OWASP Top 10 for LLM Applications: Developer Guide
OWASP Top 10 for LLM applications — developer-oriented summary of current GenAI risks, mitigations, and how they map to production controls.
The OWASP Gen AI Security Project publishes the OWASP Top 10 for LLM Applications — a community-maintained list of the most critical security risks when building products on large language models. The current edition is commonly referenced as the 2025 list (LLM01:2025 through LLM10:2025). OWASP also tracks evolving GenAI materials on genai.owasp.org, including agentic and multimodal guidance; treat the official site as the source of truth when names or numbering update.
This article is a developer-oriented summary — not a replacement for OWASP's full entries. Each section states the risk in engineering terms, typical failure modes, and production controls. Map risks to your stack, then implement detectors, policy, and tests — not slide-deck awareness.
For depth on specific risks, follow OWASP's per-item pages (for example LLM01: Prompt Injection). For IdenticAPI mapping, see production AI security stack and LLM defense in depth.
How to use this guide
- Threat model your feature (LLM threat modeling)
- Map each applicable Top 10 item to concrete code paths
- Implement layered controls — no single API solves a row
- Test with fixtures and red-team cases (AI security test suite)
- Revisit when you add RAG, tools, or new model providers
OWASP Top 10 for LLM Applications (2025) — developer summary
| ID | Risk | One-line developer view |
|---|---|---|
| LLM01:2025 | Prompt Injection | Untrusted text overrides instructions — direct or via RAG/web |
| LLM02:2025 | Sensitive Information Disclosure | PII, secrets, and confidential context leak to users or logs |
| LLM03:2025 | Supply Chain | Compromised models, plugins, datasets, or dependencies |
| LLM04:2025 | Data and Model Poisoning | Training, fine-tuning, or embedding data manipulated |
| LLM05:2025 | Improper Output Handling | Model output trusted like safe HTML or commands |
| LLM06:2025 | Excessive Agency | Tools and permissions exceed what the task needs |
| LLM07:2025 | System Prompt Leakage | Private instructions extracted via user manipulation |
| LLM08:2025 | Vector and Embedding Weaknesses | RAG retrieval, access control, and embedding attacks |
| LLM09:2025 | Misinformation | False or ungrounded outputs treated as facts |
| LLM10:2025 | Unbounded Consumption | Cost, rate, and resource abuse via LLM endpoints |
The sections below expand each item with mitigations relevant to application teams shipping in 2026.
LLM01:2025 — Prompt Injection
Risk: User or external content manipulates model behavior — ignoring policies, exfiltrating data, or triggering unintended tool use.
Developer notes:
- Split direct (chat input) and indirect (RAG, web fetch, tool results) paths
- Scan at every untrusted boundary; framing alone is insufficient
- Injection is architectural — not fixable with one keyword filter
Controls: Prompt Injection Shield, retrieve-time screening, RAG security, least-privilege tools.
OWASP reference: LLM01:2025 Prompt Injection
LLM02:2025 — Sensitive Information Disclosure
Risk: PII, financial data, credentials, or internal context appears in model output, logs, provider storage, or cross-tenant responses.
Developer notes:
- Scan assembled prompts — history and RAG included
- Block secrets; redact or block PII per policy
- Metadata-only security logging
Controls: PII & Secrets Detection, tenant isolation, LLM data leakage practices.
OWASP reference: LLM02:2025 Sensitive Information Disclosure
LLM03:2025 — Supply Chain
Risk: Vulnerable or malicious components in the LLM stack — base models, fine-tunes, plugins, vector DB extensions, prompt libraries.
Developer notes:
- Pin model versions and SDK hashes
- Vet third-party prompt packs and agent plugins
- Monitor CVEs on inference frameworks and MCP servers
Controls: Dependency scanning, signed artifacts, internal registry for approved models, secure MCP servers.
OWASP reference: LLM03:2025 Supply Chain
LLM04:2025 — Data and Model Poisoning
Risk: Attackers corrupt training, fine-tuning, or embedding corpora to bias outputs or embed backdoors.
Developer notes:
- Customer upload paths are the practical poisoning surface for most SaaS teams
- Quarantine suspicious ingest; monitor retrieval anomalies
Controls: Ingest guardrails, provenance metadata, RAG data poisoning defenses.
OWASP reference: LLM04:2025 Data and Model Poisoning
LLM05:2025 — Improper Output Handling
Risk: Applications render, store, or execute model output without validation — XSS, SQL in suggested queries, unsafe Markdown.
Developer notes:
- Treat completions as untrusted input to your UI and downstream systems
- Moderate before display; sanitize before HTML; CSP in browsers
Controls: AI Output Safety, encoding/sanitization, improper output handling.
OWASP reference: LLM05:2025 Improper Output Handling
LLM06:2025 — Excessive Agency
Risk: Agents can perform high-impact actions with too much autonomy, broad credentials, or missing human approval.
Developer notes:
- Separate read vs write tools; scope API tokens per function
- Validate every tool call before execution
Controls: Agent Action Guard, least privilege for agents, human-in-the-loop for destructive ops.
OWASP reference: LLM06:2025 Excessive Agency
LLM07:2025 — System Prompt Leakage
Risk: Attackers extract confidential system instructions, tool schemas, or internal policy text.
