LLM Security
OWASP Top 10 for LLM Applications
OWASP Top 10 for Large Language Model applications, covering prompt injection, data poisoning, supply chain vulnerabilities, and model security risks.
Select an Official Release Year
Pick a year to view release rankings, or switch to All Time for the cross-release top 10.
| Rank | Title | Summary | Details |
|---|---|---|---|
| #1 | Prompt Injection | Untrusted input can override instructions, manipulate tool usage, or redirect model behavior away from its intended policy boundaries. | View Details |
| #2 | Sensitive Information Disclosure | Models and surrounding systems can expose secrets, internal data, personal information, or hidden context during generation. | View Details |
| #3 | Supply Chain | Risk enters through models, datasets, plugins, packages, hosted services, and other dependencies that make up the LLM application stack. | View Details |
| #4 | Data and Model Poisoning | Training, fine-tuning, or retrieval data can be tampered with to corrupt outputs, bias behavior, or introduce hidden triggers. | View Details |
| #5 | Improper Output Handling | Treating model output as inherently safe can turn generated content into a direct path to downstream vulnerabilities. | View Details |
| #6 | Excessive Agency | Granting an LLM too much authority over tools, workflows, or business decisions expands the blast radius of mistakes and abuse. | View Details |
| #7 | System Prompt Leakage | Attackers may extract hidden instructions or privileged context that reveal internal behavior and weaken defenses. | View Details |
| #8 | Vector and Embedding Weaknesses | Embedding pipelines and vector stores can be manipulated or queried in ways that expose data or distort retrieval results. | View Details |
| #9 | Misinformation | Hallucinated or misleading responses can drive harmful decisions when applications over-trust the model's apparent confidence. | View Details |
| #10 | Unbounded Consumption | Without budget, token, or workload controls, attackers or misuse can create runaway compute and cost exposure. | View Details |