OWASP Top 10 for LLM Applications
The OWASP Top 10 for LLM Applications lists the most critical security risks in applications built on large language models. The 2025 edition covers prompt injection, sensitive information disclosure, supply chain, data and model poisoning, improper output handling, excessive agency, system prompt leakage, vector and embedding weaknesses, misinformation and unbounded consumption.
The ten risks
| ID | Risk | In short |
|---|---|---|
| LLM01 | Prompt Injection | Input that makes the model follow an attacker’s instructions |
| LLM02 | Sensitive Information Disclosure | The model reveals personal data, secrets or confidential information |
| LLM03 | Supply Chain | Compromised models, datasets, packages or plugins |
| LLM04 | Data and Model Poisoning | Training or fine-tuning data manipulated to change behaviour |
| LLM05 | Improper Output Handling | Model output passed to other systems without validation |
| LLM06 | Excessive Agency | The model can take more actions, with more permissions, than it needs |
| LLM07 | System Prompt Leakage | Instructions, and any secrets in them, exposed to users |
| LLM08 | Vector and Embedding Weaknesses | Retrieval systems that leak data or can be poisoned |
| LLM09 | Misinformation | Confident, wrong output that people or systems act on |
| LLM10 | Unbounded Consumption | Inputs that drive up cost or exhaust resources |
Using it
Treat the list as a shared vocabulary for threat modelling, design reviews and vendor questions, not as a complete checklist. Several risks interact: prompt injection becomes far more damaging when combined with excessive agency or improper output handling.
How HYDN tests against it
Our LLM penetration testing maps every finding to this list. The HYDN AI Attack Engine generates adversarial inputs for injection, jailbreak, leakage and poisoning scenarios, and our testers confirm impact through the application around the model.
Frequently asked questions
Who publishes the list?
The OWASP GenAI Security Project, part of the Open Worldwide Application Security Project.
How does it relate to the agentic Top 10?
The LLM list covers applications built on language models. The OWASP Top 10 for Agentic Applications, published in December 2025, covers the extra risks when models plan, use tools and act. An agent is usually also an LLM application, so both apply.
Published Updated