Enterprise Security in the Agentic AI Era

OWASP Top 10 for LLM Applications

4 min read

OWASP Top 10 for LLM Applications

The OWASP Top 10 for LLM Applications is the primary vulnerability awareness list for large language model deployments. The 2025 edition (released November 2024) ranks Prompt Injection as the #1 risk, with only three categories surviving unchanged from 2023, reflecting rapid threat evolution.

2025 Edition Changes

New additions compared to 2023:

  • System Prompt Leakage: exposure of confidential system instructions
  • Vector and Embedding Weaknesses (LLM08:2025): RAG system-specific attack surface
  • Excessive Agency: agentic architecture risks (addressed more fully in the ASI Top 10)

Verified category set (2025 edition)

Codes and titles verified against genai.owasp.org/llm-top-10 (retrieved 2026-06-22) by the LLM Top 10 standards review.

CodeTitle
LLM01:2025Prompt Injection
LLM02:2025Sensitive Information Disclosure
LLM03:2025Supply Chain
LLM04:2025Data and Model Poisoning
LLM05:2025Improper Output Handling
LLM06:2025Excessive Agency
LLM07:2025System Prompt Leakage
LLM08:2025Vector and Embedding Weaknesses
LLM09:2025Misinformation
LLM10:2025Unbounded Consumption

The OWASP AI Exchange covers the same threat as LLM10:2025 Unbounded Consumption under the name AI resource exhaustion, and gives it two threat-specific controls, DOS INPUT VALIDATION and LIMIT RESOURCES (/go/airesourceexhaustion/). The correspondence stated here is this wiki’s mapping. The Exchange cites this list by identifier elsewhere in the same document, and the wiki records three of those identifiers as unreconciled: LLM10:2026 for Improper Output Handling, LLM08 for a category that is live as Vector and Embedding Weaknesses, and a 2026 edition year for Sensitive Information Disclosure. Each is attributed to the Exchange on the page that carries the mapping.

Current Status (Q1 2026)

As of April 2026, the LLM Top 10 2025 is unchanged. A 2026 community questionnaire suggests a future update is under development, but no timeline has been announced.

The LLM Top 10 has been complemented rather than superseded by the Agentic Applications Top 10 (December 2025), which handles the agentic risk classes that the LLM Top 10 was not designed to address (multi-agent orchestration, cascading failures, rogue agents).

The ML Security Top 10 remains dormant at v0.3, creating a gap in traditional ML security coverage.

Adoption

Translated into 10+ languages. Vendor integrations by Kong, Lakera (acquired by Check Point Q1 2026), Invicti, and others. Referenced in enterprise security policies worldwide.

Strengths

  • De facto reference list for LLM application security
  • Widely adopted; translated into many languages
  • Actionable awareness for development teams
  • Prompt injection coverage has informed a generation of defensive tooling

Gaps and Shortcomings

  • Awareness framework, not compliance standard: no certification, audit procedures, or evidence criteria
  • Does not address agentic-specific risk classes (handled by OWASP Top 10 for Agentic Applications (ASI Top 10))
  • Risk descriptions, not control baselines: organizations cannot directly derive a test plan
  • ML Security Top 10 (v0.3 draft) is dormant, leaving traditional ML security coverage thin
  • No AI incident response playbooks or IoCs
  • OWASP states the incompleteness is deliberate. The OWASP AI Exchange, the other OWASP flagship AI project, positions the list as a route to quick awareness and states that it is intentionally not complete, naming the security of prompts as one omission; it directs readers seeking full coverage to the Exchange and readers seeking verification against technical requirements to the OWASP AISVS (/go/aiatowasp/). Treating the list as a coverage baseline reads it against its stated purpose.

See Also

Sources

Graph View

Backlinks