OWASP Top 10 for LLM 2025: risks and security controls

The OWASP Top 10 for LLM Applications 2025 organises the most important risk categories for products built with large language models. It covers more than the model. The relevant system includes prompts, application code, RAG data, vector stores, tool integrations, agents, users and the software supply chain.

This guide maps every category in the 2025 list to a realistic attack scenario, engineering controls and a test that can be performed before production. The primary reference is the official OWASP GenAI Security Project.

OWASP Top 10 for LLM Applications 2025 list

1. LLM01: Prompt Injection
2. LLM02: Sensitive Information Disclosure
3. LLM03: Supply Chain
4. LLM04: Data and Model Poisoning
5. LLM05: Improper Output Handling
6. LLM06: Excessive Agency
7. LLM07: System Prompt Leakage
8. LLM08: Vector and Embedding Weaknesses
9. LLM09: Misinformation
10. LLM10: Unbounded Consumption

The number is not an automatic severity score for your application. Prioritisation depends on data, capabilities, exposure and business impact. Start with a system diagram and threat hypotheses rather than applying the list as a generic compliance badge.

LLM01: Prompt Injection

Prompt injection makes the model follow an instruction that the application should not trust. Direct injection comes from a user message. Indirect injection is embedded in a web page, email, file, ticket or RAG document that the model later consumes.

The highest-impact scenario is not merely convincing the model to reveal a prompt. An agent may be instructed to retrieve private data, change a setting or send information to an external service. Keyword filters for phrases such as “ignore previous instructions” are easy to rephrase or distribute across several steps.

Controls must constrain capability:

• separate untrusted data from system instructions;
• grant each tool minimal permissions;
• require meaningful user confirmation for side effects;
• validate tool arguments in deterministic code;
• restrict network destinations and data flows;
• prevent content from silently expanding the user’s objective.

Test direct prompts and instructions embedded in HTML, office files, images, search results and tool responses. Include multi-step cases in which harmless fragments become an instruction only after context is combined.

LLM02: Sensitive Information Disclosure

An LLM application may reveal personal data, confidential documents, credentials, conversation history or information belonging to another tenant. Causes include over-broad context, missing RAG authorisation, complete prompt logging and unsafely returning tool results.

Access control must happen before retrieval. Each document and chunk should retain owner, tenant and classification metadata. Retrieval queries must filter on the authenticated principal. Classify and minimise data before sending it to a model provider, define retention and redact secrets from logs.

Tests should attempt cross-tenant retrieval, reconstruction through similar questions, full quotation of context, and leakage through traces, analytics or error reporting. Review the broader AI security guide for governance and privacy considerations.

LLM03: Supply Chain

AI products depend on models, adapters, datasets, libraries, prompt packages, plugins, MCP servers and external services. A compromised component can affect every deployment that automatically downloads it.

Maintain an inventory, pin versions and digests, verify signatures, restrict model sources and review changes to prompts and tools. An SBOM with CycloneDX or SPDX covers software components; extend the inventory with models, datasets and runtime integrations.

Test whether a deployment can be reproduced from approved artefacts, whether CI rejects untrusted components and whether the organisation can identify every product using a newly vulnerable dependency. Our software supply-chain attack guide describes the wider threat.

LLM04: Data and Model Poisoning

Poisoning deliberately changes training, fine-tuning, evaluation or retrieval data. The attacker may insert false facts, a backdoor triggered by a phrase or content that promotes a chosen action. Systems that learn automatically from user feedback create another path for manipulation.

Controls include provenance, approval separation, dataset versioning, anomaly detection and moderated ingestion. User feedback should not flow directly into training data. Critical sources may require signatures or approval by more than one trusted owner.

Test adding a document with hidden instructions, spoofed metadata and conflicting facts. Verify deletion and re-indexing: removing the original record is insufficient if stale chunks remain searchable.

LLM05: Improper Output Handling

Model output is untrusted input. If the application inserts it into HTML, SQL, a shell, a template or an API call without contextual validation, classic vulnerabilities can result: XSS, injection, SSRF, path traversal and code execution.

Every consumer needs controls appropriate to its context: output encoding, parameterised queries, allowlisted destinations, schema parsing and sandboxed execution. Structured JSON output must be validated semantically, including resource ownership, ranges and allowed actions.

Test markup, commands, internal URLs, unusual encodings and oversized values, then trace the result to the final consumer. The vulnerability often appears one or two components after the model response.

