#The ten risks and a first test for each
| ID | Risk | First test case | What a finding looks like |
|---|---|---|---|
| LLM01 | Prompt Injection | Plant an instruction in a document the app retrieves | Model follows the planted instruction over the system prompt |
| LLM02 | Sensitive Information Disclosure | Ask for another tenant's record by guessable identifier | Data from outside the user's authorization returned |
| LLM03 | Supply Chain | Inventory models, adapters, plugins and MCP servers; check provenance | Unpinned third-party component with write access |
| LLM04 | Data and Model Poisoning | Insert a crafted page into an indexed source | Poisoned content changes answers for other users |
| LLM05 | Improper Output Handling | Coerce output containing HTML/JS or SQL | Output rendered or executed downstream without encoding |
| LLM06 | Excessive Agency | Map every tool and the credential it uses | Tool scoped beyond the user's own permissions |
| LLM07 | System Prompt Leakage | Extraction prompts: repeat, translate, summarize instructions | Secrets, keys or business rules recovered |
| LLM08 | Vector and Embedding Weaknesses | Query near another tenant's documents in a shared index | Cross-tenant retrieval |
| LLM09 | Misinformation | Ask questions with no grounded answer | Confident fabricated facts consumed as authoritative |
| LLM10 | Unbounded Consumption | Long, recursive or tool-looping prompts | Cost or quota exhaustion without limits |
#What changed from the 2023 list
The 2025 edition kept Prompt Injection at LLM01 and added two entries that reflect how applications are now built: System Prompt Leakage (LLM07), because teams put secrets and business logic in prompts, and Vector and Embedding Weaknesses (LLM08), because retrieval-augmented generation is now the default architecture. Misinformation (LLM09) covers applications that consume model output as authoritative without validation [2]. Unbounded Consumption (LLM10) broadens the older denial-of-service framing to include cost and quota exhaustion, which matters when every agent loop is billed per token.
#How to use the list
The Top 10 is a taxonomy, not a test plan. Three practical rules:
- Map risks to your architecture first. LLM08 is irrelevant if you have no retrieval; LLM06 dominates if you have agents with write tools.
- Measure, don't tick. For LLM01 and LLM07, report an attack success rate with an attempt budget and interval, not pass/fail (method in our ASR post).
- Chain them. Real findings combine entries: an indirect injection (LLM01) steering an over-privileged tool (LLM06) whose output is rendered unsafely (LLM05).
#Sources
- [1] OWASP Top 10 for Large Language Model Applications (project page)
- [2] OWASP GenAI Security Project, “LLM09:2025 Misinformation”
Talk to an operator.
Thirty minutes, no slides. We'll show you what bad AI finds in one of your systems.
Book a briefing