The OWASP Top 10 for LLM applications
A shared list of the ten biggest risks in apps built on large language models. Learn each one in a line, and where this course covers it.
In 60 seconds
The OWASP Top 10 for LLM applications
A shared list of the ten biggest risks in apps built on large language models. Learn each one in a line, and where this course covers it.
The 2025 list, one line each
| ID | Risk | In one line | Where you learn it |
|---|---|---|---|
| LLM01 | Prompt Injection | Text from a user or from content the model reads changes what the model does. | Prompt injection, up close · Indirect injection: the invisible note |
| LLM02 | Sensitive Information Disclosure | The app reveals personal data, business secrets or other users' data. | Securing RAG · Vector stores and embedding leaks · Logging and monitoring |
| LLM03 | Supply Chain | A model, library, dataset or plugin you depend on is weak or malicious. | Supply chain: plugins, MCP servers and skills · Security testing in the AI pipeline |
| LLM04 | Data and Model Poisoning | Someone plants bad data in training, fine-tuning or your document store. | Securing RAG (poisoned documents) · Data poisoning and backdoors |
| LLM05 | Improper Output Handling | Model output is used by other code without checks: rendered, run or fetched. | Treat model output as untrusted input |
| LLM06 | Excessive Agency | The model has more tools, permissions or freedom than the task needs. | Excessive agency and blast radius · The confused deputy |
| LLM07 | System Prompt Leakage | Hidden instructions are revealed, and with them any secrets or rules inside. | System prompt leakage: prompts are not secrets |
| LLM08 | Vector and Embedding Weaknesses | Weak access control or isolation in the vector store and embeddings used for RAG. | Securing RAG · Vector stores and embedding leaks |
| LLM09 | Misinformation | The model produces false but believable content, and people or systems trust it. | Misinformation and overreliance in AI features |
| LLM10 | Unbounded Consumption | No limits on use, so attackers or bugs burn money, capacity or copy the model. | Unbounded consumption: denial of wallet |
Three groups that make it easier to remember
- What goes in: prompt injection (LLM01), poisoning (LLM04), supply chain (LLM03).
- What comes out: disclosure (LLM02), output handling (LLM05), prompt leakage (LLM07), misinformation (LLM09).
- What the system is allowed to do: excessive agency (LLM06), vector store access (LLM08), unbounded consumption (LLM10).
How to use the list
- 1
Describe the feature
What does it read, what can it do, who uses it? - 2
Go through all ten
For each risk, write: applies, partly applies, or does not apply, and why. - 3
Pick controls
For each risk that applies, name one or two controls and an owner. - 4
Test the controls
Turn each risk into test cases you can run again (Unit 4). - 5
Review on every big change
New tool, new data source or new model means a new review.
- Ticking all ten boxes as "done" in one meeting
- Treating it as the only risks that exist
- Adding a line to the system prompt for each risk
- Writing a reason and a control for each risk
- Using it next to a real threat model of your feature
- Putting controls in code, data access and design
Watch and read more
Lab
A one-page risk map of one AI feature against all ten OWASP risks.
The problem
Choose an imaginary feature, for example: "A chatbot on a bank's website that answers questions from public FAQ pages and can show a logged-in customer their last five transactions."
- Write three lines describing it: what it reads, what tools it has, who uses it.
- Make a table with columns Risk, Applies? (yes / partly / no), Why, One control.
- Fill in a row for each of the ten risks. For "no", still write why.
- Circle the top three risks and one combination of risks that worries you most.
You are done when
Hard questions
Try to answer before you reveal. If you can answer these, you understood the lesson.
Q1SQL injection was largely solved by parameterised queries. Why is there no equally clean fix for prompt injection?Reveal
Parameterised queries work because the database has a strict, separate channel for data that is never read as code. A language model has no such channel: instructions and data are all just text in one context, and the model decides what to follow. So we reduce the impact instead: limit what the model can see and do, check its actions in code, and require approval for risky steps.
Q2Your feature reads only public pages and has no tools. Can LLM02 (Sensitive Information Disclosure) still apply?Reveal
Yes. Users may paste their own personal data into the chat, which then sits in logs, analytics or a provider's systems. The system prompt may hold internal details. Conversations may be cached and shown to the wrong user. "No private data in the source" does not mean "no private data in the system".
Questions people ask
Is the OWASP Top 10 for LLMs a law or a certificate?
No. It is free community guidance. Some companies and auditors use it as a checklist, but following it does not certify your app as secure.
Does it only cover chatbots?
No. It covers applications built on large language models in general, including RAG search, AI features inside other apps, and agents that use tools.
Why is prompt injection first?
Because it affects almost every LLM app and there is no complete fix yet. Models read instructions and data in the same stream of text, so defences reduce the risk but do not remove it. That is why the other controls, like limited permissions, matter so much.
Will the list change?
Yes, it is updated from time to time as attacks and apps change. The 2025 edition replaced an earlier version. Check the project website for the current list before an audit or a review.
Lesson test
5 questions. Get 3 right (60%) to pass and complete this lesson.