Generative AI is rapidly becoming part of the enterprise technology stack. Organizations are embedding large language models into customer service platforms, knowledge assistants, software development tools, document analysis systems, and automated business processes.
However, an AI application introduces risks that are not fully addressed by traditional application security controls. Large language models interpret natural-language instructions, retrieve information from multiple sources, generate unpredictable outputs, and increasingly interact with external tools. In agentic AI environments, they may also execute actions with limited human intervention.
The OWASP Top 10 for LLM Applications provides a practical framework for understanding these emerging threats. The current 2025 version identifies ten critical risk categories affecting LLM and generative AI applications throughout their design, development, deployment, and operational lifecycle.
The framework does not suggest that every organization will experience every risk in the same way. Instead, it gives security leaders, developers, data scientists, and governance teams a shared vocabulary for conducting threat modeling, designing controls, and prioritizing AI security investments.
Traditional applications generally separate instructions, code, and data. An LLM processes all three through natural-language context, making it more difficult to distinguish legitimate content from malicious instructions.
An enterprise assistant might process a user prompt, retrieve documents from vector databases, call an external plugin, and return generated content to a web application. A weakness at any point in that chain could result in sensitive information disclosure, unauthorized actions, cross-site scripting, remote code execution, or excessive operational costs.
The OWASP Top 10 for LLM Applications helps organizations examine the complete AI application rather than focusing only on the underlying model. This includes:
Effective AI security therefore requires layered controls across the model, application, data, infrastructure, and human decision-making processes.
LLM01: Prompt Injection occurs when an instruction changes an LLM’s intended behavior or causes it to ignore its original rules. OWASP distinguishes between direct attacks, where a user deliberately submits malicious instructions, and indirect prompt injection, where the model encounters hostile content inside a document, website, email, image, or external data source.
A direct attack may tell the model to disregard its security policy and reveal protected information. An indirect attack may hide instructions inside a document retrieved by a knowledge assistant.
Prompt injection is especially dangerous when the AI application can access sensitive information or invoke external tools. In an agentic AI system, a manipulated prompt could potentially trigger unauthorized emails, database modifications, file downloads, or financial transactions.
Jailbreaking is related but not identical. Jailbreaking generally attempts to bypass behavioral or safety restrictions, while prompt injection targets the instructions and context used by an application.
No single control can completely eliminate prompt injection. Organizations should combine several mitigation strategies:
Input validation is useful, but it should not be treated as a complete defense. Malicious instructions can appear in many formats and may not resemble conventional attack strings.
Sensitive information disclosure occurs when an LLM reveals confidential, regulated, proprietary, or personally identifiable information.
The exposed information may come from:
An AI assistant may unintentionally reveal customer records, credentials, source code, internal policies, or proprietary business information if access controls and data governance are weak.
Sensitive information disclosure can also occur when users submit confidential information to an unauthorized generative AI service.
Organizations should:
Data security must be designed into the application rather than added after deployment.
Modern AI systems depend on complex supply chains. These may include pre-trained models, open-source libraries, datasets, APIs, hosting platforms, vector databases, fine-tuning adapters, and third-party plugins.
OWASP notes that supply chain vulnerabilities can compromise the integrity of models, training data, and deployment platforms. The risk extends beyond conventional software dependencies because organizations may also rely on external datasets, community models, LoRA adapters, and machine-learning repositories.
A compromised model could contain backdoors. A poisoned dataset could manipulate results. A malicious dependency could introduce model theft or remote code execution.
Organizations should:
A traditional software bill of materials is helpful, but AI environments may also require an inventory of models, data sources, prompts, connectors, and fine-tuning components.
Data and model poisoning occurs when attackers manipulate training, fine-tuning, or retrieval data to influence model behavior.
Training data poisoning may introduce biased, misleading, or malicious examples into a dataset. Fine-tuning can amplify these effects if the organization uses poorly validated data. Poisoned information in a retrieval-augmented generation system may repeatedly influence responses without changing the base model.
Attackers may use poisoning to create backdoors, spread misinformation, reduce model quality, or trigger specific behavior under certain conditions.
