The OWASP Top 10 for Large Language Model Applications is the most widely used reference for securing generative AI. Its 2025 edition reflects how LLMs are really deployed today: with retrieval, agents and tools. Below, each risk in plain language, with one way to test it and one way to reduce it.
LLM01: Prompt injection
Input changes the model’s behaviour in ways the developer did not intend. It can be direct (the user types it) or indirect (hidden in a web page, email or document the model reads).
Test: plant instructions in a document that the assistant retrieves and check whether it follows them. Mitigate: treat all content as untrusted, separate instructions from data, limit what the model can do, and require approval for sensitive actions.
LLM02: Sensitive information disclosure
The application reveals personal data, credentials, confidential documents or details of its own configuration.
Test: ask, directly and indirectly, for other users’ data or internal secrets. Mitigate: never put secrets in prompts, enforce access rights before retrieval, and filter outputs for personal data.
LLM03: Supply chain
Risks from third-party models, datasets, fine-tuning adapters, plug-ins and libraries.
Test: review where every model and component comes from and how it is updated. Mitigate: use trusted sources, verify integrity, keep an inventory of AI components and assess providers like any other supplier.
LLM04: Data and model poisoning
Manipulated training, fine-tuning or embedding data introduces backdoors, bias or wrong behaviour.
Test: check who can write to the data sources the model learns from or retrieves. Mitigate: control and log data provenance, validate data before use and monitor for drift.
LLM05: Improper output handling
Model output is passed to a browser, shell, database or other system without validation, which can lead to cross-site scripting, code execution or injection.
Test: make the model produce HTML, JavaScript or SQL and see whether it is rendered or executed. Mitigate: treat output like user input: encode, sanitise and validate it.
LLM06: Excessive agency
An agent has more functions, permissions or autonomy than it needs, so a manipulated model can cause real damage.
Test: try to get the agent to send, delete, pay or change something outside its task. Mitigate: least privilege for every tool, narrow functions instead of generic ones, and human approval for high-impact actions.
LLM07: System prompt leakage
The system prompt is extracted, exposing business logic, filters or, worse, credentials placed in it.
Test: use extraction techniques such as role-play, translation or summarisation requests. Mitigate: assume the system prompt will become public; keep secrets and security controls outside it.
LLM08: Vector and embedding weaknesses
Weaknesses in retrieval-augmented generation (RAG): mixed tenants in one index, missing access controls, or injected content in the vector store.
Test: check whether a user can retrieve chunks from documents they are not allowed to open. Mitigate: enforce permissions at query time, separate data per tenant and validate content before indexing.
LLM09: Misinformation
The model produces confident but false or unsupported answers that people or systems rely on.
Test: measure answer accuracy on questions with known answers and on questions outside the knowledge base. Mitigate: ground answers in sources, show citations, and design the user experience so people can verify.
LLM10: Unbounded consumption
Uncontrolled use of the model leads to denial of service, unexpected costs or model extraction.
Test: send very long or recursive requests and high request volumes. Mitigate: rate limits, input size limits, per-user quotas, timeouts and cost monitoring.
Using the list in practice
The OWASP list is a checklist, not a test plan. Start from your own threat model, decide which risks matter most for your application and test those in depth. Our LLM security testing guide explains how such a test is run.
Setexe tests LLM applications and AI agents against every OWASP risk and helps you fix what we find. See our AI security services or contact us.
