AI glossary · Basic · AI security
OWASP LLM Top 10
The OWASP LLM Top 10 is a list, compiled by the nonprofit security community OWASP, of 10 security risks that come up especially often and cause serious problems in apps and services that use LLMs.
About this term
- Level
- Basic · Technical terms you often meet in AI news
- Category
- Security & safety
- Fields
- AI security
- Added
- 2026-10-09
What it is
OWASP is a nonprofit community that has long been active in web security, and it is well known for its list of top risks for web applications. As LLMs spread into chatbots, agents and search services, OWASP put together the LLM Top 10 to cover new risks that the existing web security list alone could not catch. For each item it explains what the risk is, how attacks happen and how to reduce it. The items and their order are revised periodically to keep up with changes in technology.
What risks it covers
Key items include prompt injection, which tricks a model into ignoring its original instructions; sensitive information disclosure, where personal or confidential data slips into answers; and data and model poisoning, which plants harmful content in training data or the model. It also covers problems caused by passing model output to other systems without checking it, and excessive agency, which comes from giving an agent too many permissions. It further addresses system prompt leakage, weaknesses in vector DBs and embeddings, plausible-sounding misinformation, unbounded consumption that makes a system use resources without limit, and supply chain risks from external models and libraries. The exact item names and order can change between editions, so it is best to check the latest one.
Check questions based on key items
Input · data
- Is it fooled by prompt injection?
- Is the training or retrieval data uncontaminated?
- Are there weaknesses in the vector DB or embeddings?
Output · information
- Does sensitive information stay out of answers?
- Is the system prompt kept from leaking?
- Is output checked before passing to other systems?
- Is there a way to filter misinformation?
Permissions · operations
- Are agent permissions limited to what is needed?
- Is unlimited resource use blocked?
- Have external model and library sources been verified?
Why it matters
Teams building LLM services are often not security experts, so it is easy to feel lost about what to check first. The list gives developers, security staff and product planners a common reference so they can talk about risks in the same terms. Security checklists, red team scenarios and descriptions of guardrail products often use its items as their baseline.
Things to know
The list only picks "the most common and important" risks; it does not cover every risk. Each service handles different data and permissions, so the size of each risk differs too, and teams need to re-prioritize for their own service. Also, a single fix that blocks one item is rare; the usual approach is to stack several layers, such as least privilege, input and output checks, and monitoring.
Example
Before launching a RAG chatbot that searches internal documents to answer questions, security teams often review it using the OWASP LLM Top 10 items as a checklist. For example, they test one by one: "Can the chatbot be steered by instructions hidden in a document? (prompt injection)", "Does HR material show up in answers to employees without access? (sensitive information disclosure)", and "Does the chatbot use tools such as sending email without confirmation? (excessive agency)"