Summary: The community-standard list of the ten most critical LLM application security risks. Version 2.0 (2025) is current; the project has since grown into the broader OWASP GenAI Security Project.
Sources: raw/OWASP-Top-10-for-LLMs/LLM00_Preface.md through LLM10_UnboundedConsumption.md; llm-top-10.md; llm-top-10-2023-24.md
Last updated: 2026-07-28
Why this was the vault’s most-cited gap
Four separately-ingested sources named OWASP as a resource before it existed here:
- Microsoft’s IR readiness pattern cites it for severity adaptation (source:
raw/AI-incident-response/Incident response for AI systems.md). - Cloudflare notes “Data poisoning is listed in the OWASP Top 10 for LLMs” (source:
raw/Data-poisoning/What is AI data poisoning_.md). - Snyk: “OWASP has identified model theft as one of the top 10 LLM security risks” (source:
raw/Model-theft/Understanding AI Model Theft...md). - PITAX cites
OWASP LLM01:2025as an alias for adversarial suffix attacks (source:raw/AI-attack-techniques/PIT-T-09-gradient-based-attacks.md).
It is the shared vocabulary the other frameworks assume you already have. See owasp-crosswalk.
Provenance
The content in raw/ is the canonical markdown from the project repository’s 2_0_vulns/ directory, not scraped HTML. Licensed CC BY-SA 4.0.
Worth knowing: owasp.org/www-project-top-10-for-large-language-model-applications/ is now only a pointer page. It states the project “has now grown into the comprehensive OWASP GenAI Security Project” and redirects to genai.owasp.org/llm-top-10/. The live site is a WordPress/Elementor build whose pages are ~90% shared navigation; the repository markdown is both cleaner and authoritative. See genai-security-project.
The 2025 list
| Code | Risk |
|---|---|
| LLM01 | Prompt Injection |
| LLM02 | Sensitive Information Disclosure |
| LLM03 | Supply Chain |
| LLM04 | Data and Model Poisoning |
| LLM05 | Improper Output Handling |
| LLM06 | Excessive Agency |
| LLM07 | System Prompt Leakage |
| LLM08 | Vector and Embedding Weaknesses |
| LLM09 | Misinformation |
| LLM10 | Unbounded Consumption |
Detail on each: the-ten-risks.
What changed from 2023-24 to 2025
The earlier list (source: llm-top-10-2023-24.md):
LLM01 Prompt Injection · LLM02 Insecure Output Handling · LLM03 Training Data Poisoning · LLM04 Model Denial of Service · LLM05 Supply Chain Vulnerabilities · LLM06 Sensitive Information Disclosure · LLM07 Insecure Plugin Design · LLM08 Excessive Agency · LLM09 Overreliance · LLM10 Model Theft
The project leads’ own account of the changes (source: LLM00_Preface.md):
- Unbounded Consumption “expands on what was previously Denial of Service to include risks around resource management and unexpected costs.” It also absorbed Model Theft, which is no longer a standalone entry.
- Vector and Embeddings is new, responding “to the community’s requests for guidance on securing Retrieval-Augmented Generation (RAG) and other embedding-based methods, now core practices.”
- System Prompt Leakage is new, “to address an area with real-world exploits that were highly requested by the community. Many applications assumed prompts were securely isolated, but recent incidents have shown that developers cannot safely assume that information in these prompts remains secret.”
- Excessive Agency was expanded “given the increased use of agentic architectures… With LLMs acting as agents or in plug-in settings, unchecked permissions can lead to unintended or risky actions, making this entry more critical than ever.”
Two structural moves worth noting:
- Insecure Plugin Design disappeared as a separate entry, folded into Excessive Agency and Supply Chain. The plugin framing gave way to the agent framing.
- Overreliance became Misinformation — reframing a user-behaviour problem as a model-output problem.
The direction of travel is consistent with what ATLAS shows independently: the field’s centre of gravity moved from model-level attacks to agents and retrieval.
Scale of the project
“From a small group of security professionals addressing an urgent security gap in 2023, it has grown into a global community with over 600 contributing experts from more than 18 countries and nearly 8,000 active community members” (source: raw/OWASP-Top-10-for-LLMs/llm-top-10.md).
A caveat on using it
The Top 10 is a risk awareness list, not a control framework or a coverage checklist. Entries are broad categories with overlapping boundaries — the LLM03 text itself notes “Some of the risks discussed here are also discussed in ‘LLM04 Data and Model Poisoning.’”
For technique-level coverage use ATLAS; for payload craft use PITAX; for binding obligations use AI Act Art 15. OWASP’s job is to be the thing everyone can name.