OWASP LLM Top 10 — the 10 most critical risks for LLM-powered applications (2025)

What it is

The OWASP Top 10 for Large Language Model Applications is a community-curated list of the most critical security risks specific to LLM-powered applications. The 2025 edition was published in late 2024 and is the current version as of mid-2026. It complements the regular OWASP Top 10 (which still applies to your auth, data, and infrastructure) by covering the LLM-specific bug classes: prompt injection, insecure output handling, training-data poisoning, model denial-of-service, supply chain, sensitive information disclosure, insecure plugin design, excessive agency, overreliance, and model theft.

Vulnerable example

// Vulnerable: a customer-support chatbot that hits LLM02 (insecure output handling)
import OpenAI from "openai";

const llm = new OpenAI();

export async function POST(req: Request) {
  const { question } = await req.json();
  const r = await llm.chat.completions.create({
    model: "gpt-4o-mini",
    messages: [
      { role: "system", content: "You are a customer support assistant." },
      { role: "user", content: question }, // LLM01 injection surface
    ],
  });
  // LLM02: raw LLM output rendered as HTML on the page
  return new Response(`<div>${r.choices[0].message.content}</div>`, {
    headers: { "content-type": "text/html" },
  });
  // The model can be coaxed into emitting <script> tags. Stored XSS via LLM.
}

Fixed example

import OpenAI from "openai";
import { sanitize } from "@securie/llm-safety";
import { escapeHtml } from "./escape";

const llm = new OpenAI();

export async function POST(req: Request) {
  const { question } = await req.json();

  // LLM01 defense: pre-classify input
  const cleanInput = sanitize.input(question);
  if (cleanInput.blocked) return new Response("blocked", { status: 400 });

  const r = await llm.chat.completions.create({
    model: "gpt-4o-mini",
    messages: [
      { role: "system", content: "You are a customer support assistant. Output plain text only." },
      { role: "user", content: cleanInput.text },
    ],
  });

  // LLM02 defense: never trust raw LLM output as HTML
  const safe = escapeHtml(r.choices[0].message.content ?? "");
  return Response.json({ answer: safe });
}

How Securie catches it

import OpenAI from "openai";
import { sanitize } from "@securie/llm-safety";
import { escapeHtml } from "./escape";

const llm = new OpenAI();

export async function POST(req: Request) {
  const { question } = await req.json();

  // LLM01 defense: pre-classify input
  const cleanInput = sanitize.input(question);
  if (cleanInput.blocked) return new Response("blocked", { status: 400 });

  const r = await llm.chat.completions.create({
    model: "gpt-4o-mini",
    messages: [
      { role: "system", content: "You are a customer support assistant. Output plain text only." },
      { role: "user", content: cleanInput.text },
    ],
  });

  // LLM02 defense: never trust raw LLM output as HTML
  const safe = escapeHtml(r.choices[0].message.content ?? "");
  return Response.json({ answer: safe });
}

Checklist

• LLM01 — Prompt injection: input sanitized + Llama Guard 4 input/output classifier wired
• LLM02 — Insecure output handling: LLM outputs are NEVER rendered as HTML / executed as SQL / eval'd without escaping
• LLM03 — Training data poisoning: every RAG-ingested document is poisoning-scored before reaching context
• LLM04 — Model denial-of-service: per-tenant compute caps + per-session sampling-call ceilings
• LLM05 — Supply-chain vulnerabilities: AIBOM emitted on every release + dependency-vuln scanned on every PR
• LLM06 — Sensitive info disclosure: prompt templates audited for hard-coded secrets / PII
• LLM07 — Insecure plugin design: tool catalogs scope-locked at credential issuance
• LLM08 — Excessive agency: agents have least-privilege scope; destructive tools require explicit approval
• LLM09 — Overreliance: confidence + provenance signals shown to users; audit log retains every decision
• LLM10 — Model theft: model artifacts signed (DSSE) + tenant-isolated; egress monitoring on training infra

FAQ

Related guides