The OWASP Top 10 for LLM Applications is a community-maintained list of the most critical security risks specific to apps built on large language…
See why LLM apps need their own security top-ten.
The OWASP Top 10 for LLM Applications catalogs the most critical security risks unique to systems built on large language models. OWASP is the same organization behind the famous web-app Top 10, and this list applies that proven format to a new attack surface.
LLM apps introduce risks traditional security wasn't built for: an input that is also an instruction, a model that can be tricked into leaking data, and outputs that flow into other systems. The list gives teams a shared vocabulary and a concrete checklist for these new threats.
Learn the three risks nearly every LLM app faces.
Prompt injection sits at the top: attacker instructions hidden in user input or in content the app fetches override its intended behavior. Sensitive information disclosure is the model revealing secrets — private data in its context, other users' information, or parts of its system prompt.
These pair dangerously: an injection can trick the model into disclosing data it shouldn't. Mitigations include least privilege on data access, keeping secrets out of the model's reach, and filtering both inputs and outputs.
Insecure output handling is treating model output as trusted and passing it, unsanitized, into another system. If a model's text is dropped into a web page, a shell command, or a database query, it can carry an attack — the same class as classic injection, but the payload now comes from the LLM.
The rule: treat model output as untrusted user input. Sanitize, encode, and validate it before it touches any other system.
Understand the risks that grow as LLMs gain tools and autonomy.
As LLMs gain tools and autonomy, excessive agency becomes a leading risk: an agent with too many permissions, too much tool access, or too much autonomy can cause real damage when it is manipulated or simply errs. The fix is least privilege — minimal tools and scopes — plus human approval for consequential actions.
This is why prompt injection is so serious in agents: a hijacked model with broad agency can act, not just talk.
Other listed risks include supply-chain threats (compromised models, datasets, or plugins from third parties), data and model poisoning, misinformation from hallucinations, system-prompt leakage, and unbounded consumption — where uncontrolled requests run up cost or cause denial of service. Rate limits, provenance checks, and monitoring address these.
Turn the Top 10 into a practical part of your workflow.
Use the Top 10 as a threat-modeling checklist before you ship. For each item, ask: can this happen in my app, and what is my mitigation? Trace where untrusted content enters, what data and tools the model can reach, and where its output flows. The exercise usually surfaces a missing guardrail or an over-broad permission.
It is a living list, revised as the field evolves, so revisit it periodically rather than treating one pass as permanent security.
Don't treat the list as a one-time box-tick: threats and the list both change. Don't rely on a single control (a prompt-level instruction alone won't stop injection). And don't forget output handling — teams guard inputs but pipe model output straight into other systems. Layer controls and test with real attack payloads.
The OWASP Top 10 for LLM Applications is the standard checklist of security risks unique to LLM apps. The headline risks — prompt injection, sensitive information disclosure, and insecure output handling — hit nearly every app, and agent-era risks like excessive agency, supply-chain threats, and unbounded consumption grow with tools and autonomy. Use it to threat-model each feature before shipping: trace untrusted input, data and tool access, and output flow, layer controls, and revisit as the list evolves.
Take an LLM feature that reads user emails and can send replies. Walk three OWASP LLM risks that apply, the specific mitigation for each, and identify the single place you would add output sanitization before the model's text leaves the system.
What is the OWASP Top 10 for LLM Applications?
It applies OWASP's proven risk-list format to the new attack surface of LLM apps, giving teams a shared checklist for threat-modeling.
What is insecure output handling?
Model output should be treated as untrusted input; unsanitized output flowing into web pages, shells, or queries enables downstream attacks.
What is excessive agency?
Excessive agency is mitigated with least privilege and human approval for consequential actions, which limits the blast radius of a hijacked agent.
How should you use the OWASP Top 10 for LLMs?
It is a living list best used to systematically threat-model each feature, layering controls rather than relying on any single one.