Developer notes:
- Do not embed secrets in system prompts
- Monitor for extraction patterns; minimize sensitive detail in prompts
Controls: Injection detection, output screening, system prompt extraction awareness.
OWASP reference: LLM07:2025 System Prompt Leakage
LLM08:2025 — Vector and Embedding Weaknesses
Risk: RAG systems leak across tenants, retrieve poisoned chunks, or trust embeddings without authorization.
Developer notes:
- Similarity search ≠ access control
- Scan chunks at ingest and retrieve
Controls: Metadata filters, per-tenant indexes, vector database security, secure RAG production.
OWASP reference: LLM08:2025 Vector and Embedding Weaknesses
LLM09:2025 — Misinformation
Risk: Models produce plausible falsehoods; users or downstream automation treat them as authoritative.
Developer notes:
- Require citations grounded in retrieved sources for high-stakes answers
- Disclaim limitations in UX; human review for regulated advice
Controls: RAG grounding checks, output policy, review queues — classifiers complement but do not replace product design.
OWASP reference: LLM09:2025 Misinformation
LLM10:2025 — Unbounded Consumption
Risk: Abuse drives token cost, GPU load, or denial of service through unbounded prompts, loops, or agent retries.
Developer notes:
- Per-tenant and per-user rate limits
- Cap context size, tool iterations, and retrieval depth
Controls: API gateway throttling, budget counters on agent loops, monitoring usage anomalies.
OWASP reference: LLM10:2025 Unbounded Consumption
Mapping Top 10 to IdenticAPI controls
| OWASP item | IdenticAPI building blocks |
|---|---|
| LLM01 | Prompt Injection Shield, Unified Guard input checks |
| LLM02 | PII & Secrets Detection, output echo scan |
| LLM05 | AI Output Safety |
| LLM06 | Agent Action Guard |
| LLM07 | Prompt injection + output safety |
| LLM08 | Ingest/retrieve guards + app-layer ACL (your code) |
Items LLM03, LLM04, LLM09, LLM10 are primarily process, architecture, and ops — detectors support but do not replace them.
Unified Guard orchestrates multiple checks per request when you want one integration point.
Prioritization for new features
If you ship a chat-only MVP:
- LLM01 + LLM02 + LLM05 (input injection, PII/secrets, output handling)
- LLM10 (rate limits)
- LLM07 (prompt hygiene)
If you add RAG:
- LLM08 + LLM04 (retrieval ACL, ingest screening)
If you add agents:
- LLM06 (action guard, approvals)
Testing against the Top 10
Build a coverage matrix linking each applicable OWASP row to CI fixtures (test guardrails in CI). Annual review: re-read genai.owasp.org for list updates and new GenAI resources.
Summary
The OWASP Top 10 for LLM Applications (2025 edition, LLM01–LLM10) frames the dominant GenAI risks for developers — from prompt injection and sensitive disclosure to RAG weaknesses and excessive agency. Use this summary to map risks to pipeline hooks and controls; consult the OWASP Gen AI Security Project for authoritative definitions and evolving guidance.
Explore IdenticAPI AI Security · OWASP Gen AI Security Project
Frequently asked questions
What is the OWASP Top 10 for LLM Applications?
It is a community-maintained list from the OWASP Gen AI Security Project (genai.owasp.org) describing the most critical risks in LLM applications. The 2025 edition uses IDs LLM01:2025 through LLM10:2025 covering injection, disclosure, supply chain, poisoning, output handling, agency, prompt leakage, RAG weaknesses, misinformation, and unbounded consumption.
Is this article an official OWASP document?
No. This is a developer-oriented summary for engineering teams. Consult genai.owasp.org and each LLM##:2025 risk page for authoritative definitions, which may update independently of third-party summaries.
Which OWASP LLM risks does IdenticAPI address directly?
Prompt Injection Shield and Unified Guard input checks map to LLM01. PII and Secrets Detection maps to LLM02. AI Output Safety maps to LLM05. Agent Action Guard maps to LLM06. RAG-oriented scanning supports LLM08 alongside application-layer authorization you must implement.
What OWASP risks are mostly process and architecture?
LLM03 supply chain, LLM04 poisoning governance, LLM09 misinformation product design, and LLM10 unbounded consumption require dependency management, ingest policy, UX grounding, and rate limiting — detectors complement but do not replace these controls.
How should developers prioritize the Top 10 for a new chat feature?
Start with LLM01 injection, LLM02 sensitive disclosure, LLM05 output handling, and LLM10 rate limits. Add LLM08 and LLM04 controls when introducing RAG, and LLM06 when enabling tools or agents.
Related reading
- How to Build Defense in Depth for LLM Applications
Defense in depth for LLM apps — authentication, input validation, injection detection, PII protection, output moderation…
- What Is Prompt Injection? A Developer's Guide
Prompt injection is when untrusted text manipulates an LLM into ignoring your instructions. Learn how it works, why it m…
- What Is AI Agent Security?
AI agent security covers tool permissions, action policies, untrusted content ingestion, and human oversight for autonom…
- The Production AI Security Stack: Inputs, Outputs, Data and Agents
The production AI security stack — input security, data protection, output safety, agent controls, guardrails, logging, …