What is the OWASP Top 10 for LLM applications, and which risks does the 2025 edition list?

A list of the most relevant security risks for applications built on large language models, from the OWASP GenAI Security Project (maintained since 2023, current list on genai.owasp.org). Prompt injection is number one.

1. Prompt injection: input that changes the model's instructions.
2. Sensitive information disclosure: the model reveals data it was given or trained on.
3. Supply chain: compromised models, datasets or plugins.
4. Data and model poisoning: manipulated training, fine-tuning or embedding data.
5. Improper output handling: model output passed on to a shell, browser or database without validation.
6. Excessive agency: the model has more permissions or tools than its task needs.
7. System prompt leakage: secrets or logic hidden in the system prompt get revealed.
8. Vector and embedding weaknesses: attacks on the retrieval layer (RAG).
9. Misinformation: confident, wrong output that people rely on.
10. Unbounded consumption: uncontrolled resource use, leading to denial of service or runaway cost.

Several are old web risks in new form. Improper output handling is injection one step further down the chain. Excessive agency is a least-privilege failure.

Go deeper:

• OWASP Gen AI Security Project — LLM Top 10 — each risk with examples and mitigations
• Prompt injection (Wikipedia) — the number-one risk in depth