Overview
Use the OWASP Top 10 for LLM Applications as the risk taxonomy for anything that puts a model in the request path: chatbots, RAG pipelines, and tool-calling agents. It is a separate list from the general OWASP Top 10 because the failure modes are different; a model that follows instructions embedded in its input is not a bug in the traditional sense, it is the model working as designed against an attacker-controlled prompt. The 2025 edition is the current version as of this writing. Each entry links to the page on this site with the implementation guidance.
LLM01: Prompt Injection holds the top spot again; treat all model input as untrusted
Prompt injection is an attacker embedding instructions in data the model reads (a document, a webpage, a tool result) that override or redirect the system prompt. Delimit untrusted data from instructions, run a sentinel check on suspicious input, and scope tool permissions with least privilege. See prompt-injection-defense for the full defense stack and prompt-injection for the term definition.
LLM02: Sensitive Information Disclosure jumped to #2; redact before the model sees it or before its output leaves
A model can leak training data, retrieved documents, or conversation history it should not repeat, and a tool response can carry credentials straight into the context window. Redact secrets and PII from tool outputs before they reach the model, not after. See mcp-security for the redaction pattern on tool responses.
LLM03: Supply Chain covers the model and its dependencies, not just your own code
A fine-tuned model built on a poisoned base, a compromised model registry, or a malicious MCP server are all supply chain risk in the LLM context. Vet model and MCP server provenance before adding them, and pin model versions rather than tracking latest in production. This mirrors A03 in the general Top 10 but the attack surface includes model weights and training data, not just package registries.
LLM04: Data and Model Poisoning means the training or retrieval corpus is the attack surface
An attacker who can write to a RAG index or a fine-tuning dataset can steer model behavior without ever sending a malicious prompt. Control write access to any corpus the model retrieves from or trains on, and validate ingested documents before indexing. See rag-vector-databases for access control on the retrieval store.
LLM05: Improper Output Handling means model output is attacker-controlled once injection succeeds
Never pass LLM output to eval(), a shell, a SQL query, or innerHTML without the same validation you would apply to any other untrusted input. A successful prompt injection turns model output into an attacker’s payload, and an application that trusts that output blindly inherits the injection.
LLM06: Excessive Agency means the model has permissions its task does not need
Excessive Agency is granting a tool-calling agent broad filesystem, network, or account permissions “in case it needs them.” Scope tools narrowly, require human confirmation for irreversible actions (deletes, payments, sends), and apply per-session rate limits. See mcp-security for the filesystem allowlist and rate-limiting patterns.
LLM07: System Prompt Leakage means secrets in the system prompt are not actually secret
Users can often extract the system prompt through direct questioning or injection, so anything in it should survive being read aloud: no embedded API keys, no “this is the secret rule the user must never learn” framing. Treat the system prompt as a behavior spec the user can see, and put access-control decisions in code, not in prompt text.
LLM08: Vector and Embedding Weaknesses means the retrieval index needs the same access control as the database
An attacker who can insert documents into a vector store used for RAG can poison what the model retrieves, and a retrieval index with no per-tenant filtering leaks one customer’s documents into another’s context. Apply row-level or namespace-level access control to the vector store the same way you would to Postgres. See rag-vector-databases and supabase-rls.
LLM09: Misinformation means a confident, wrong answer is a security-relevant failure
A model that fabricates a citation, an API parameter, or a fact presented as verified can cause real harm when the output drives a decision or an automated action. Ground high-stakes answers in retrieval with citations, and mark generated content that has not been verified against a source. See rag-citations.
LLM10: Unbounded Consumption means an agent loop or a huge prompt is a denial-of-service and a billing risk
Without limits on prompt size, output length, and tool-call volume, a single request or a runaway agent loop can exhaust API quota and run up cost. Cap max tokens, set per-session tool-call limits, and add a circuit breaker that disables a tool after repeated failures. See mcp-security for the rate-limit and circuit-breaker pattern.