Organizations should:
Data quality is not only an accuracy issue. It is also an AI security requirement.
Improper output handling occurs when an application trusts generated content without sufficient validation, sanitization, or encoding.
An LLM may produce HTML, JavaScript, SQL, shell commands, API calls, or application code. If the receiving application executes or renders that content directly, an attacker may be able to trigger:
Insecure output handling is especially dangerous when generated content is inserted directly into a website, database query, terminal, or automation workflow.
Organizations should treat every LLM response as untrusted input.
Recommended controls include:
Sanitization should be applied at the point where the output is consumed. A response intended for HTML requires different handling from one used in a database query or operating-system command.
Excessive agency occurs when an LLM-based system has more functionality, permissions, or autonomy than it needs.
This risk is increasingly important as organizations deploy AI agents capable of accessing files, sending messages, modifying records, creating accounts, or executing workflows. OWASP expanded this category in response to the growing use of agentic architectures and tools.
Excessive agency may result from:
An agent that only needs to read a calendar should not have permission to delete events or send email.
Organizations should:
Agentic AI must be governed as an operational identity, not merely as a chatbot.
System prompt leakage occurs when an application reveals hidden instructions used to guide the model.
A system prompt may contain:
Organizations should assume that system prompts may eventually become visible to users or attackers. OWASP specifically warns against treating a system prompt as a secure location for secrets or authorization logic.
Organizations should:
System prompts should guide behavior, not serve as a security boundary.
Vector and embedding weaknesses affect systems that use embeddings and vector databases to retrieve relevant content.
In retrieval-augmented generation, documents are converted into vectors and stored for semantic search. Weak access controls, poor tenant isolation, poisoned documents, or insecure retrieval logic may expose sensitive records or manipulate model responses.
Potential problems include:
Organizations should:
Retrieval-augmented generation should never bypass the organization’s underlying access governance.
Misinformation occurs when an LLM generates false, inaccurate, misleading, or unsupported content.
This risk includes hallucinations, where the model produces plausible but incorrect information. Overreliance becomes dangerous when users or automated systems accept those outputs without independent verification.
Misinformation can affect:
Organizations should:
A human-in-the-loop process is particularly important when an output can affect people, finances, compliance, or safety.
Unbounded consumption occurs when an AI application allows excessive or uncontrolled use of model resources.
The risk may result in:
Attackers may intentionally submit long prompts, trigger repeated requests, create recursive agent loops, or force expensive operations.
Organizations should:
Cost monitoring should be treated as a security control because financial exhaustion can disrupt service just as effectively as a technical denial of service.
The OWASP categories demonstrate that securing an AI application requires more than securing an API endpoint or selecting a reputable model provider.
Organizations should adopt a lifecycle approach that includes:
Threat modeling should evaluate:
The analysis should consider both malicious attacks and unintended model behavior.
Organizations should not assume that a model will always follow instructions, produce accurate content, or protect confidential information.
Model responses, retrieved content, prompts, and tool calls all require validation.
Authorization, data protection, transaction limits, and business rules should be enforced by deterministic application controls rather than depending solely on natural-language instructions.
An agent should have only the tools and permissions required for its specific purpose. High-impact actions should require human approval.
Security teams should monitor:
Pre-trained models, fine-tuning data, LoRA adapters, vector databases, APIs, plugins, and infrastructure providers should all be included in vendor and supply chain risk management.
The OWASP Top 10 for LLM Applications is an essential starting point, but organizations should not use it only as a compliance checklist.
The framework is most valuable when its risks are translated into:
Prompt injection, excessive agency, sensitive information disclosure, supply chain vulnerabilities, and unbounded consumption demonstrate why AI systems need controls that extend beyond conventional application security.
Organizations that combine OWASP guidance with effective governance, threat modeling, access controls, data protection, human oversight, and operational monitoring will be better positioned to deploy large language models securely.
The goal is not to eliminate every possible risk before adopting AI. It is to understand the risks, establish practical mitigation strategies, and create an AI security program capable of evolving as models, applications, and threats continue to change.