The OWASP Top 10 for LLMs, Explained

Large language models introduce a security surface that traditional appsec checklists don't fully cover. The OWASP Top 10 for LLM Applications is the closest thing the industry has to a shared vocabulary for these risks. Here is a practical walkthrough.

Why a dedicated Top 10?

Classic web risks (injection, broken access control, misconfiguration) still apply — but LLMs add failure modes that stem from treating natural language as control flow. When instructions and data share the same channel, an attacker who controls the data can influence the instructions. That single idea underlies most of the list.

The list

LLM01 — Prompt Injection

The flagship risk. Untrusted text — typed by a user or retrieved from a document or web page — is interpreted as instructions. Indirect prompt injection, where the payload arrives through retrieved content, is especially dangerous in agentic systems.

Mitigation starts with never concatenating untrusted text into your system prompt, and never trusting model output to be safe by default.

LLM02 — Sensitive Information Disclosure

Models can leak secrets embedded in prompts, training data, or context windows. Keep credentials out of the model entirely, and sanitize outputs that might carry PII.

LLM03 — Supply Chain

Poisoned models, malicious packages, and compromised datasets. Verify model provenance, pin dependencies, and generate an SBOM for your AI stack.

LLM04 — Data and Model Poisoning

Attackers corrupt training or fine-tuning data to plant backdoors or bias. Validate data sources and monitor for trigger phrases.

LLM05 — Improper Output Handling

Rendering model output without sanitization leads to XSS, SSRF, or command injection downstream. Treat model output like any other untrusted input.

LLM06 — Excessive Agency

Agents with broad tool access can be steered into destructive actions. Apply allow-lists, least privilege, and human-in-the-loop approval for high-risk operations.

LLM07 — System Prompt Leakage

The system prompt is not a secret store. Assume it can be extracted, and keep business-critical logic and credentials out of it.

LLM08 — Vector and Embedding Weaknesses

RAG systems can be poisoned or manipulated through the retrieval layer. Control who can write to your vector store.

LLM09 — Misinformation

Overreliance on confident-but-wrong output. Add grounding, citations, and human review for consequential decisions.

LLM10 — Unbounded Consumption

Token floods and recursive generation drive cost and denial-of-service. Rate limit, cap output length, and budget spend per user.

Where to start

If you only fix three things this quarter:

1. Separate instructions from data and re-assert critical rules after untrusted content.
2. Sanitize output before it hits a browser, shell, or another tool.
3. Constrain agency — every tool call behind an allow-list.

You can pressure-test the first item today with our free Prompt Injection Scanner.