The OWASP Top 10 for LLM Applications, Applied

The OWASP Top 10 for LLM Applications is the closest thing this field has to a shared vocabulary, which is most of its value: it lets a finding be filed as LLM05 instead of as an argument. The 2025 edition reorganised the list, and this page maps each entry to the code that addresses it.

What the list is, and is not

It is a risk taxonomy maintained by the OWASP GenAI Security Project, derived from practitioner consensus rather than from an incident database. It is not a compliance standard, not exhaustive, and not ordered by severity for your application. Treat it as a checklist of questions you should be able to answer, not as a list of controls you are obliged to install.

The 2025 entries: LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM03 Supply Chain, LLM04 Data and Model Poisoning, LLM05 Improper Output Handling, LLM06 Excessive Agency, LLM07 System Prompt Leakage, LLM08 Vector and Embedding Weaknesses, LLM09 Misinformation, LLM10 Unbounded Consumption. Read in that order they look like ten unrelated topics. Grouped by where the fix lives, they are four pieces of work.

The instruction-boundary group

LLM01 Prompt Injection · LLM05 Improper Output Handling · LLM06 Excessive Agency. These three are one problem seen from three sides: untrusted text becomes instruction, the resulting output is trusted downstream, and the model holds enough authority for that to matter. Fixing any one in isolation leaves the chain intact.

• LLM01 — what to write. Provenance on every span entering the context; delimiters and instruction-hierarchy prompting as the cheap layer; separation between the context that reads untrusted content and the one that acts. Accept a residual rate.
• LLM05 — what to write. Treat model output as untrusted input at every consumer. Escape on render, parameterise before any query, never eval, never build a shell string, allowlist hosts in any URL the model produced. This is the entry where classic web vulnerabilities re-enter, and it is the most commonly exploited one in practice.
• LLM06 — what to write. Minimum tool set, per-user scoped credentials minted at call time, schema and business-rule validation on arguments, human approval on irreversible tiers. A single policy gate is the implementation.

The disclosure group

LLM02 Sensitive Information Disclosure · LLM07 System Prompt Leakage · LLM08 Vector and Embedding Weaknesses. All three are about data reaching a context it should not have reached — and the fix is always at ingestion, never at the point of output.

• LLM02. Redact or tokenise before text enters the context; filter retrieval by the caller’s entitlements at query time; scan outbound text for the specific patterns you know are catastrophic (keys, card numbers, national identifiers). Decide explicitly whether prompts are retained by your provider, and record the answer where compliance can read it.
• LLM07. Move credentials and access rules out of the prompt entirely — see the extraction page. Canary tokens for detection, not for prevention.
• LLM08. The one people skip. A vector store with no tenant filter will happily return another customer’s chunk because it is semantically close; embeddings can also leak substantial information about their source text, so treat the index as containing the documents themselves. Partition by tenant at the index level rather than filtering after the search, and re-check entitlements on retrieved chunks before they enter the context.

The supply-chain group

LLM03 Supply Chain · LLM04 Data and Model Poisoning. Trust in artefacts you did not build. The controls are the ones software supply-chain security already established, applied to weights, datasets and adapters.

• LLM03. Pin model versions and record which version served which request. Load weights from formats that cannot execute code — see pickle versus safetensors — and verify checksums against the publisher. Inventory your adapters, plugins and MCP servers the way you inventory npm dependencies, because an MCP server is remote code with tool access.
• LLM04. If you fine-tune, control and review the training corpus and keep it reproducible. If you use RAG — and this is the common case — the live analogue of poisoning is an attacker getting content into your index, so treat write access to the index as a privileged operation with review.

The operations group

LLM09 Misinformation · LLM10 Unbounded Consumption. Neither is an attack in the usual sense; both are how systems fail in production.

• LLM09. Ground answers in retrieved sources and cite them so a user can check; constrain the model to refuse outside its evidence; put a human in the loop where a wrong answer has consequences. The security-relevant variant is package hallucination — a model inventing a dependency name that an attacker then registers — so resolve suggested packages against a real registry before anything installs them.
• LLM10. Token and request quotas per key and per user, hard spend caps, timeouts, bounded output lengths, and limits on agent loop depth. Covered in denial of wallet; this entry also covers model extraction through high-volume querying.

Using it without turning it into paperwork

The failure mode of any top-ten list is a spreadsheet with ten rows marked “mitigated”. Two habits keep it honest. First, for each entry write down the specific file or component where the control lives; an entry with no location is not mitigated, it is intended. Second, pair the list with an actual threat model of your own system — the list tells you which categories to check, and only a threat model tells you which of them matters for the data you hold.

For a governance framing rather than an engineering one, NIST’s AI Risk Management Framework (AI RMF 1.0, January 2023) organises the same territory into GOVERN, MAP, MEASURE and MANAGE, and its companion taxonomy NIST AI 100-2 catalogues adversarial machine-learning attacks in more depth than OWASP attempts. Use OWASP to decide what to build and NIST when someone asks how the programme is run.