OWASP Top 10 for LLM Apps
The 2025 List
The OWASP Top 10 for Large Language Model Applications (2025 edition) is the standard checklist for LLM security reviews.
| ID | Risk | ShopEase example | Main defence |
|---|---|---|---|
| LLM01 | Prompt Injection | review text tells the bot to insult users | least privilege, separate data from instructions, detection |
| LLM02 | Sensitive Information Disclosure | bot reveals another customer's address | access checks in tools, PII masking |
| LLM03 | Supply Chain | an unvetted model or MCP server from the internet | trusted sources, pinned versions, review |
| LLM04 | Data and Model Poisoning | fake reviews added to the RAG index | curate and moderate indexed content |
| LLM05 | Improper Output Handling | model output rendered as HTML or run as SQL | escape, validate, parameterise |
| LLM06 | Excessive Agency | bot can issue unlimited refunds | narrow tools, limits, human approval |
| LLM07 | System Prompt Leakage | secrets or discount rules in the prompt get revealed | no secrets in prompts; enforce rules in code |
| LLM08 | Vector and Embedding Weaknesses | search returns docs from another tenant | metadata filters per user/tenant |
| LLM09 | Misinformation | wrong return policy stated confidently | RAG, citations, verification |
| LLM10 | Unbounded Consumption | a script sends 1 lakh long prompts | rate limits, max tokens, budgets per user |
How to Read the List
OWASP (Open Worldwide Application Security Project) is a non-profit known for the original OWASP Top 10 of web application risks. Its LLM list does the same for apps built on language models: it names the most common and damaging risk categories so that teams share a vocabulary in design reviews and audits. It is a checklist of risks, not a standard you certify against.
The ten items group into three families, which makes them easier to remember:
- What goes in: LLM01 Prompt Injection, LLM04 Data and Model Poisoning, LLM03 Supply Chain (untrusted inputs, documents, models and plugins).
- What comes out: LLM02 Sensitive Information Disclosure, LLM05 Improper Output Handling, LLM07 System Prompt Leakage, LLM09 Misinformation.
- What the system is allowed to do: LLM06 Excessive Agency, LLM08 Vector and Embedding Weaknesses, LLM10 Unbounded Consumption (permissions, data access and resource limits).
Notice how many defences are ordinary security engineering: access control, parameterised queries, escaping, rate limits, dependency review. LLM security is mostly application security applied to a component that can be talked into anything. The single most useful question in a review is: "if the model is fully manipulated, what is the worst it can do?" Shrink that answer with permissions and limits.
Tip
Tip: In interviews, pick two risks and explain a concrete defence in your own project. "I put refund limits in the tool, not in the prompt" shows you understand LLM06.
Misconception and Summary
Note: Misconception: "we use a safe, well-trained model, so these risks do not apply". Most items on the list (disclosure, output handling, excessive agency, vector store access, consumption) are about your application around the model, not the model itself.
- The OWASP LLM Top 10 (2025) is a shared checklist of LLM app risks.
- Group them: inputs, outputs, and what the system may do.
- Most defences are classic security: least privilege, validation, escaping, limits.
- Assume the model can be manipulated; design so that is survivable.