OWASP Top 10 for LLM Applications (2025): the full list
The OWASP Top 10 for LLM Applications (2025) is the community standard taxonomy of the ten most important security risks for LLM and generative-AI applications, maintained by the OWASP GenAI Security Project. The first edition shipped in 2023; the 2025 edition reorganised the list around how LLM apps are actually built and attacked — including tool-using and retrieval-augmented systems (Kodem — OWASP LLM Top 10 explained). It gives teams a shared vocabulary: when everyone says "LLM01" or "excessive agency," risk conversations, tooling, and audits line up. It is a starting point for coverage, not a guarantee of security on its own. See also what prompt injection is and the secure AI agent deployment checklist.
1. The 2025 list at a glance
| ID | Risk | What goes wrong (one line) |
|---|---|---|
| LLM01 | Prompt Injection | Untrusted input steers the model to ignore policy or abuse tools. |
| LLM02 | Sensitive Information Disclosure | Secrets, PII, or system text leak via outputs, logs, or errors. |
| LLM03 | Supply Chain | Compromised models, datasets, plugins, or dependencies upstream. |
| LLM04 | Data and Model Poisoning | Bad training or retrieval data teaches wrong or malicious behaviour. |
| LLM05 | Improper Output Handling | Downstream code treats model output as safe when it is not. |
| LLM06 | Excessive Agency | Tools/integrations take high-impact actions without enough checks. |
| LLM07 | System Prompt Leakage | Instructions or hidden policy text exposed to users or attackers. |
| LLM08 | Vector and Embedding Weaknesses | Retrieval can be manipulated or leak data via embeddings/RAG. |
| LLM09 | Misinformation | Confident wrong answers harm decisions, safety, or compliance. |
| LLM10 | Unbounded Consumption | Abuse of tokens/APIs causes cost, denial of service, or drain. |
This ordering and naming is confirmed by the OWASP project's 2025 release and multiple summarising sources (OWASP Seoul chapter PDF; BSG — LLM Top 10).
2. The agent-relevant rows
For teams shipping autonomous agents, four rows dominate the risk surface:
- LLM01 Prompt Injection — the entry point to almost everything else; split into direct (LLM01.1) and indirect (LLM01.2), with indirect rated higher-impact in agentic deployments (OWASP — Prompt Injection).
- LLM06 Excessive Agency — the model is granted too much functionality, permission, or autonomy, so an influenced model can take harmful actions. The classic fix is least privilege plus human approval for irreversible steps.
- LLM08 Vector and Embedding Weaknesses — flaws in how vectors/embeddings are generated, stored, or retrieved (RAG) enable injection or data leakage.
- LLM05 Improper Output Handling — model output passed to code without validation enables XSS, SSRF, or RCE.
3. How to use the list in practice
A checklist is only useful if you can tell which risks are actually reachable in your stack (Kodem).
- Map — for each feature (chat, RAG, tools, plugins), note which rows apply.
- Measure — tie tests to rows: red-team prompts (LLM01), tool-abuse cases (LLM06), retrieval-poisoning fixtures (LLM04/LLM08), cost limits (LLM10).
- Manage — assign owners for controls (schema design, egress rules, logging, human approval).
- Cross-link — align with the NIST AI RMF for governance cadence, and with MITRE ATLAS for the attacker's technique catalogue.
Classical OWASP categories (injection, broken access control, SSRF) still matter in the services around the model — API gateways, orchestrators, MCP servers. The LLM Top 10 names risks at the model and prompt boundary; it is an add-on lens, not a replacement for a secure SDLC (CloudSec — risk landscape).
4. Where AgentRedTeam maps to the list (honestly)
AgentRedTeam runs simulations keyed to these risk classes and returns a prioritized report of likely gaps across LLM01, LLM04/LLM08, LLM05, and LLM06. It does not claim to cover all ten rows with equal depth, and it does not guarantee finding every instance. It is decision-support, not certification. Pair it with the LLM red-teaming guide for the human-led method behind the automation.