⚡ Quick Summary
Published by OWASP, this guidance identifies ten security vulnerabilities affecting large language model applications and sets out prevention and mitigation strategies for each. It presents the 2025 update of a community-driven project that began in 2023, shaped through brainstorming, voting and feedback from contributors working in LLM application security. The document addresses risks across prompts, model outputs, data, models, retrieval systems, agent tools and resource consumption.
The ten entries are Prompt Injection; Sensitive Information Disclosure; Supply Chain; Data and Model Poisoning; Improper Output Handling; Excessive Agency; System Prompt Leakage; Vector and Embedding Weaknesses; Misinformation; and Unbounded Consumption. Each combines a description with examples of risks or vulnerabilities, concrete mitigations, attack scenarios and reference links; several also map to related MITRE ATLAS, OWASP, NIST or CWE materials. The 2025 revision expands the earlier Denial of Service category into Unbounded Consumption, adds guidance on vectors and embeddings for Retrieval-Augmented Generation (RAG), adds System Prompt Leakage, and expands Excessive Agency for agentic architectures.
🧩 What’s Covered
The material proceeds from an account of the update to ten risk entries, followed by a threat-modelling appendix and project acknowledgements.
- Project context and 2025 changes: The opening letter describes the project as an open-source, community-driven effort and explains four changes: Unbounded Consumption broadens the earlier denial-of-service focus to resource management and unexpected costs; Vector and Embedding Weaknesses covers RAG; System Prompt Leakage responds to reported exploits; and Excessive Agency reflects more autonomous agents and plug-in settings.
- Prompt Injection and Sensitive Information Disclosure: The first entries distinguish direct from indirect injection, including external files, webpages, obfuscated content and multimodal inputs. Recommended measures include constrained behaviour, output-format validation, filtering, least privilege, content segregation, adversarial testing, sanitisation, access controls, data-use transparency, federated learning, differential privacy, tokenisation and redaction.
- Supply Chain and Data and Model Poisoning: The guidance covers third-party packages, model provenance, licences, pre-trained models, LoRA adapters, collaborative model merging, on-device models and supplier terms. It recommends supplier vetting, SBOMs or AI/ML BOMs, integrity checks, code signing, patching, data-origin tracking, data version control, sandboxing, anomaly detection and red teaming.
- Improper Output Handling and Excessive Agency: These entries separate unsafe processing of model output from damaging actions enabled by excessive functionality, permissions or autonomy. Measures include zero-trust validation, context-aware encoding, parameterised queries, content security policies, granular extensions, execution in the user's context, complete mediation and human approval for high-impact actions.
- System Prompt Leakage and Vector and Embedding Weaknesses: The document cautions against treating system prompts as secrets or security controls, and calls for guardrails and deterministic controls outside the LLM. For RAG systems, it addresses access partitioning, embedding inversion, knowledge conflicts and poisoning through permission-aware stores, source authentication, classification and immutable retrieval logs.
- Misinformation and Unbounded Consumption: The final entries cover hallucinations, biased or incomplete information, overreliance, unsafe code suggestions, denial of wallet, input floods, model extraction and side-channel attacks. Suggested controls include verified RAG sources, cross-verification, human oversight, risk communication, quotas, throttling, monitoring, watermarking, graceful degradation and controlled MLOps deployment.
- Appendix and supporting material: A visual appendix maps the Top 10 onto an LLM application architecture and threat model. The final pages identify project sponsors and supporters.
💡 Why it matters?
The guidance gives teams a shared security vocabulary for LLM applications while linking each risk to actions that can be built into architecture, deployment and operations. It is particularly relevant where model output reaches browsers, databases, shells, APIs or extensions, or where an agent can act across downstream systems. Its treatment of least privilege, user-context execution, independent authorisation and human approval helps distinguish controls that should be enforced outside a probabilistic model.
It also connects application security with data governance and operational resilience: teams can use its recommendations on supplier review, inventories, provenance checks, vector-store permissions, logging, quotas and resource management when assessing LLM integrations.
❓ What’s Missing
The document is a risk catalogue and mitigation guide rather than a formal assessment method. It does not provide a scoring model, maturity scale, prioritisation formula or completed control checklist for deciding which of the ten risks is most material in a particular deployment. Although it includes many scenarios and references, it does not provide implementation code, test cases or measurable pass/fail criteria for the recommended controls. It also acknowledges that no fool-proof prevention for prompt injection is known because of the nature of generative AI. The appendix supplies an LLM application architecture and threat-model diagram, but no accompanying textual walkthrough or reusable threat-modelling worksheet.
👥 Best For
Security architects, application security teams and engineers designing or reviewing LLM-enabled products, particularly systems using RAG, external content, tool-calling agents, third-party models or cloud inference. It also supports governance and procurement teams evaluating model suppliers, data sources, licences, permissions, inventories and monitoring arrangements.
📄 Source Details
OWASP Top 10 for LLM Applications 2025 is an English, 45-page OWASP publication dated 18 November 2024 and marked “Version 2025”. Running headers identify it as “OWASP Top 10 for LLM Applications v2.0”. No individual authors are identified; Steve Wilson is listed as Project Lead and Ads Dawson as Technical Lead & Vulnerability Entries Lead. It is licensed CC BY-SA 4.0. The printed project website is genai.owasp.org. The complete PDF was available for review.
