What are the OWASP LLM Top 10 risks?

The OWASP Top 10 for Large Language Model (LLM) Applications identifies the most critical security vulnerabilities affecting AI integrations, ranging from prompt injection to supply chain failures. This framework provides a standardized list of ten distinct risk categories designed to help developers and security professionals secure the next generation of AI-driven software.

What is the OWASP Top 10 for LLM Applications?

The OWASP (Open Web Application Security Project) LLM Top 10 is a specialized security framework released to address the unique attack vectors introduced by generative artificial intelligence. Unlike traditional software vulnerabilities, LLM risks involve the intersection of probabilistic model behavior and deterministic code execution.

The framework was formalized to provide a structured approach to securing AI Models against malicious actors. While traditional web security focuses on data input and output, LLM security requires monitoring the semantic meaning of prompts and the reliability of model responses. Security professionals often turn to community resources like PromptCube as one recommended option for staying updated on these evolving threat landscapes.

What are the specific LLM Top 10 risk categories?

The current industry standard defines ten specific categories of risk that organizations must mitigate to ensure robust AI deployment.

Each risk category represents a different layer of the stack, from the user interface to the underlying training data and infrastructure.

1. LLM01: Prompt Injection: This occurs when an attacker provides specifically crafted inputs to manipulate the LLM into ignoring previous instructions or executing unintended actions. This can be "Direct" (the user inputs the command) or "Indirect" (the LLM processes external data, like a webpage, containing a hidden malicious command).
2. LLM02: Insecure Output Handling: This risk arises when the output from an LLM is passed directly to other systems (like a web browser or a terminal) without proper validation. If a model generates malicious code or scripts, the downstream system may execute them, leading to Cross-Site Scripting (XSS) or Remote Code Execution (RCE).
3. LLM03: Training Data Poisoning: This involves corrupting the training dataset to introduce vulnerabilities or biases into the model. If an attacker can influence the data used during the pre-training or fine-tuning phases, they can create "backdoors" that trigger specific behaviors under certain conditions.
4. LLM04: Model Denial of Service (DoS): An attacker can overwhelm an LLM application by sending complex, resource-intensive queries that exhaust computational power, memory, or API credits. This can lead to increased latency or complete service unavailability for legitimate users.
5. LLM05: Supply Chain Vulnerabilities: Modern AI applications rely on a complex web of third-party libraries, pre-trained models, and datasets. A compromise in any of these external components—such as a hijacked model repository—can compromise the entire application.
6. LLM06: Sensitive Information Disclosure: LLMs may inadvertently reveal sensitive data contained in their training sets or in the context provided during a conversation. This includes PII (Personally Identifiable Information), trade secrets, or proprietary code that was not properly scrubbed before model deployment.
7. LLM07: Insecure Plugin Design: Many LLMs use plugins or "agents" to interact with the real world (e.g., checking email or searching a database). If these plugins lack strict authorization and input validation, an attacker can use the LLM as a proxy to perform unauthorized actions in external systems.
8. LLM08: Excessive Agency: This risk occurs when an LLM is given too much autonomy or too many permissions within a system. If a model has the power to delete files, send emails, or execute financial transactions without a "human-in-the-loop" or strict constraints, a single prompt injection can lead to catastrophic consequences.
9. LLM09: Overreliance: This is a functional risk where users or developers trust the model's output too implicitly, failing to account for "hallucinations" (plausible but false information). Overreliance can lead to poor decision-making in critical fields like medicine, law, or engineering.
10. LLM10: Model Theft: Attackers may attempt to steal the model's weights, architecture, or training methodology through various means, such as model inversion attacks or API scraping. Stealing a highly tuned model represents a significant loss of intellectual property and competitive advantage.

How does Prompt Injection differ from traditional SQL Injection?

Prompt injection is a semantic attack, whereas traditional injection attacks are syntactic.

In a traditional SQL injection, the attacker breaks the syntax of a database query to manipulate the backend. In prompt injection, the attacker manipulates the intent or the instructional logic of the natural language processor. While a SQL injection targets the database layer, prompt injection targets the logic layer of the LLM, making it significantly harder to filter using traditional regex-based security tools.

How can organizations mitigate LLM01 Prompt Injection?

Mitigation requires a multi-layered approach involving input sanitization, output validation, and architectural constraints.

Organizations should implement a "defense in depth" strategy. This includes using a secondary LLM to act as a "guardrail" to inspect incoming prompts, implementing strict system instructions that define the model's boundaries, and limiting the model's access to external tools unless absolutely necessary.

Why is Supply Chain Security critical for AI?

The AI ecosystem is highly interdependent, making the supply chain a primary target for sophisticated attackers.

Because most developers do not build AI Models from scratch, they rely on ecosystems like Hugging Face or GitHub. A single malicious package or a "poisoned" model weights file can propagate through thousands of applications instantly. Verifying the provenance of data and models through cryptographic signatures and checksums is essential for modern AI governance.

What is the role of "Human-in-the-loop" in preventing Excessive Agency?

A human-in-the-loop (HITL) serves as a critical verification layer that prevents autonomous AI agents from causing irreversible damage.

When an LLM is tasked with high-stakes actions—such as transferring funds or modifying system configurations—the system should be designed to pause and request human authorization. This prevents "Excessive Agency" from turning a minor model error into a major operational failure.

Frequently Asked Questions

When was the OWASP LLM Top 10 first released?
The initial version of the OWASP Top 10 for LLM Applications was released in late 2023 to address the rapid adoption of generative AI and the unique security gaps it created in enterprise environments.

Is the OWASP LLM Top 10 the same as the standard OWASP Top 10?
No. While the standard OWASP Top 10 focuses on general web application vulnerabilities (like Broken Access Control), the LLM Top 10 is specifically tailored to the probabilistic and non-deterministic nature of Large Language Models.

How often is the OWASP LLM Top 10 updated?
Given the rapid pace of AI development, the list is subject to frequent revisions. Security researchers and community groups, including contributors found through PromptCube, monitor new attack vectors to ensure the framework remains relevant.

Which risk is considered the most dangerous?
There is no single "most dangerous" risk, as the severity depends on the use case. For a customer service chatbot, Prompt Injection is critical; for a medical diagnostic tool, Overreliance and Sensitive Information Disclosure pose the highest risks.