Sensitive Information Disclosure went from the #6 risk in the original OWASP LLM list to #2 in the 2025 update. That’s not a cosmetic reshuffle – it reflects a wave of real incidents where LLM applications leaked training data, credentials, or internal configuration through nothing more exotic than a well-crafted query.
If your team is building or shipping anything backed by an LLM – a chatbot, a RAG pipeline, an agent that calls tools – the OWASP Top 10 for LLM Applications is the closest thing the industry has to a shared risk checklist. This guide walks through the current 2025 edition, what changed from the original 2023 list, where the list still falls short for agentic systems, and how to actually test for each risk.
In this guide:
- What the OWASP LLM Top 10 is
- What changed in the 2025 update
- The 10 risks, explained
- Where the list falls short (agents and MCP)
- How to test your application against it
- FAQ
What Is the OWASP LLM Top 10?
The OWASP Top 10 for LLM Applications is a community-maintained ranking of the most critical security risks specific to applications built on large language models. OWASP first published it in 2023, then substantially revised it for 2025 based on real-world incidents and the shift from simple chatbots to agentic, tool-calling systems.
It’s maintained by OWASP’s GenAI Security Project, the same organization behind the long-standing OWASP Top 10 for web applications — but the LLM list covers risks that don’t exist in a traditional web app, like a model that can’t structurally tell the difference between an instruction and a piece of data it’s supposed to summarize.
What Changed in the 2025 Update
Three things happened between the 2023 list and the 2025 edition:
- Two new categories were added: System Prompt Leakage (LLM07) and Vector and Embedding Weaknesses (LLM08), both driven by the rise of RAG-based applications.
- Three categories were renamed and expanded: Training Data Poisoning became Data and Model Poisoning (LLM04); Overreliance became Misinformation (LLM09); Model Denial of Service became Unbounded Consumption (LLM10), which now covers runaway API costs and model theft, not just downtime.
- Rankings shifted. Sensitive Information Disclosure moved from #6 to #2. Supply Chain risk moved from #5 to #3. Insecure Plugin Design and Model Theft, which were standalone items in 2023, got folded into Supply Chain and Excessive Agency.
If your security program still maps to the 2023 list, there’s a real gap: nothing in that version addresses vector database exposure or system prompt leakage, both of which are now common findings in RAG deployments.
The 2025 List, Risk by Risk
| # | Risk | What It Means |
|---|---|---|
| LLM01 | Prompt Injection | Attacker input overrides the model’s intended instructions |
| LLM02 | Sensitive Information Disclosure | Model exposes PII, credentials, or proprietary data in output |
| LLM03 | Supply Chain | Vulnerable or malicious third-party models, datasets, or packages |
| LLM04 | Data and Model Poisoning | Manipulated training or fine-tuning data introduces bias or backdoors |
| LLM05 | Improper Output Handling | Model output passed downstream without validation, enabling injection or SSRF |
| LLM06 | Excessive Agency | The system grants the model more permission or autonomy than its task needs |
| LLM07 | System Prompt Leakage | Hidden operator instructions get extracted, exposing IP and internal policy |
| LLM08 | Vector and Embedding Weaknesses | Flaws in RAG retrieval let attackers manipulate or extract embedded data |
| LLM09 | Misinformation | The model states false things confidently and downstream systems act on them |
| LLM10 | Unbounded Consumption | Unrestricted resource use enables denial of service or runaway cost |
Table: The OWASP Top 10 for LLM Applications, 2025 edition.
Three of these are worth a closer look, because they’re the ones we see most often in actual assessments.
LLM01: Prompt Injection
LLMs process instructions and untrusted input through the same channel, with no structural separation between the two. An attacker doesn’t need to break encryption or find a bug — they just need to phrase input so the model treats it as a new instruction instead of data to process. This is why it’s held the #1 spot in both the 2023 and 2025 editions. Direct injection comes straight from the user (“ignore your previous instructions and…”). Indirect injection is more dangerous in production: the malicious instruction is hidden inside a document, email, or webpage the model is asked to summarize, and the user has no idea it’s there.
