OWASP Top 10 for LLM Applications 2025

Address OWASP LLM06:2025 Excessive Agency + LLM10:2025 Unbounded Consumption. Excessive Agency occurs when an LLM is granted too much functionality (excessive functions + permissions + autonomy) such that compromise causes outsized impact including unauthorised actions + data modification + resource consumption + financial impact. Unbounded Consumption occurs when LLM systems consume excessive resources (compute + tokens + external API calls + cost) enabling DoS + cost amplification + denial of wallet attacks. Mitigations for Excessive Agency include (a) limit LLM functions + permissions to minimum necessary + (b) implement human-in-the-loop approval for sensitive operations + (c) implement strict allowlists for LLM-callable tools + APIs + (d) avoid open-ended autonomous action chains + (e) implement audit logging for LLM-initiated actions. Mitigations for Unbounded Consumption include (

• OWASP LLM Top 10 evidence for OWASPLLM-6

• adversarial testing limited + user education informal

Address OWASP LLM04:2025 Data and Model Poisoning. Data Poisoning occurs when training + fine-tuning + retrieval data is intentionally + unintentionally contaminated to bias + degrade + or backdoor the resulting model. Model Poisoning occurs when the model itself is tampered with via direct modification + supply chain compromise + or insider action. Mitigations include (a) vet training + fine-tuning data sources for integrity + provenance + content + (b) implement anomaly detection + sanitisation for training data + (c) implement model integrity verification including signing + reproducibility + (d) protect model artefacts in storage + deployment via access control + integrity verification + (e) implement adversarial testing including poisoning + backdoor detection + (f) maintain monitoring + detection for model behaviour drift + (g) implement model versioning + rollback capability.

• OWASP LLM Top 10 evidence for OWASPLLM-5

• adversarial testing limited + user education informal

Operate LLM governance + inventory + risk + change management. Requirements include (a) maintain inventory of LLM systems + models + datasets + tools + agents + integrations + (b) maintain risk assessment + classification per LLM system aligned to applicable regulation (EU AI Act + NIST AI RMF + ISO 42001 + similar) + (c) implement governance structures + roles + responsibilities + accountability for LLM systems + (d) implement change management for models + prompts + tools including approval + testing + rollout + rollback + (e) implement model lifecycle management including evaluation + retirement + (f) integrate LLM systems with broader AI governance + risk management + (g) maintain documentation including model cards + system cards + risk assessments + responsible AI commitments.

• OWASP LLM Top 10 evidence for OWASPLLM-7

• adversarial testing limited + user education informal

Operate LLM monitoring + testing + red teaming + user education. Requirements include (a) maintain comprehensive logging for LLM systems including inputs + outputs + tool calls + retrieved content + with appropriate retention + privacy controls + (b) implement monitoring + alerting + anomaly detection for misuse + abuse + injection + poisoning + drift + (c) integrate LLM logs with SIEM + AI-specific observability tools + (d) operate adversarial testing + red teaming + bug bounty for LLM systems including injection + jailbreak + poisoning + extraction + (e) deliver user education + acceptable use + awareness training including LLM limitations + responsible use + reporting + (f) maintain incident response capability for LLM-specific incidents.

• OWASP LLM Top 10 evidence for OWASPLLM-8

• adversarial testing limited + user education informal

Address OWASP LLM05:2025 Improper Output Handling + LLM09:2025 Misinformation. Improper Output Handling occurs when LLM output is consumed by downstream systems (browsers + databases + code execution + tools) without validation + sanitisation enabling XSS + SQL injection + RCE + SSRF + CSRF. Misinformation occurs when LLM produces inaccurate + fabricated + hallucinated content that users + systems treat as authoritative including factual errors + unsafe code + made-up citations + and over-reliance on incorrect output. Mitigations for Improper Output Handling include (a) treat LLM output as untrusted input + apply context-appropriate encoding + escaping + (b) parameterise downstream queries + (c) sandbox code generation + execution. Mitigations for Misinformation include (a) implement retrieval augmented generation (RAG) with vetted sources + citation + (b) implement fact-checking + verif

• OWASP LLM Top 10 evidence for OWASPLLM-2

• adversarial testing limited + user education informal

Address OWASP LLM01:2025 Prompt Injection + LLM07:2025 System Prompt Leakage. Prompt Injection occurs when attacker input causes the LLM to act outside intended boundaries via direct injection (user-supplied) or indirect injection (through retrieved data + documents + tools + multi-modal inputs). System Prompt Leakage occurs when the system prompt + instructions + sensitive data embedded therein become disclosed to users or attackers. Mitigations include (a) treat all user input + retrieved content as untrusted + (b) maintain clear instruction-data separation + privilege boundaries in prompts + (c) use input + output filtering for known injection patterns + (d) implement least-privilege access for LLM-invoked tools + APIs + (e) avoid embedding secrets + credentials + sensitive instructions in system prompts + (f) implement output classification + filtering against jailbreak + leakage + (

• OWASP LLM Top 10 evidence for OWASPLLM-1

• adversarial testing limited + user education informal

Address OWASP LLM02:2025 Sensitive Information Disclosure + Privacy and Lawful Basis for LLM Processing. Sensitive Information Disclosure occurs when LLM systems disclose training data + user data + system data including PII + credentials + intellectual property + trade secrets to unauthorised parties via memorisation + leakage + inference + side-channel attacks. Mitigations include (a) classify data flowing into + through LLM systems + apply appropriate protection per classification + (b) implement data minimisation in training + fine-tuning + retrieval + (c) implement differential privacy + sanitisation + redaction for training data + (d) implement access controls + output filtering against unauthorised disclosure + (e) implement appropriate legal basis + consent + DPIAs for personal data processing per applicable regulation (GDPR + CCPA + APPI + similar) + (f) maintain data subject ri

• OWASP LLM Top 10 evidence for OWASPLLM-3

• adversarial testing limited + user education informal

Address OWASP LLM03:2025 Supply Chain + LLM08:2025 Vector and Embedding Weaknesses. Supply Chain risk arises from third-party models + datasets + libraries + frameworks + plugins + tools + agent capabilities + including model poisoning + backdoors + malicious packages + license issues. Vector and Embedding Weaknesses arise from vector database + embedding model usage including unauthorised access to embeddings + embedding inversion attacks + retrieval poisoning + cross-context leakage in shared vector stores. Mitigations include (a) maintain inventory of third-party models + datasets + libraries + tools with provenance verification + (b) scan for vulnerabilities + license issues + malicious content + (c) implement model signing + integrity verification + (d) implement access control + isolation for vector databases + (e) implement embedding access control + prevent unauthorised retrieval

• OWASP LLM Top 10 evidence for OWASPLLM-4

• adversarial testing limited + user education informal