The OWASP Top 10 for LLM Applications 2025
Evaluate LLM guardrail, testing and monitoring tools. Lesson 1, 18 min.
The OWASP Top 10 for LLM Applications is a list of the main risks for LLM and generative AI applications. The OWASP GenAI Security Project publishes it. It is not a standard, but it is a good base for a test plan. Ask every guardrail, red-teaming or testing vendor to map its tests to it, risk by risk.
The 2025 list and what to check
- LLM01 Prompt Injection: test direct injection and indirect injection through documents, web pages and tool output.
- LLM02 Sensitive Information Disclosure: the model must not reveal personal data, secrets or other users' data.
- LLM03 Supply Chain: models, datasets and packages come from trusted sources and are pinned.
- LLM04 Data and Model Poisoning: training, fine-tuning and retrieval data are controlled.
- LLM05 Improper Output Handling: output is validated before it reaches a browser, shell, database or API.
- LLM06 Excessive Agency: tools and permissions are the minimum the task needs.
- LLM07 System Prompt Leakage: no secrets or access rules live in the system prompt.
- LLM08 Vector and Embedding Weaknesses: retrieval respects user access rights.
- LLM09 Misinformation: answers are grounded, and users can check sources.
- LLM10 Unbounded Consumption: rate limits, quotas and cost alerts are set.
Which layer covers which risk
Do not expect one tool to cover all ten. A guardrail can screen inputs and outputs for LLM01, LLM02 and LLM07. Supply chain and poisoning risks need controls on how you source and pin models, data and packages. Excessive agency needs a permission review. Unbounded consumption needs rate limits and cost alerts. Ask each vendor which risks its product covers and which it does not.
Ask about the vendor's own product
Many governance and testing tools use LLMs inside the product. Ask how the vendor protects its own product against prompt injection and system prompt leakage.
Sources
- OWASP Top 10 for LLM Applications 2025, OWASP GenAI Security Project (genai.owasp.org/llm-top-10)
- AIGovernanceTools buyer guide: LLM deployment security and compliance checklist, updated 2026-10-29