LLM Security · 2025 edition
OWASP Top 10 for Large Language Model applications, covering prompt injection, data poisoning, supply chain vulnerabilities, and model security risks.
Official OWASP list| Rank | Risk | Summary | Details |
|---|---|---|---|
| 01 |
| Untrusted input can override instructions, manipulate tool usage, or redirect model behavior away from its intended policy boundaries. |
| Details |
| 02 | Sensitive Information Disclosure | Models and surrounding systems can expose secrets, internal data, personal information, or hidden context during generation. | Details |
| 03 | Supply Chain | Risk enters through models, datasets, plugins, packages, hosted services, and other dependencies that make up the LLM application stack. | Details |
| 04 | Data and Model Poisoning | Training, fine-tuning, or retrieval data can be tampered with to corrupt outputs, bias behavior, or introduce hidden triggers. | Details |
| 05 | Improper Output Handling | Treating model output as inherently safe can turn generated content into a direct path to downstream vulnerabilities. | Details |
| 06 | Excessive Agency | Granting an LLM too much authority over tools, workflows, or business decisions expands the blast radius of mistakes and abuse. | Details |
| 07 | System Prompt Leakage | Attackers may extract hidden instructions or privileged context that reveal internal behavior and weaken defenses. | Details |
| 08 | Vector and Embedding Weaknesses | Embedding pipelines and vector stores can be manipulated or queried in ways that expose data or distort retrieval results. | Details |
| 09 | Misinformation | Hallucinated or misleading responses can drive harmful decisions when applications over-trust the model's apparent confidence. | Details |
| 10 | Unbounded Consumption | Without budget, token, or workload controls, attackers or misuse can create runaway compute and cost exposure. | Details |
