Summary: Each 2025 entry, with the framing that matters most and where it connects to the rest of the vault.
Sources: raw/OWASP-Top-10-for-LLMs/LLM01_*.md through LLM10_*.md (canonical v2.0 markdown)
Last updated: 2026-07-29
LLM01:2025 — Prompt Injection
“Occurs when user prompts alter the LLM’s behavior or output in unintended ways. These inputs can affect the model even if they are imperceptible to humans, therefore prompt injections do not need to be human-visible/readable, as long as the content is parsed by the model.”
Two clarifications the entry makes carefully:
- Injection vs jailbreaking: “Prompt injection involves manipulating model responses through specific inputs to alter its behavior, which can include bypassing safety measures. Jailbreaking is a form of prompt injection where the attacker provides inputs that cause the model to disregard its safety protocols entirely.” Preventing jailbreaking “requires ongoing updates to the model’s training and safety mechanisms” — it is not solvable at the application layer.
- RAG and fine-tuning do not fix it: “research shows that they do not fully mitigate prompt injection vulnerabilities.”
Split into Direct and Indirect, matching PITAX’s delivery axis and AML.T0051. Both can be “intentional or unintentional.”
→ PITAX catalogues 70 techniques inside this one entry.
LLM02:2025 — Sensitive Information Disclosure
Covers PII, financial and health records, credentials, and “proprietary models may also have unique training methods and source code considered sensitive.”
The notable admission: system-prompt restrictions on what the model may return “may not always be honored and could be bypassed via prompt injection or other methods.” Guardrails expressed in prompts are not controls.
→ T58 oracle extraction; Model Theft
LLM03:2025 — Supply Chain
The longest entry (14 KB). “While traditional software vulnerabilities focus on issues like code flaws and dependencies, in ML the risks also extend to third-party pre-trained models and data.”
Specifically flags LoRA and PEFT fine-tuning on platforms like Hugging Face, and notes “the emergence of on-device LLMs increase the attack surface.”
→ Supply Chain Attacks; slopsquatting; supply-chain poisoning.
LLM04:2025 — Data and Model Poisoning
Poisoning across “pre-training, fine-tuning, or embedding” and transfer learning. Called out as “an integrity attack.”
Two details worth carrying:
- Malicious pickling — “models distributed through shared repositories or open-source platforms can carry risks beyond data poisoning, such as malware embedded through techniques like malicious pickling, which can execute harmful code when the model is loaded.” This is code execution, not model misbehaviour.
- Sleeper agents — “backdoors may leave the model’s behavior untouched until a certain trigger causes it to change. This may make such changes hard to test for and detect, in effect creating the opportunity for a model to become a sleeper agent.”
→ Data Poisoning collection; PITAX T44 trigger-gated payloads
LLM05:2025 — Improper Output Handling
“Insufficient validation, sanitization, and handling of the outputs generated by large language models before they are passed downstream.”
The framing to remember: “Since LLM-generated content can be controlled by prompt input, this behavior is similar to providing users indirect access to additional functionality.”
Consequences are ordinary appsec ones: “XSS and CSRF in web browsers as well as SSRF, privilege escalation, or remote code execution on backend systems.”
This is the entry that makes LLM security legible to a conventional appsec team — treat model output as untrusted user input, because that is what it is.
It is also the hinge to Secure Coding Patterns, where the downstream system receiving untrusted model output is your own git repository.
LLM06:2025 — Excessive Agency
“The vulnerability that enables damaging actions to be performed in response to unexpected, ambiguous or manipulated outputs from an LLM, regardless of what is causing the LLM to malfunction.”
That clause is the important one: the entry is agnostic about cause. Triggers include hallucination “caused by poorly-engineered benign prompts, or just a poorly-performing model,” and injection “from a malicious user, an earlier invocation of a malicious/compromised extension, or (in multi-agent/collaborative systems) a malicious/compromised peer agent.”
Root causes: excessive functionality, excessive permissions, excessive autonomy.
→ PITAX agentic cluster; ATLAS AML.T0053 AI Agent Tool Invocation, the most-mitigated technique in that matrix
LLM07:2025 — System Prompt Leakage
New in 2025, and the entry with the sharpest opinion in the list:
“The system prompt should not be considered a secret, nor should it be used as a security control… disclosure of the system prompt itself does not present the real risk — the security risk lies with the underlying elements, whether that be sensitive information disclosure, system guardrails bypass, improper separation of privileges.”
And on inevitability: “Even if the exact wording is not disclosed, attackers interacting with the system will almost certainly be able to determine many of the guardrails and formatting restrictions.”
The real failure it names is “the application allows bypassing strong session management and authorization checks by delegating these to the LLM.”
LLM08:2025 — Vector and Embedding Weaknesses
New in 2025. “Weaknesses in how vectors and embeddings are generated, stored, or retrieved can be exploited by malicious actions (intentional or unintentional) to inject harmful content, manipulate model outputs, or access sensitive information.”
→ PITAX T64 retrieval ranking manipulation; PoisonedRAG
LLM09:2025 — Misinformation
Replaces Overreliance. “Misinformation occurs when LLMs produce false or misleading information that appears credible.”
Hallucination is the major cause but explicitly not the only one — “biases introduced by the training data and incomplete information can also contribute.” Overreliance survives as a contributing factor rather than the headline: it “occurs when users place excessive trust in LLM-generated content, failing to verify its accuracy.”
→ T67 fake-citation grounding, where fabricated sources are used offensively
LLM10:2025 — Unbounded Consumption
Absorbed both Model Denial of Service and Model Theft. Covers attacks “designed to disrupt service, deplete the target’s financial resources, or even steal intellectual property by cloning a model’s behavior” — all resting on “excessive and uncontrolled inferences.”
Risks named: “denial of service (DoS), economic losses, model theft, and service degradation.”
Grouping DoS and extraction under one heading is a real insight: both are defeated by the same control, query volume limits. That is the convergence model theft defences documents across four independent sources.