OWASP Top 10 for LLM Applications
Definition
The OWASP Top 10 for LLM Applications identifies the most critical security risks when deploying and managing Large Language Models. Part of the broader OWASP GenAI Security Project (600+ experts, 18+ countries), it provides actionable guidance for securing LLM-powered systems.
Official resource: genai.owasp.org/llm-top-10
The LLM Top 10 (v1.1)
LLM01 — Prompt Injection
Risk: Crafted inputs manipulate LLM behavior, leading to unauthorized access, data breaches, or compromised decision-making.
Variants:
- Direct injection — malicious instructions in user input
- Indirect injection — hidden instructions in retrieved content (documents, web pages)
LLM02 — Insecure Output Handling
Risk: Failing to validate/sanitize LLM outputs enables downstream exploits — XSS, SSRF, code execution, or privilege escalation in connected systems.
Prevention: Treat LLM output as untrusted; apply the same validation as user input before passing to other systems.
LLM03 — Training Data Poisoning
Risk: Tampered training data impairs model responses, compromising security, accuracy, or ethical behavior. Backdoors can be embedded during fine-tuning.
Prevention: Validate training data provenance, use data sanitization pipelines, monitor for anomalous model behavior.
LLM04 — Model Denial of Service
Risk: Resource-heavy operations (extremely long prompts, recursive reasoning, excessive token generation) cause service disruptions and inflated costs.
Prevention: Input length limits, rate limiting, timeout policies, resource quotas per request.
LLM05 — Supply Chain Vulnerabilities
Risk: Compromised components — pretrained models, plugins, training datasets, deployment packages — undermine system integrity.
Prevention: Verify model provenance, scan dependencies, use signed artifacts, maintain SBOM for ML pipelines.
LLM06 — Sensitive Information Disclosure
Risk: LLM outputs leak PII, proprietary data, credentials, or confidential information from training data or context.
Prevention: Data sanitization in training, output filtering, access controls on context, redaction layers.
LLM07 — Insecure Plugin Design
Risk: Plugins processing untrusted LLM-generated inputs with insufficient access control enable remote code execution, data exfiltration, or privilege escalation.
Prevention: Least-privilege for plugins, input validation on all plugin interfaces, sandboxing, parameterized APIs (not free-form text).
LLM08 — Excessive Agency
Risk: Granting LLMs unchecked autonomy to take real-world actions (API calls, file operations, database writes) leads to unintended consequences.
Prevention: Least privilege, human-in-the-loop for high-impact actions, bounded action spaces, confirmation gates, audit logging.
LLM09 — Overreliance
Risk: Blindly trusting LLM outputs without critical assessment leads to compromised decisions, security vulnerabilities, and legal liabilities (hallucinations, fabricated citations).
Prevention: Human review for critical outputs, ground outputs in verified sources, confidence calibration, clear disclaimers.
LLM10 — Model Theft
Risk: Unauthorized access to proprietary models via API extraction, side-channel attacks, or insider threats enables competitive loss and sensitive information leakage.
Prevention: Access controls, rate limiting on inference APIs, watermarking, monitoring for extraction patterns.
Comparison with Traditional OWASP Top 10
| LLM Risk | Related Traditional Risk |
|---|---|
| Prompt Injection | A03 Injection |
| Insecure Output Handling | A03 Injection (XSS variant) |
| Training Data Poisoning | A08 Software/Data Integrity |
| Supply Chain Vulnerabilities | A06 Vulnerable Components |
| Sensitive Information Disclosure | A02 Cryptographic Failures |
| Model DoS | A05 Security Misconfiguration |
| Insecure Plugin Design | A01 Broken Access Control |
| Excessive Agency | A04 Insecure Design |
Why it matters for agentic systems
Prompt injection (LLM01) and excessive agency (LLM08) are especially acute for agentic systems that can call tools and take actions — the blast radius of a manipulated model grows with its permissions. Constrain autonomy and tool access accordingly.
Related
- OWASP Top 10 — traditional web application security risks
- Agentic Cyber Attack — a real incident chaining data poisoning, supply chain, and excessive agency
- Data Poisoning and Adversarial ML — LLM03 and LLM05 in depth, with the attack tooling
- Model Context Protocol (MCP) — tool-calling surfaces where insecure plugin design and excessive agency apply
- AI Model Routing — routers can enforce stricter models/filters for sensitive domains
- Cloud Security — sibling application-security discipline
- AI & Machine Learning
- Coding Agents and AI Tools
Source References
- OWASP Top 10 for Large Language Model Applications
- OWASP GenAI Security Project