What is the OWASP Top 10 for LLMs?

The OWASP Top 10 for LLM Applications is a community-maintained ranking of the ten most critical security risks in apps built on large language models — and prompt injection has held the #1 spot in every version, including the 2025 edition, still the latest as of July 2026.

OWASP is the nonprofit behind the famous web-security Top 10; this list applies the same playbook to AI. It exists because LLM apps break in ways traditional security checklists never anticipated — the attack surface is language itself.

The 2025 list, in order:

1. Prompt injection — malicious instructions hidden in user input or in content the model reads (see prompt injection)
2. Sensitive information disclosure — the model leaking data it shouldn't
3. Supply chain — compromised models, datasets, or plugins
4. Data and model poisoning — corrupting training or fine-tuning data
5. Improper output handling — trusting model output enough to execute it
6. Excessive agency — giving an AI agent more permissions than it needs
7. System prompt leakage — exposing the app's hidden instructions
8. Vector and embedding weaknesses — attacks on RAG pipelines
9. Misinformation — confident hallucinations users act on
10. Unbounded consumption — runaway usage and denial-of-wallet costs

If you're building anything on an LLM, treat this the way web developers treat the original Top 10: a pre-launch checklist, not optional reading. Start with LLM security for the defensive basics.