The OWASP Top 10 for Large Language Model Applications is the best-known list of security risks for apps built on large language models (LLMs), such as chatbots, copilots and AI agents. It’s produced by the OWASP GenAI Security Project, part of OWASP, the foundation behind the classic OWASP Top 10 for web applications.
This guide follows the 2025 edition, which is also the numbering our white papers use. Here’s each risk in plain English.
A note on the 2026 edition. OWASP released a 2026 edition in August 2026. It reorders most entries and renames one. Prompt injection stays at number 1 and sensitive information disclosure at number 2. Excessive agency moves up from number 6 to number 3. We’ll update this guide once we’ve reviewed the full 2026 list. Until then, if you map controls to OWASP IDs, say which edition you used.
LLM01: Prompt injection
Crafted input that makes the model ignore its instructions, either typed directly or hidden in content the model reads (indirect injection). Do: limit the model’s privileges, require human approval for sensitive actions, and treat all external content as untrusted. Read more: what is prompt injection.
LLM02: Sensitive information disclosure
The model reveals personal data, confidential business information or credentials, from its training data, its context or connected systems. Do: minimise the data the model can access, enforce access control outside the model, and filter outputs. See AI chatbot data leakage.
LLM03: Supply chain
Risks from third-party models, datasets, plugins and libraries, which can be outdated, tampered with or malicious. Do: use trusted sources, check provenance and integrity, and keep an inventory of AI components. See AI supply chain risks.
LLM04: Data and model poisoning
Manipulated training, fine-tuning or embedding data that plants backdoors, biases or vulnerabilities. Do: vet data sources, track data lineage and test model behaviour. See data poisoning.
LLM05: Improper output handling
Passing model output to other systems without validation, which can lead to cross-site scripting, SQL injection, remote code execution and similar attacks. Do: treat model output like user input: validate, sanitise and encode it before use.
LLM06: Excessive agency
Giving an LLM-based system too much functionality, too many permissions or too much autonomy, so mistakes or manipulation cause real damage. Do: apply least privilege to tools and APIs, and require human approval for high-impact actions. See AI agent security.
LLM07: System prompt leakage
Exposing the system prompt, which may contain internal logic, rules or, worse, secrets. Do: never put credentials or sensitive data in prompts, and don’t rely on the prompt as a security control. Enforce rules outside the model.
LLM08: Vector and embedding weaknesses
Risks in retrieval-augmented generation (RAG) systems that use vector databases: unauthorised access to embeddings, data leaking between users or tenants, and poisoned documents in the knowledge base. Do: enforce permission-aware retrieval, separate data by tenant, and validate what goes into the knowledge base.
LLM09: Misinformation
The model produces false or misleading information that looks credible, and people or systems rely on it. Do: ground answers in verified sources, show citations, communicate limitations and keep humans in the loop for important decisions.
LLM10: Unbounded consumption
Uncontrolled resource use: denial of service, runaway costs (“denial of wallet”) or extracting a model through excessive queries. Do: rate limits, quotas, input size limits, cost monitoring and alerts.
How to use the list
- As a threat model checklist when designing an AI feature: go through all ten and note how each applies.
- As a testing plan for red-teaming your AI chatbot before launch.
- As a shared language between developers, security teams and leadership.
The list isn’t a complete security programme. Classic application security still applies. But it covers the risks that are new or much worse with LLMs.
Official sources
- OWASP Top 10 for LLM Applications: the OWASP GenAI Security Project’s list of the main LLM risks
- MITRE ATLAS: a knowledge base of real attack techniques against AI systems
More primary sources, with a short note on each, are on our Sources page.
Last reviewed 25 October 2026. Based on the OWASP Top 10 for LLM Applications, 2025 edition. A 2026 edition with new numbering was released in August 2026; see the OWASP GenAI Security Project for the full list.