AIWiki
Malaysia
Back to all articles
Ethics & PolicycybersecurityLLM securityprompt injection

OWASP Top 10 for LLM Applications

4 min readUpdated August 2026
OWASP Top 10 for LLM Applications
Type
Security risk framework
Publisher
OWASP Gen AI Security Project
First published
2023
Latest edition
2025
Top risk
Prompt injection (LLM01:2025)

The OWASP Top 10 for LLM Applications is a community-maintained list of the ten most critical security risks affecting applications built on large language models (LLMs), published by the Gen AI Security Project of the Open Worldwide Application Security Project (OWASP). First released in 2023 and updated in a 2025 edition, it has become the most widely referenced framework for securing generative AI applications [1][3].

History

OWASP, a non-profit foundation established in 2001, has long published "Top 10" awareness lists for common web application vulnerabilities. As organisations rapidly deployed LLM-based features, OWASP's Gen AI Security Project produced the first Top 10 for LLM Applications in 2023, cataloguing the emerging failure modes of systems built on foundation models [3]. The list was substantially reworked for the 2025 edition, which reflects real-world incidents, the growth of agentic AI, and community feedback: it added two new categories — system prompt leakage and vector and embedding weaknesses — consolidated overlapping entries, and reordered risks [3]. The 2025 edition was developed by an international team of more than 500 experts and over 150 contributors from industry, academia, and hardware providers [4].

Key Concepts

The 2025 edition lists the following ten risks, as catalogued by the OWASP Gen AI Security Project and independent security summaries [1][2].

  • Prompt Injection (LLM01:2025) — manipulating an LLM's inputs to override its instructions; attacks may be direct (instructions embedded in a user prompt) or indirect (malicious instructions arriving through external content such as web pages or documents). It retained the top position for the second consecutive edition [2][3].
  • Sensitive Information Disclosure (LLM02:2025) — unintentional leakage of confidential data through model outputs or logs.
  • Supply Chain (LLM03:2025) — vulnerabilities in third-party models, datasets, plugins, and dependencies.
  • Data and Model Poisoning (LLM04:2025) — corrupting training or fine-tuning data to alter model behaviour.
  • Improper Output Handling (LLM05:2025) — passing model output to other systems without validation, enabling attacks such as cross-site scripting or SQL injection.
  • Excessive Agency (LLM06:2025) — granting LLM-driven agents overly broad permissions or autonomy.
  • System Prompt Leakage (LLM07:2025) — exposure of internal system prompts containing instructions, credentials, or operational logic.
  • Vector and Embedding Weaknesses (LLM08:2025) — attacks on retrieval components such as vector databases used in retrieval-augmented generation (RAG).
  • Misinformation (LLM09:2025) — the generation and propagation of false or harmful content.
  • Unbounded Consumption (LLM10:2025) — uncontrolled resource usage leading to denial of service or excessive cost.

    • Because LLMs process instructions and data in the same channel, distinguishing user content from commands is a core technical challenge, which is why prompt injection remains the flagship risk [3]. The framework also prescribes mitigations, including input validation, segregation of untrusted content, output sanitisation, least-privilege permissions for agents, and adversarial testing [2].

    Applications

    Security teams use the OWASP Top 10 as a checklist for threat modelling, code review, and penetration testing of LLM applications, and as a common vocabulary for red-teaming exercises [2][3]. Regulators and enterprises increasingly map AI governance requirements onto the framework: it complements the EU AI Act's transparency and risk-management obligations and is used by vendors to document the security posture of AI products [3]. For agentic systems, the excessive agency and system prompt leakage entries guide the design of permission boundaries and secret handling [2].

    >See Also

    🇲🇾Malaysian Context

    In Malaysia, the OWASP Top 10 is directly relevant to organisations deploying AI chatbots and agents under the country's data-protection regime. The Personal Data Protection Act (PDPA) requires safeguards against unauthorised disclosure, making risks such as sensitive information disclosure and prompt injection compliance concerns for Malaysian businesses processing customer data through LLMs [1][2]. Cybersecurity Malaysia and the National Cyber Security Agency (NACSA) promote secure-by-design practices that align with the framework, and the National AI Office's planned AI Adoption Regulatory Framework is expected to reference recognised security baselines. Malaysian banks and fintech firms subject to Bank Negara Malaysia's AI guidelines, as well as government agencies piloting public-service chatbots, have begun incorporating OWASP-style checks — particularly for prompt injection, excessive agency, and unbounded consumption — into their AI governance and red-teaming processes [2][4].

    References

    1. ↑[OWASP Gen AI Security Project — Top 10 for LLM and Gen AI Applications](https://genai.owasp.org/llm-top-10)
    2. ↑[DeepTeam — OWASP Top 10 for LLMs 2025 risk list and mitigations](https://trydeepteam.com/docs/frameworks-owasp-top-10-for-llms)
    3. ↑[Aembit — The OWASP Top 10 for LLM Applications (2025): Explained Simply](https://aembit.io/blog/owasp-top-10-llm-risks-explained)
    4. ↑[Evidently AI — OWASP Top 10 LLM: How to test your Gen AI app in 2025](https://www.evidentlyai.com/blog/owasp-top-10-llm)
    Back to all articles