LLM06: Excessive Agency

Excessive agency occurs when an agent has more tools, permissions or autonomy than the task requires. An email assistant that only needs to draft a response should not automatically read every mailbox, change rules and send attachments.

Separate read, draft, write, delete and administration capabilities. Use minimal OAuth scopes and service roles. High-risk operations need a clear confirmation showing the real target and parameters. Deterministic policy code—not the model—must decide whether an action is allowed.

Test whether the agent can expand the goal, call an unrelated tool, combine individually allowed steps into a dangerous chain or bypass confirmation by modifying parameters after approval. Our article on AI agents in business explains the operational architecture.

LLM07: System Prompt Leakage

The system prompt may reveal policies, tool names and architecture details. It must not contain secrets or act as the sole access-control mechanism. A model may disclose it directly or reconstruct parts through transformation, translation and behavioural probing.

Treat the prompt as configuration whose confidentiality can fail. Store credentials elsewhere and enforce authorisation in code. Give the model only the technical information it needs. The objective is not a magical “unextractable prompt”; it is a system that remains secure after the prompt is known.

Test direct requests, completion tricks, encoding, summarisation and indirect reconstruction. Then assess the impact of the disclosed information rather than reporting every fragment as critical.

LLM08: Vector and Embedding Weaknesses

RAG adds trust boundaries around ingestion, metadata, vector storage, similarity search and context construction. Incorrect tenant filtering can expose another customer’s document. A malicious record can rank highly for many queries or inject instructions through retrieved text.

Enforce authorisation at document and chunk level, isolate collections where appropriate, validate ingestion sources and control indexing endpoints. Limit retrieved content, preserve citations and measure retrieval quality as well as answer quality.

Test similar document names, adversarial text, unusual Unicode, mass ingestion, stale permissions and deletion. Verify that a user who loses access cannot retrieve chunks from a previously built index.

LLM09: Misinformation

Models can produce confident but false answers, fabricate sources or combine incompatible facts. This becomes a security and safety issue when output drives medical, financial, legal or operational decisions.

Constrain the domain, cite sources, measure groundedness, define confidence thresholds and route high-impact cases to a qualified human. RAG does not guarantee truth; both retrieval and answer consistency need evaluation.

Build a representative test set that includes questions with no answer, outdated documents and conflicting sources. Monitor quality after every model, prompt and data change.

LLM10: Unbounded Consumption

Attackers can submit long contexts, run expensive queries, trigger recursive agents, generate large media outputs or cause repeated tool calls. The result can be denial of service, quota exhaustion or an unexpectedly large provider bill.

Set budgets for tokens, time, iterations, tool calls and monetary cost per request, user and tenant. Add global circuit breakers, queue controls, timeouts, caching and concurrency limits. Agents must stop after a bounded number of steps even if the model requests another attempt.

Test long and compressed inputs, parallel requests, retry storms, tool loops and differences in cost between model routes. Alert on abnormal rate of change before the monthly budget is exhausted.

Turning the list into engineering requirements

Create a matrix containing the OWASP category, business scenario, asset, control, owner, test and evidence. “We have a filter” is not evidence. A policy configuration, access-control test, token scope, execution log or red-team result is.

Integrate the matrix into the lifecycle:

• during design, diagram data flows, tools and trust boundaries;
• before implementation, define security acceptance criteria;
• in CI, test schemas, permissions, budgets and known attack cases;
• before production, combine application pentesting with AI red teaming;
• in production, monitor retrieval, tools, cost and policy decisions;
• after every model, prompt, source or tool change, run regression tests.

Pre-production checklist

• Is external content explicitly treated as untrusted data?
• Does RAG filter every chunk by identity and tenant?
• Is the system prompt free of credentials and authorisation logic?
• Is model output validated by the final consumer?
• Do tools have minimal, separate read and write permissions?
• Do consequential actions require informed confirmation?
• Are models, components and data sources inventoried and pinned?
• Are token, cost, time, iteration and concurrency limits enforced?
• Can logs reconstruct a decision without storing excessive sensitive data?
• Does the evaluation set include attacks, regressions and unanswerable questions?

OWASP Top 10 for LLM is not a certificate

The list is a risk-awareness and design resource, not a complete certification scheme or pentest scope. A chatbot may resist basic injection prompts while its API exposes cross-tenant data. Conversely, a strong application security foundation does not prevent an over-privileged agent from misusing a legitimate function.

Combine classic application and API penetration testing with AI-specific evaluation, permission review and business-safety testing. To independently assess an LLM, RAG or agent product, contact Breachroad with the architecture, data sources and tool inventory.