The OWASP LLM Top 10 (2025), entry by entry
All ten entries of the OWASP Top 10 for LLM Applications 2025, what each one actually means in a deployed system, and which control closes it.
The OWASP Top 10 for Large Language Model Applications is the working risk taxonomy for this category. It is not a standard and it is not a control set — it is a shared vocabulary, which is exactly what a three-year-old field needs most, because it lets a security team, an engineering team and an auditor describe the same problem in the same words.
The 2025 revision reorganised the 2023 list around what deployments actually got wrong. Below is each entry with what it means in practice and where the fix lives.
LLM01:2025 Prompt Injection
Untrusted text reaching the model's instruction channel. Direct (the user types it) or indirect (it arrives in a document, a page, a ticket or an API response the application retrieves). Structural rather than a bug: there is one token stream and nothing in it distinguishes instructions from data.
Where the fix lives: not in filtering. Least-privilege tools, output treated as untrusted, and human confirmation on irreversible actions. Full explainer.
LLM02:2025 Sensitive Information Disclosure
Personal, proprietary or credential data escaping — into a provider's logs, to a user not entitled to it, or out through a tool. Promoted up the list in 2025 because it is the failure that actually shows up in production.
Where the fix lives: know your provider's retention and training position; filter retrieval by the asking user's permissions; redact or tokenise outbound data; classify your own prompt logs. The seven leak paths.
LLM03:2025 Supply Chain
Compromised or unverifiable models, weights, datasets, adapters and the frameworks serving them. Model weights are executable content, model hubs are publisher-unverified by default, and a hosted endpoint pinned to an alias can change under you.
Where the fix lives: provenance and inventory. AI bill of materials.
LLM04:2025 Data and Model Poisoning
Deliberate corruption of pre-training data, fine-tuning data or a retrieval corpus to change behaviour later. The backdoor variant — normal behaviour except on a trigger — is invisible to held-out evaluation.
Where the fix lives: control who can write to a corpus, record provenance, and test with trigger-probing sets. Data poisoning.
LLM05:2025 Improper Output Handling
Passing a completion to a downstream component without validation: rendering it as HTML, executing it as SQL or shell, using it to build a URL or a file path. This is the most classical entry on the list — it is injection, with the model as the untrusted source.
Where the fix lives: the boundary you already know. Escape, parameterise, validate against a schema, allow-list. Cheapest high-value fix in the list.
LLM06:2025 Excessive Agency
An agent able to do more than the task requires: too many tools, too broad credentials, or too much autonomy over irreversible actions. This is what turns a prompt injection from bad text into a bad action.
Where the fix lives: per-agent identity, task-scoped credentials, server-side authorisation on every tool call, confirmation for outbound and irreversible operations. Agent security.
LLM07:2025 System Prompt Leakage
Disclosure of the hidden instructions. New in 2025, and included precisely because teams kept putting things in the system prompt that should never have been there — credentials, business thresholds, internal hostnames, guardrail descriptions.
Where the fix lives: assume the prompt is public; enforce in code what you were asking for in prose. System prompt leakage.
LLM08:2025 Vector and Embedding Weaknesses
Retrieval-specific risks: an index with no access control, cross-tenant contamination, poisoned documents, and the fact that embeddings are recoverable rather than anonymous. Also new in 2025, reflecting that RAG became the default enterprise architecture.
Where the fix lives: pre-query permission filtering, per-tenant isolation, source attribution, and classifying the index like the corpus. RAG security.
LLM09:2025 Misinformation
Confident, fluent, wrong output — and, importantly, software acting on it. The package-hallucination supply-chain attack is the clearest security instance: the model invents a dependency, an attacker registers the name.
Where the fix lives: resolvable citations, schema-constrained output, verification of identifiers against a real registry, humans on consequential decisions. Hallucination.
LLM10:2025 Unbounded Consumption
Resource and cost exhaustion. Broader than the 2023 "Model Denial of Service" entry because the money, not the availability, is usually the target: cost per request is attacker-influenced, and agent loops multiply it.
Where the fix lives: budgets in tokens and currency per tenant, explicit output caps, bounded agent loops, spend-rate alerting. Denial of wallet.
How to use the list without misusing it
Do use it as the vocabulary for findings, as the index for a threat model, and as the structure for a red-team report. It makes results legible to people who were not in the room.
Do not treat it as a control set or a compliance target. "We address the OWASP LLM Top 10" is not a meaningful statement — there is no certification, no audit and no defined bar to clear. When you see it in a vendor security questionnaire, the useful follow-up is which controls, at which layer, and how did you test them.
For the governance layer above this, the NIST AI Risk Management Framework (NIST AI 100-1) and its Generative AI Profile (NIST AI 600-1, July 2024) are the right references. For adversary techniques when you are building a test set, use MITRE ATLAS.