Overview
The 2025 edition of the OWASP Top 10 for Large Language Model Applications. Pick a risk — every page shares this nav, language and theme.
What's New in 2025
A note from the project leads and the key changes in this edition.
LLM01: Prompt Injection
User prompts alter an LLM's behavior or output in unintended ways, even via content imperceptible to humans.
LLM02: Sensitive Information Disclosure
LLMs can expose PII, proprietary algorithms, or confidential business data through their outputs, causing privacy and IP breaches.
LLM03: Supply Chain
LLM supply chains are vulnerable to tampering and poisoning across training data, third-party models, adapters, and deployment platforms.
LLM04: Data and Model Poisoning
Manipulating training, fine-tuning, or embedding data introduces vulnerabilities, backdoors, or biases that compromise model integrity.
LLM05: Improper Output Handling
Insufficient validation and sanitization of LLM outputs before downstream use can enable XSS, SQL injection, SSRF, or remote code execution.
LLM06: Excessive Agency
Excessive functionality, permissions, or autonomy granted to LLM systems enables damaging actions from unexpected or manipulated LLM outputs.
LLM07: System Prompt Leakage
System prompts may inadvertently expose sensitive data or controls that attackers can extract and exploit to facilitate further attacks.
LLM08: Vector and Embedding Weaknesses
Weaknesses in how RAG vectors and embeddings are generated, stored, or retrieved can be exploited to inject harmful content, manipulate outputs, or leak data.
LLM09: Misinformation
LLMs producing false or misleading yet credible-seeming content, often from hallucination, leading to breaches, reputational and legal harm.
LLM10: Unbounded Consumption
Excessive, uncontrolled LLM inference enables denial of service, economic loss, model theft, and service degradation.