OWASP maintains a dedicated Top 10 for large language model applications, separate from the general web application list, because LLM-specific systems fail in ways that traditional web risk categories do not fully capture. A SQL injection checklist does not tell you anything about a retrieval pipeline leaking another tenant's documents through embedding similarity, or an agent with too much tool access taking an unintended action after a manipulated prompt. The 2025 revision of the list reorganized several categories based on real incident data gathered since the original 2023 release.
What changed in 2026
- System Prompt Leakage is now its own category, reflecting how often system prompts — sometimes containing business logic or credentials — get extracted through careful querying and then used to craft more effective attacks.
- Vector and Embedding Weaknesses joined the list, covering RAG-specific risks like embedding inversion and cross-tenant retrieval leakage in shared vector stores, a gap the original 2023 list did not address.
- Unbounded Consumption replaced the narrower Model Denial of Service category, broadening scope to cover cost-based attacks (denial-of-wallet) alongside pure availability attacks.
- Insecure Plugin Design and Model Theft dropped as standalone categories, with their concerns folded into Excessive Agency and Supply Chain, reflecting how "plugins" became "tools" in a broader agentic context.
- Misinformation replaced Overreliance, shifting the framing from a human-behavior problem to a model-output-quality problem that applications need to actively guard against.
The ten categories
| Rank |
Category |
What it covers |
| LLM01 |
Prompt Injection |
Crafted input, direct or via retrieved content, overrides the application's intended instructions |
| LLM02 |
Sensitive Information Disclosure |
Model reveals PII, secrets, or proprietary data from training data or context |
| LLM03 |
Supply Chain |
Compromised training data, pretrained models, or third-party tools and libraries in the pipeline |
| LLM04 |
Data and Model Poisoning |
Manipulated training or fine-tuning data introduces backdoors, bias, or degraded behavior |
| LLM05 |
Improper Output Handling |
Downstream systems trust model output without validation, enabling XSS, SSRF, or code execution |
| LLM06 |
Excessive Agency |
Model or agent granted more permissions, tools, or autonomy than the task requires |
| LLM07 |
System Prompt Leakage |
Attacker extracts the system prompt, exposing logic or embedded secrets |
| LLM08 |
Vector and Embedding Weaknesses |
RAG-specific risks: embedding inversion, unauthorized retrieval, cross-tenant leakage |
| LLM09 |
Misinformation |
Model produces plausible but false output that users or downstream systems over-trust |
| LLM10 |
Unbounded Consumption |
Uncontrolled resource or cost usage from expensive queries, denial-of-wallet, or denial-of-service |
Why this list needs to be read alongside the general Top 10
None of these ten categories retire standard web application risk. An LLM feature still runs inside a web application: it has authentication, authorization, logging, and dependencies, all covered by the general OWASP Top 10. LLM06, Excessive Agency, for instance, is really an access-control problem (A01 in the general list) applied to a new kind of principal — the model itself acting on a user's behalf. Reading the LLM list in isolation and assuming it replaces standard application security review is itself a category of the mistake OWASP is trying to prevent.
Common mistakes
Treating Prompt Injection as fully solvable. No current technique reliably prevents it; the realistic goal is limiting what an attacker gains if injection succeeds, through scoped permissions and output validation — see LLM security best practices for concrete controls.
Ignoring Vector and Embedding Weaknesses in multi-tenant RAG. A shared vector index without per-tenant filtering at query time can return another customer's documents in a similarity search, regardless of how careful the prompt is.
Granting broad tool access "to keep things flexible." Excessive Agency is rarely a deliberate decision — it accumulates as more tools get added to an agent without revisiting whether each one still needs the access it was given.
Skipping cost controls until a bill spikes. Unbounded Consumption is often discovered in a billing statement, not a security review — cap tokens, request rate, and context size per user before shipping, not after.
FAQ
Is the OWASP LLM Top 10 different from the general OWASP Top 10?
Yes, it is a separate list maintained for AI and LLM-specific risks, meant to complement rather than replace the general web application Top 10.
What is the single most exploited category?
Prompt Injection (LLM01), consistently, because it requires no special access, just the ability to influence any text the model reads.
Does using a well-known provider like OpenAI or Anthropic cover these risks?
No. Provider-level safety training reduces some risks but application-level issues — RAG access control, tool permission scope, output handling, cost caps — remain the deploying team's responsibility.
What is Excessive Agency in practice?
Giving an agent more standing permissions or autonomous action capability, like sending emails, executing code, or spending money, than the specific task requires, which turns a successful prompt injection into a real-world action instead of just bad text.
Where to go next