The OWASP Top 10 for LLM Applications 2025
The ten risks every AI feature review should cover, and the first control for each.
Why a shared list helps
Security reviews go faster when engineers, product managers and customers use the same vocabulary. The OWASP Top 10 for LLM applications, updated for 2025, is the most widely used list of risks for features built on large language models. It suits SaaS teams because enterprise buyers increasingly ask about it in security questionnaires.
The ten risks
The 2025 list runs from LLM01 to LLM10. Each needs at least one named control before a feature ships.
- LLM01 Prompt Injection
- LLM02 Sensitive Information Disclosure
- LLM03 Supply Chain
- LLM04 Data and Model Poisoning
- LLM05 Improper Output Handling
- LLM06 Excessive Agency
- LLM07 System Prompt Leakage
- LLM08 Vector and Embedding Weaknesses
- LLM09 Misinformation
- LLM10 Unbounded Consumption
Using the list in reviews
For each AI feature, write one line per risk: does it apply, what control is in place, and how it is tested. Store the review with the feature's design document so it is updated when prompts, tools or models change.
- Use the OWASP LLM Top 10 2025 as the review checklist.
- Every risk needs a named control and a test.
- Update the review when prompts, tools or models change.
Pick one AI feature in your product and write a one-line control for each of the ten OWASP risks.
Check your understanding
1. Which risk is LLM01 in the 2025 OWASP list?
2. What does LLM06 cover?
3. When should an AI feature's review be updated?
From USD 49 or INR 2,999 a month. A person approves every step.