LLM Security · 2025 edition
OWASP Top 10 for Large Language Model applications, covering prompt injection, data poisoning, supply chain vulnerabilities, and model security risks.
Official OWASP list| Rank | Risk | Summary | Details |
|---|---|---|---|
| 01 |
| Untrusted prompts can override system intent and manipulate tools or model behavior. |
| Details |
| 02 | Insecure Output Handling | Treating model output as safe can lead to downstream injection and data integrity risks. | Details |
| 03 | Training Data Poisoning | Compromised training or retrieval data can bias outputs and create hidden attack triggers. | Details |
| 04 | Model Denial of Service | Unbounded prompts and request flooding can cause cost spikes and service degradation. | Details |
| 05 | Supply Chain Vulnerabilities | Model and plugin dependencies can introduce compromised artifacts and unsafe behavior. | Details |
| 06 | Sensitive Information Disclosure | Prompts, context windows, and outputs can leak secrets or regulated data. | Details |
| 07 | Insecure Plugin Design | Poorly constrained plugins/tools allow privilege escalation and unsafe external actions. | Details |
| 08 | Excessive Agency | Overly autonomous workflows amplify mistakes and abuse impact across connected systems. | Details |
| 09 | Overreliance | Users and systems may trust inaccurate model outputs without verification safeguards. | Details |
| 10 | Model Theft | Attackers can extract model behavior or assets through abuse of APIs and deployment gaps. | Details |