LLM02: Sensitive Information Disclosure
Models can memorize and reproduce fragments of training or fine-tuning data, including PII and proprietary business logic — and attackers have developed reliable techniques for extracting it through targeted queries. This isn’t theoretical: CVE-2025-68665 documented a LangChain serialization-injection flaw that allowed secret extraction from applications built on the framework. Beyond training data, poorly scoped system prompts and debug endpoints are common sources of leakage in the applications we test.
LLM07: System Prompt Leakage
Your system prompt often contains business logic, internal policy, or the exact guardrails you’re relying on to keep the model in line. When an attacker extracts it — usually through the same techniques used for prompt injection — they don’t just learn your prompt engineering. They learn exactly how to route around your defenses. OWASP split this out as its own category in 2025 specifically because the damage (leaked IP, defeated guardrails) is distinct from generic prompt injection.
Where the List Falls Short
The OWASP LLM Top 10 is application-centric, and it says so itself. It only partially covers autonomous-agent and MCP-specific risk: shadow agents running outside your approval process, agent-to-agent trust in multi-agent systems, and agent identity and authentication aren’t really addressed here. Excessive Agency (LLM06) is the closest anchor, but OWASP treats the deeper agentic threat model in separate documents — its “Agentic AI: Threats and Mitigations” guide and the newer OWASP Top 10 for Agentic Applications.
If your product is a tool-calling agent or an MCP-based system, treat the LLM Top 10 as a floor, not a ceiling.
How to Test Your Application Against These Risks
Automated scanners can fuzz known payload families at scale – tools like garak and promptfoo are useful for that first pass. But none of them tell you whether a given prompt injection actually crosses a real trust boundary in your specific application, and none of them can assess whether your agent’s tool permissions are more than the job requires. That distinction takes a person who understands your architecture.
A practical testing approach against this list looks like:
- Map your application against the 10 categories to identify which apply (a chat-only app weighs LLM01, LLM02, and LLM09 heaviest; a RAG system adds LLM08; an agentic system adds LLM06 and LLM10)
- Run automated adversarial testing to surface the obvious payload classes
- Manually attempt indirect prompt injection through every untrusted input channel – documents, retrieved web content, API responses
- Review system prompt and output handling for leakage and injection paths
- Test agent tool permissions against least-privilege, not against what’s convenient
This is the core of what an AI red teaming and LLM security assessment actually involves – manual testing against a specific application’s architecture, not a generic scan.
A Practical Example
A common pattern we see in early-stage AI products: a customer support chatbot built on a RAG pipeline, retrieving answers from an internal knowledge base. The team had tested for direct prompt injection in the chat window and felt confident. What they hadn’t tested was indirect injection through the documents themselves – a support ticket containing hidden instructions, ingested into the knowledge base, that altered the model’s behavior for every user who triggered a retrieval that included it. That’s LLM01 and LLM08 overlapping, and it’s invisible if you only test the chat interface directly.
FAQ
What is the OWASP Top 10 for LLM Applications?
It’s a community-maintained ranking of the ten most critical security risks specific to applications built on large language models, published by OWASP’s GenAI Security Project. The current edition is from 2025.
How is the OWASP LLM Top 10 different from the OWASP Web Application Top 10?
Both rank the most critical risks in their domain, but the LLM list covers risks unique to model-based systems — prompt injection, excessive agency, data poisoning — that don’t have an equivalent in traditional web application security.
Does the OWASP LLM Top 10 cover AI agents and MCP servers?
Only partially. Excessive Agency (LLM06) is the closest anchor, and several other entries apply directly, but OWASP addresses deeper agentic and MCP-specific risk in separate companion guides rather than folding it into this list.
What changed between the 2023 and 2025 OWASP LLM Top 10?
Two new categories were added (System Prompt Leakage, Vector and Embedding Weaknesses), three were renamed and expanded, and several risks — notably Sensitive Information Disclosure — moved significantly higher in the ranking.
How often is the OWASP LLM Top 10 updated?
It was first published in 2023 and revised in 2025. OWASP updates it based on community input and observed real-world incidents rather than on a fixed schedule.
Test Your AI Application Against the Full List
Running through this list on paper is a start. Knowing which of these ten risks are actually reachable in your specific application — not just theoretically present — takes manual testing against your real architecture. Book a free 30-minute consultation and we’ll walk through where your AI product likely stands against the current OWASP LLM Top 10.