Home / AI Security Documentation / Standards & Frameworks OWASP Top 10 for LLM Applications (2025)
The OWASP Top 10 for LLM Applications (2025 edition, v1.1.1 released 2024) is a community-driven awareness document identifying the most critical security risks in LLM-integrated applications. It is not a standard and carries no regulatory weight — it informs risk assessment and secure development practices.
Primary source: OWASP Foundation. OWASP LLM Top 10 2025
The 2025 List
Rank
ID
Risk
Core Issue
1 LLM01 Prompt Injection Untrusted input manipulates model behaviour via direct or indirect prompts
2 LLM02 Insecure Output Handling LLM output used without validation, leading to XSS, CSRF, SSRF, code execution
3 LLM03 Training Data Poisoning Malicious data injected into training/fine-tuning sets to alter behaviour
4 LLM04 Model Denial of Service Resource exhaustion via complex prompts, recursive calls, or large contexts
5 LLM05 Supply Chain Vulnerabilities Compromised models, datasets, or third-party components in the ML pipeline
6 LLM06 Sensitive Information Disclosure PII, secrets, or proprietary data leaked via model outputs or embeddings
7 LLM07 Insecure Plugin Design Plugins/tools with excessive privileges, no input validation, or confused deputy
8 LLM08 Excessive Agency LLMs granted autonomous action (API calls, code execution) without guardrails
9 LLM09 Overreliance Humans or systems trust LLM outputs without verification
10 LLM10 Model Theft Unauthorised extraction of model weights, architecture, or fine-tuning data
Key Changes from 2023 Edition (v1.0 → v1.1)
2023 (v1.0)
2025 (v1.1)
Change
Prompt Injection (LLM01)
Prompt Injection (LLM01)
Retained; expanded indirect injection taxonomy
Insecure Output Handling (LLM02)
Insecure Output Handling (LLM02)
Retained; added supply chain context
Training Data Poisoning (LLM03)
Training Data Poisoning (LLM03)
Retained; added fine-tuning/RLHF poisoning
Model DoS (LLM04)
Model Denial of Service (LLM04)
Renamed; added context window exhaustion
Supply Chain (LLM05)
Supply Chain Vulnerabilities (LLM05)
Expanded to include model registries, adapters
Sensitive Info Disclosure (LLM06)
Sensitive Information Disclosure (LLM06)
Added embedding inversion attacks
Insecure Plugin Design (LLM07)
Insecure Plugin Design (LLM07)
Added tool-calling frameworks (LangChain, etc.)
Excessive Agency (LLM08)
Excessive Agency (LLM08)
Added autonomous agent chaining
Overreliance (LLM09)
Overreliance (LLM09)
Added hallucination cascade effects
Model Theft (LLM10)
Model Theft (LLM10)
Added distillation and extraction attacks
Mapping to Standards
OWASP LLM
NIST AI 600-1
EU AI Act
ISO 42001
LLM01 Prompt Injection
§2.9 (Misuse)
Art. 15 (Robustness)
A.5.2 (Development)
LLM02 Insecure Output
§2.8 (Integrity)
Art. 13 (Transparency)
A.6.2 (Operation)
LLM03 Data Poisoning
§2.3 (Dangerous)
Art. 10 (Data Governance)
A.9.2 (Data Management)
LLM04 Model DoS
§2.5 (Environmental)
Art. 15 (Robustness)
A.6.3 (Monitoring)
LLM05 Supply Chain
§2.12 (Value Chain)
Art. 25 (Provider Obligations)
A.8.3 (Asset Management)
LLM06 Info Disclosure
§2.4 (Privacy)
Art. 10, GDPR Art. 25
A.6.2 (InfoSec)
LLM07 Plugin Design
§2.12 (Value Chain)
Art. 15 (Robustness)
A.5.3 (Acquisition)
LLM08 Excessive Agency
§2.7 (Human-AI Config)
Art. 14 (Human Oversight)
A.6.1 (Deployment)
LLM09 Overreliance
§2.7 (Human-AI Config)
Art. 13 (Transparency)
A.7.2 (Evaluation)
LLM10 Model Theft
§2.10 (IP)
Art. 53 (GPAI)
A.8.2 (Asset Protection)
Usage Guidance
Citation