In one sentence: The OWASP Top 10 for LLM applications is a public list of the ten most important security risks in software built on large language models, the technology behind AI chatbots and assistants.

What it is

A large language model (LLM) is an AI system trained on large amounts of text that answers questions in plain language. Businesses now build chatbots, search tools and assistants on top of them.

OWASP publishes the well-known Top 10 for web applications. Its Gen AI Security Project publishes a separate Top 10 of risks, vulnerabilities and mitigations for developing and securing generative AI and LLM applications across the development, deployment and management lifecycle. The latest edition is dated 2025.

It is an awareness list for developers and managers, not a legal standard.

How it works

The 2025 list names ten risks:

1. LLM01 Prompt Injection. User prompts alter the model’s behaviour in unintended ways, even if the input is not visible to humans.
2. LLM02 Sensitive Information Disclosure. Private data can leak from the model or its application.
3. LLM03 Supply Chain. Models, data and components from outside can carry vulnerabilities.
4. LLM04 Data and Model Poisoning. Pre-training, fine-tuning or embedding data is tampered with.
5. LLM05 Improper Output Handling. Model output is passed on without enough validation or sanitisation.
6. LLM06 Excessive Agency. The system is given too much ability to act.
7. LLM07 System Prompt Leakage. Hidden instructions are exposed.
8. LLM08 Vector and Embedding Weaknesses. Weaknesses in the stores that feed the model extra data.
9. LLM09 Misinformation. The model produces false output that people rely on.
10. LLM10 Unbounded Consumption. The model is made to use excessive resources.

Who it affects and how badly

Anyone who deploys an AI assistant, or whose staff paste company data into one.

• Sole trader to 10 staff: sensitive information going into public AI tools, and a customer chatbot saying something wrong.
• 10 to 50 staff: recruitment, accountancy and legal firms using AI to summarise documents risk exposing client information.
• 50 to 250 staff: SaaS start-ups embedding LLMs in products face prompt injection, excessive agency and unbounded consumption (a surprise bill or outage).
• Regulated businesses: fintech, insurance and healthcare must show control over personal data and decisions made with AI.

Real examples

• Air Canada chatbot, 2024. A British Columbia tribunal decided in Moffatt v. Air Canada that the airline was liable for negligent misrepresentation after its website chatbot gave a customer wrong information about bereavement fares. Air Canada argued the chatbot was a separate entity responsible for its own actions. The tribunal found the chatbot was part of the website and that Air Canada had not taken reasonable care to ensure it was accurate. This is an example of the misinformation risk (LLM09), and it was a small-claims decision.

How to detect it

• Keep logs of prompts, responses and any actions the assistant takes, and review unusual ones.
• Test the assistant with safe prompts, such as asking it to reveal its instructions. Only test systems you own or have permission to test.
• Track usage and cost, so a spike from unbounded consumption is noticed.
• Compare each risk on the list with your own design, and record the gaps.

How to fix or prevent it

1. Give the model only the access it needs, and require human approval for risky actions (OWASP excessive agency and prompt injection guidance).
2. Constrain model behaviour with specific instructions, remembering OWASP’s warning that no fool-proof prevention is known.
3. Validate and sanitise model output before another system uses it.
4. Keep secrets, personal data and credentials out of prompts and system instructions.
5. Vet third-party models and plug-ins as you would any supplier, and set spending alerts.
6. Run regular penetration tests and attack simulations, treating the model as an untrusted user (OWASP).

Related terms

• prompt injection
• indirect prompt injection
• owasp top 10
• supply chain attack
• data exfiltration
• penetration testing methodology

Frequently asked questions

Is the OWASP LLM Top 10 a legal requirement?
No. It is an awareness list published by OWASP. It helps teams find and discuss the main risks.

Which risk is listed first?
LLM01 Prompt Injection, where user prompts alter the model’s behaviour in unintended ways.

Who was held responsible in the Air Canada chatbot case?
The tribunal held Air Canada responsible for what its website chatbot said, rejecting the argument that the chatbot was a separate entity.

Sources

• OWASP Gen AI Security Project, 2025 Top 10 for LLM applications: https://genai.owasp.org/llm-top-10/
• OWASP LLM01:2025 Prompt Injection: https://genai.owasp.org/llmrisk/llm01-prompt-injection/
• Civil Resolution Tribunal of British Columbia, Moffatt v. Air Canada, 2024 BCCRT 149: https://www.canlii.org/en/bc/bccrt/doc/2024/2024bccrt149/2024bccrt149.html

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan.