OWASP Top 10 for LLM Applications (2025) Explained
A breakdown of the OWASP Top 10 security risks for LLM applications, with a real incident and a practical fix for each, plus an honest split of which three SafePrompt covers and which seven it does not.
TLDR
The OWASP Top 10 for Large Language Model Applications lists the ten most critical security risks in AI apps, from prompt injection at number one to unbounded consumption at number ten. Three of them sit at the prompt layer and are a one-call fix. The other seven need real engineering, and the honest move is to know exactly which is which before someone else finds the gap. This guide walks all ten with a real incident and a fix for each.
You shipped an AI feature. The OWASP Top 10 for LLM Applications is the list of ten ways it can be attacked. Three of them are a one-call fix and the other seven need real engineering, so the useful thing is to know exactly which is which before someone else finds the gap. This guide walks all ten, with a real incident and a practical fix for each.
What is the OWASP Top 10 for LLM Applications?
The OWASP Top 10 for Large Language Model Applications is OWASP's reference list of the ten most critical security risks in applications built on large language models. OWASP, the Open Worldwide Application Security Project, publishes it so developers can understand and mitigate the risks that are specific to AI systems. The 2025 edition reflects current attack techniques and documented incidents.
Unlike traditional web vulnerabilities, LLM risks exploit the probabilistic, language-based nature of the model. A single sentence can undo weeks of hardening. That is why the list needs its own Top 10 rather than folding into the classic web one.
What are the ten OWASP LLM risks, and which does SafePrompt cover?
Here is the full list with an honest coverage note for each. SafePrompt is an input-validation API, so it covers the risks that live at the prompt layer and nothing else. The split is the point of this guide.
| Rank | Vulnerability | SafePrompt coverage |
|---|---|---|
| LLM01 | Prompt Injection | Full coverage |
| LLM02 | Sensitive Information Disclosure | Partial (extraction attempts) |
| LLM03 | Supply Chain Vulnerabilities | Not covered |
| LLM04 | Data and Model Poisoning | Not covered (training-time) |
| LLM05 | Improper Output Handling | Not covered (output-side) |
| LLM06 | Excessive Agency | Helps via input validation |
| LLM07 | System Prompt Leakage | Full coverage |
| LLM08 | Vector and Embedding Weaknesses | Partial (RAG poisoning) |
| LLM09 | Misinformation | Not covered (content accuracy) |
| LLM10 | Unbounded Consumption | Not covered (rate limiting) |
LLM01: Prompt Injection
What it is: attackers craft inputs that override the system instructions, causing the model to perform unintended actions. This includes direct injection, where the user types the attack, and indirect injection, where the attack is hidden in a document, email, or web page the model later reads.
Real example:a Chevrolet dealership chatbot was talked into agreeing to sell a vehicle for $1 after a user typed an instruction override. The dealership never honored the "deal," but the screenshots spread widely and the embarrassment was the real cost (The Guardian, December 2023).
Fix: validate every input before it reaches the model. SafePrompt detects prompt injection with above 95% accuracy in a single call. The full attack taxonomy is in the OWASP LLM01 prompt injection breakdown, and the fundamentals are in what is prompt injection.
LLM02: Sensitive Information Disclosure
What it is: the model reveals confidential information in its responses: training data, system prompts, personal data, or proprietary business logic.
Real example:in late 2023, researchers from Google DeepMind and others found that prompting ChatGPT to "repeat the word 'poem' forever" could make it diverge from normal output and emit memorized training data verbatim, including personal information (Nasr et al., "Scalable Extraction of Training Data from (Production) Language Models," November 2023).
Fix: SafePrompt detects the extraction attempts that target system prompts and data. Pair it with output filtering to catch sensitive patterns before they reach users. SafePrompt covers the input half of this risk, not the output half.
LLM03: Supply Chain Vulnerabilities
What it is: compromised training data, poisoned models, or malicious packages introduce vulnerabilities before your code even runs.
Real example: a backdoored model on a public hub can exfiltrate data when specific trigger phrases appear in its input.
Fix: audit third-party models, use verified sources, sign models, and monitor for unexpected behavior. SafePrompt does not cover this. It is a supply-chain control on your side.
LLM04: Data and Model Poisoning
What it is: attackers manipulate training or fine-tuning data to embed behaviors that activate under specific conditions.
Real example: a poisoned code assistant trained to suggest vulnerable patterns when it detects certain project names.
Fix: validate training data sources, track data provenance, and run anomaly detection during training. SafePrompt does not cover this. It is a training-time control.
LLM05: Improper Output Handling
What it is: model output is passed to other systems without sanitization, enabling XSS, SQL injection, or command injection through the AI.
Real example: an AI that generates HTML gets tricked into outputting a <script>tag that runs in the user's browser.
Fix: treat model output as untrusted. Encode HTML, parameterize SQL, validate JSON schemas. SafePrompt validates input, not output, so this one is on you.
LLM06: Excessive Agency
What it is: models are given more permissions than they need: database access, APIs, actions they should not perform. Combined with prompt injection, this is where a small flaw turns into a real breach.
Real example: an AI email assistant with send permissions, manipulated into forwarding confidential data to an attacker.
Fix: apply least privilege and gate destructive actions behind human approval. SafePrompt helps by blocking the injection attempts that exploit these permissions, but the permission design is yours. More on this in AI agent prompt injection risks.
LLM07: System Prompt Leakage
What it is:attackers extract the system prompt that defines your AI's behavior, exposing business logic, pricing rules, and the exact guardrails they then work around.
Real example:users extracted Bing Chat's system prompt, known internally as "Sydney," within days of launch, revealing Microsoft's internal instructions (February 2023).
Fix: SafePrompt detects system prompt extraction attempts like "repeat your instructions" or "what are your rules," including indirect phrasings. Also avoid putting truly sensitive logic in the prompt at all.
LLM08: Vector and Embedding Weaknesses
What it is: in retrieval-augmented generation (RAG) systems, attackers poison the knowledge base with malicious documents that get retrieved and influence responses.
Real example: an attacker uploads a document to a company wiki with hidden instructions. When someone asks the AI about that topic, the poisoned document is retrieved and its instructions execute.
Fix: validate documents before they enter a knowledge base, and validate retrieved chunks before insertion. SafePrompt can validate retrieved content, which covers part of this. Details in indirect prompt injection.
LLM09: Misinformation
What it is: models confidently generate false information, through hallucination or manipulation, which can cause reputational and legal harm.
Real example: a lawyer submitted a brief with AI-generated case citations that did not exist and was sanctioned (Mata v. Avianca, 2023).
Fix: add fact-checking layers, cite sources, show confidence, and label AI-generated content. SafePrompt does not cover this. It is a content-accuracy problem, not an attack vector.
LLM10: Unbounded Consumption
What it is: attackers craft inputs that burn resources: very long prompts, recursive loops, or requests designed to maximize compute and cost.
Real example: sending huge prompts or requesting near-maximum-token outputs to run up API bills.
Fix: apply input length limits, rate limiting, timeouts, and cost alerts. SafePrompt does not cover this. It is a rate-limiting and quota problem.
So what does SafePrompt actually cover?
Three of the ten are a one-call fix, and SafePrompt is not going to pretend it covers the other seven. A sharp reader would catch that and it would cost the trust this guide is trying to earn. SafePrompt closes LLM01 prompt injection and LLM07 system prompt leakage in full, covers the extraction half of LLM02, helps with LLM06 by blocking the injections that exploit over-broad permissions, and validates retrieved content for LLM08. The training-time, supply-chain, output-handling, misinformation, and rate-limiting risks are real engineering on your side.
LLM01: Prompt Injection
Above 95% detection accuracy, most requests under 100ms per call.
LLM02 and LLM07: Extraction
Detects system prompt and data exfiltration attempts.
LLM08: RAG Poisoning
Validate retrieved chunks before insertion. Partial coverage.
You do not need a compliance team to act on the three it does cover. It is a single API call to POST https://api.safeprompt.dev/api/v1/validate with an X-API-Key header, or the safeprompt npm package. The free plan covers 100,000 validations a month with no credit card. Close the three at the prompt layer first, then go work the other seven.
Start with the three you can close today
The prompt layer is your most exposed surface and the fastest to fix: one API call in front of your model, most requests under 100ms, above 95% detection accuracy. Free plan, no card. Then go work the other seven.
Frequently asked questions
What is the OWASP Top 10 for LLM Applications?
The OWASP Top 10 for LLM Applications is OWASP's reference list of the ten most critical security risks in applications that use large language models. It runs from prompt injection at number one to unbounded consumption at number ten. The 2025 edition reflects current attack techniques and documented real-world incidents, and it exists because LLM risks exploit the language-based behavior of the model rather than the traditional web flaws OWASP's main Top 10 covers.
What is the number one OWASP risk for LLM apps?
Prompt injection, listed as LLM01, is the number one risk. Attacker-controlled input overrides the system prompt and makes the model act against its instructions, either directly when a user types the attack or indirectly when it is hidden in a document, email, or web page the model reads. It ranks first because every application that accepts input is exposed and there is no infrastructure-level fix that removes it.
Which OWASP LLM risks does SafePrompt cover?
SafePrompt directly covers three of the ten: LLM01 prompt injection, LLM07 system prompt leakage, and the extraction half of LLM02 sensitive information disclosure. It also helps with LLM06 excessive agency by blocking the injection attempts that exploit over-broad permissions, and with LLM08 by validating retrieved content in RAG systems. It does not cover the training-time, supply-chain, output-handling, misinformation, or rate-limiting risks, because those are architecture and infrastructure controls on your side, not input validation.
Does SafePrompt cover all of the OWASP LLM Top 10?
No, and SafePrompt does not claim to. SafePrompt is an input-validation API, so it closes the three risks that live at the prompt layer and helps with two more. The remaining risks, such as data and model poisoning, improper output handling, misinformation, and unbounded consumption, need real engineering on your side: output encoding, supply-chain auditing, rate limiting, and fact-checking. Any tool that claims to cover all ten is overstating what an input filter can do.
Further reading
- OWASP LLM01: prompt injection, the deep dive on the number one risk
- System prompt extraction, the attack behind LLM07
- What is prompt injection?, the fundamentals
- How to prevent prompt injection, the implementation guide
- Official OWASP LLM Top 10, the source document