The OWASP Top 10 for LLM Applications (2025): a must-have security checklist
TL;DR
The OWASP Top 10 for LLM Applications 2025 is the standard security checklist for LLM apps. Prioritise reducing agent privileges, treat output as untrusted data, keep secrets out of system prompts and cap resource consumption.
The security team asks: "Has the new chatbot feature been risk-assessed?". If your team has no reference framework yet, the OWASP Top 10 for LLM Applications is the standard starting point. It lists the ten most common risks in LLM-powered applications, maintained by the OWASP community (the people behind the famous web OWASP Top 10). The current version is 2025.
Ten risks and their core mitigations
| ID | Risk | Core mitigation |
|---|---|---|
| LLM01 | Prompt Injection: input (direct or via documents, web pages) alters model behaviour | Separate data from instructions, limit privileges, approve sensitive actions |
| LLM02 | Sensitive Information Disclosure: leaking personal data or secrets | Filter input/output data, per-user retrieval permissions |
| LLM03 | Supply Chain: compromised third-party models, libraries, plugins | Verify provenance, pin versions, SBOMs |
| LLM04 | Data and Model Poisoning: tampered training/fine-tuning/embedding data | Control data sources, test behaviour after training |
| LLM05 | Improper Output Handling: using unchecked output (XSS, SQL injection, command execution) | Treat output as untrusted input: escape, validate, parameterise |
| LLM06 | Excessive Agency: agents with too many permissions, tools or autonomy | Minimal tools and permissions, human approval for irreversible actions |
| LLM07 | System Prompt Leakage: exposing prompts that contain logic or sensitive details | Keep secrets out of prompts; enforce permissions at the system level |
| LLM08 | Vector and Embedding Weaknesses: flaws in RAG and vector databases | Per-document access control, vet data entering the store |
| LLM09 | Misinformation: wrong but convincing output | Citations, verification, UX that conveys uncertainty |
| LLM10 | Unbounded Consumption: unlimited resource use (cost, DoS) | Rate limits, token caps, budgets and cost alerts |
Three risks to prioritise for agents
- LLM01 + LLM06 are the most dangerous pair: injection only does serious harm when the agent has permission to do harmful things. Reducing privileges is the most reliable defence, since there's no way to block injection completely.
- LLM05: classic web bugs return, such as rendering LLM output straight into HTML or concatenating it into SQL.
- LLM10: an agent stuck in a loop or abusive users can push an API bill up very fast.
Risks and caveats
- The Top 10 isn't everything: it's the most common list, not a substitute for threat modelling your specific system.
- The system prompt isn't a place for secrets: assume it will leak.
- Traditional web security still applies: authentication, authorisation, logging and secret management don't change because there's an LLM.
How to apply it
- Dev: Escape and validate all LLM output before rendering or executing it; never concatenate output into SQL or shell commands.
- Tech Lead: Use the ten items as a design review checklist for every LLM feature; record the mitigation for each, or why it doesn't apply.
- PM/Security: Set per-user cost budgets and rate limits from the first version, rather than waiting for an unusual bill.
Sources & references
- OWASP Top 10 for LLM Applications 2025 — OWASP GenAI Security Project