The OWASP LLM Top 10 for 2025 is a list of ten risks for applications built on large language models, published by the OWASP Gen AI Security Project and numbered LLM01 to LLM10. Each risk has its own page with a definition and a list of mitigations. This post follows OWASP’s order and gives one mitigation per risk, all from those ten pages. It covers generative AI applications.
What is the OWASP LLM Top 10 for 2025?
The OWASP Gen AI Security Project site lists “LLM Top 10 for 2025” next to “LLM Top 10 for 2023/24”. Each entry is labeled with its number and the year, for example “LLM01:2025 Prompt Injection”. The pages describe the weakness and give prevention and mitigation strategies. We have not re-ranked or scored anything. The order below is OWASP’s numbering.
What are the ten risks, LLM01 to LLM05?
LLM01: Prompt Injection
OWASP says a prompt injection vulnerability occurs when user prompts alter the model’s behavior or output in unintended ways. The inputs can affect the model even if humans cannot see or read them, as long as the model parses the content. One listed mitigation is to require human approval, with human-in-the-loop controls for privileged operations. Our post on prompt injection attacks covers the topic further.
LLM02: Sensitive Information Disclosure
OWASP lists personal identifiable information, financial details, health records, confidential business data, security credentials and legal documents as examples of sensitive information. Applications risk exposing such data through their output. One mitigation is to limit access to sensitive data based on the principle of least privilege.
LLM03: Supply Chain
OWASP says LLM supply chains are susceptible to vulnerabilities that affect the integrity of training data, models and deployment platforms. The risks extend to third-party pre-trained models and data. One mitigation is to maintain an up-to-date inventory of components using a Software Bill of Materials (SBOM).
LLM04: Data and Model Poisoning
Data poisoning occurs when pre-training, fine-tuning or embedding data is manipulated to introduce vulnerabilities, backdoors or biases. OWASP says it is considered an integrity attack. One mitigation is to vet data vendors rigorously and validate model outputs against trusted sources to detect signs of poisoning.
LLM05: Improper Output Handling
This risk refers to insufficient validation, sanitization and handling of model outputs before they are passed to other components and systems. One mitigation is to treat the model as any other user and adopt a zero-trust approach.
What are the ten risks, LLM06 to LLM10?
LLM06: Excessive Agency
OWASP describes a system that is granted the ability to call functions or interface with other systems through extensions. Excessive Agency is the vulnerability that enables damaging actions in response to unexpected, ambiguous or manipulated model outputs. One mitigation is to limit the extensions an agent may call to the minimum necessary. See our glossary entry on AI agents and our post on an unmanaged shadow AI agent.
LLM07: System Prompt Leakage
System prompts used to steer the model can contain sensitive information that was not meant to be discovered. OWASP states the system prompt should not be considered a secret or used as a security control. One mitigation is to avoid embedding sensitive information, such as API keys, directly in system prompts.
LLM08: Vector and Embedding Weaknesses
OWASP says weaknesses in how vectors and embeddings are generated, stored or retrieved in systems using retrieval augmented generation can be exploited to inject harmful content, manipulate outputs or access sensitive information. One mitigation is fine-grained access controls and permission-aware vector and embedding stores.
LLM09: Misinformation
Misinformation occurs when a model produces false or misleading information that appears credible. OWASP names hallucination as one major cause, and says it is not the only one. One mitigation is to use retrieval augmented generation to retrieve relevant and verified information from trusted external databases.
LLM10: Unbounded Consumption
This occurs when an application allows excessive and uncontrolled inferences, leading to risks such as denial of service, economic losses, model theft and service degradation. One mitigation is rate limiting and user quotas that restrict the number of requests a single source can make in a given period. Our post on AI gateway exploitation is related reading.
| Aspect | Prompt Injection | Improper Output Handling |
|---|---|---|
| What it is | User prompts alter the model’s behavior or output in unintended ways | Insufficient validation of model outputs before they go downstream |
| One listed mitigation | Human-in-the-loop controls for privileged operations | Treat the model as any other user, with a zero-trust approach |
How can a security team use the list?
The pages number the risks LLM01 to LLM10, so the list can be read as a set of questions. Each question below is derived from a mitigation the pages list. Where AI tools are used without approval, our entry on shadow AI explains the term.
- Do agents call only the extensions they need?LLM06 lists limiting extensions to the minimum necessary.
- Do we keep an inventory of model components?LLM03 lists an SBOM-based inventory.
- Are there rate limits and user quotas?LLM10 lists both.
- Do privileged operations need human approval?LLM01 lists human-in-the-loop controls.
Which risks does OWASP link to retrieval augmented generation?
Two pages tie directly to it. LLM08 covers weaknesses in systems that use retrieval augmented generation, and LLM09 lists it as a mitigation for misinformation. LLM01 notes it does not fully mitigate prompt injection. The same technique appears as a risk surface and as a control, so a check is worth running on how each retrieval source is permissioned and verified.
Related reading: AI cyber threats in 2026 and the OWASP Top 10 for web applications.