation": "Design the system to degrade gracefully under heavy load, maintaining partial functionality rather than complete failure."
  10. "Limit Queued Actions and Scale Robustly": limit "the number of queued actions and total actions". Use "dynamic scaling and load balancing" for "varying demands".
  11. "Adversarial Robustness Training"
  12. "Glitch Token Filtering": "Build lists of known glitch tokens and scan output before adding it to the model’s context window."
  13. "Access Controls", with RBAC and least privilege for "LLM model repositories and training environments"
  14. "Centralized ML Model Inventory"
  15. "Automated MLOps Deployment"

Use OWASP Top 10 for LLM Applications in Modulos ​

For the Requirement mapping and steps in Modulos, see Use the OWASP Top 10 for LLM Applications in Modulos.

Other Frameworks ​

The 2026 Top 10 has "Appendix A: Related Framework Mappings". In Appendix A, OWASP maps the ten 2026 entries to "nine external security frameworks and taxonomies":

  • OWASP Top 10 for Agentic Applications
  • OWASP GenAI Data Security 2026
  • MITRE ATLAS
  • MITRE ATT&CK
  • MITRE CWE
  • NIST AI 600-1 (Generative AI Profile)
  • NIST AI RMF (AI 100-1), v1.0 (2023)
  • CSA AI Controls Matrix (AICM)
  • OWASP AIVSS

For the NIST AI RMF, OWASP maps the 2026 entries to the AI RMF "Categories whose outcomes it most directly exercises". The NIST AI RMF section of Appendix A gives no mapping for LLM10:2026 Improper Output Handling. OWASP does not map the 2025 entries in Appendix A. OWASP also does not map ISO/IEC 42001 or the EU AI Act in Appendix A. In the 2025 Top 10, seven entries have a "Related Frameworks and Taxonomies" section, which refers to MITRE ATLAS and, in some entries, to other sources.

The OWASP GenAI Security Project also has the GenAI Security Crosswalk, which is different from the Top 10. The Crosswalk README identifies mappings for the "LLM Top 10 2026", for example LLM_EUAIAct.md for the EU AI Act and LLM_ISO42001.md for ISO/IEC 42001:2023.

NIST writes that "The AI RMF 1.0 is being revised as part of the White House AI Action Plan." For these frameworks, see NIST AI RMF, EU AI Act, and ISO/IEC 42001. To compare frameworks, see Comparison. For Controls that are in more than one Modulos Framework, see Control overlap.

FAQ ​

For the FAQ about the OWASP Top 10 for LLM Applications, see FAQ.

OWASP for AI security (hub)

The OWASP LLM Top 10 and the Agentic Top 10

OWASP Top 10 for Agentic Applications

Security risks of AI agents that use tools

Sources ​

Disclaimer

This page gives general information. It is not legal advice.