OWASP Top 10 for LLM apps in plain English
The OWASP Top 10 for LLM applications (2025 edition) lists the ten most important security risks in apps built on large language models: prompt injection, sensitive information disclosure, supply chain, data and model poisoning, improper output handling, excessive agency, system prompt leakage, vector and embedding weaknesses, misinformation and unbounded consumption. Most of them are handled by treating what the model reads and writes as untrusted, limiting what each AI feature can do, and keeping a person in the loop for actions that matter.
OWASP, the open community best known for its web application Top 10, also publishes a list of the most important risks in applications built on large language models (LLMs): chatbots, AI assistants, and workflows that call a model behind the scenes.
The official list is written for security specialists. This is a plain English version for the people who own these applications: what each risk means, and one check you can make. It follows the 2025 edition of the list.
1. Prompt injection
What it is: someone writes text that makes the model ignore your instructions. It can come from a user typing into a chatbot, or be hidden in a document, email or web page the model reads.
Check: assume any text the model reads might contain instructions. Don't let the model's output alone trigger anything important.
2. Sensitive information disclosure
What it is: the model reveals data it shouldn't, such as another customer's details, internal documents or credentials, because that data was in its context or training.
Check: only give the model the data the current user is allowed to see, and filter what comes back.
3. Supply chain
What it is: the models, libraries, plugins and datasets you depend on can be outdated, tampered with or carry licences you didn't expect.
Check: keep a list of every model and AI component you use, where it came from and who maintains it.
4. Data and model poisoning
What it is: bad data gets into training, fine-tuning or the documents a model looks things up in, and quietly changes its answers.
Check: control who can add or change the data your AI system learns from or searches.
5. Improper output handling
What it is: the model's output is passed straight into a web page, a database query, a shell command or another system without checks, so a crafted answer becomes an attack.
Check: treat model output like any other untrusted user input: validate and escape it before using it.
6. Excessive agency
What it is: the model has been given more tools, permissions or freedom than the task needs, so a mistake or an injected instruction can do real damage, such as sending emails, changing records or making payments.
Check: give each AI feature the smallest set of permissions it needs, and require a person to approve high-impact actions.
7. System prompt leakage
What it is: the hidden instructions you give the model can be extracted. That is a problem if they contain secrets, internal rules or credentials.
Check: never put passwords, keys or anything confidential in a system prompt. Enforce rules in your code, not only in the prompt.
8. Vector and embedding weaknesses
What it is: systems that look up documents to answer questions (retrieval-augmented generation, or RAG) can return documents a user shouldn't see, or be fed misleading ones.
Check: apply the same access rules to document search as to the documents themselves.
9. Misinformation
What it is: the model states something false with confidence, and people or systems act on it.
Check: show sources for answers where you can, and keep a person in the loop for anything with legal, financial or safety consequences.
10. Unbounded consumption
What it is: heavy or malicious use runs up costs or slows the service down, for example very long inputs, automated requests, or attempts to copy the model's behaviour.
Check: set limits per user and per request, and alert on unusual spend.
Where to start
You don't need to address all ten at once. For most businesses adding AI to an existing product, three habits cover a lot of ground:
- Treat everything the model reads, and everything it writes, as untrusted.
- Give each AI feature the least access it needs.
- Keep a person in the loop for anything that matters.
The risks in this list sit alongside, not instead of, the usual web and API risks. An AI feature on an insecure application is still an insecure application.
If you would like a second pair of eyes, Application security includes testing AI features against this list alongside the rest of your application.
Sources
Want help implementing this?
Book a free 30-minute call about your business. No obligation.