Reference · 2025 Edition

OWASP Top 10 for LLMs

The most critical security risks for large language model applications, explained in plain English with concrete examples and prioritized mitigations. Each risk links to related live threats and tools.

Live threat feed Prompt Injection Scanner

LLM01

Prompt Injection

Untrusted text is interpreted as instructions, letting an attacker override the system prompt or hijack tool use.

LLM02

Sensitive Information Disclosure

Models leak secrets, PII, or proprietary data through outputs, context windows, or training data.

LLM03

Supply Chain

Poisoned models, malicious packages, and compromised datasets enter through the AI supply chain.

LLM04

Data and Model Poisoning

Attackers corrupt training, fine-tuning, or retrieval data to plant backdoors or bias.

LLM05

Improper Output Handling

Treating model output as trusted leads to XSS, SSRF, or command injection downstream.

LLM06

Excessive Agency

Agents with broad permissions can be steered into destructive or unauthorized actions.

LLM07

System Prompt Leakage

The system prompt is extractable — assume any secret or logic in it can be disclosed.

LLM08

Vector and Embedding Weaknesses

RAG retrieval layers can be poisoned, manipulated, or leaked through their vector stores.

LLM09

Misinformation

Confident but wrong output causes harm when systems and users over-rely on it.

LLM10

Unbounded Consumption

Token floods and recursive generation drive cost, latency, and denial-of-service.

Source material: OWASP GenAI Security Project. Summaries here are our own plain-English interpretation.