OWASP Top 10 for LLM Applications

Prompt injection has held the top spot since the first 2023 edition. The list also covers sensitive information disclosure, supply chain risks, data poisoning, and excessive agency.

Its usefulness comes from scope. Governance frameworks such as the NIST AI RMF tell you how to run a program; the OWASP list tells your engineers what to actually test for. It is written for the people building the thing, which makes it the right artifact to hand to a development team on the day they start integrating a model, and the right basis for the test cases in a security review.

The entries that surprise people are the ones about the surrounding system rather than the model. Insecure output handling covers what happens when your application takes model output and passes it into a shell, a database query, or a browser without treating it as untrusted, which reverses the usual assumption that the model is the risky component. Excessive agency covers the permissions you gave the system rather than anything it did wrong. Supply chain covers the provenance of models, adapters, and training data you did not produce.

Treat it as a checklist for design review rather than a compliance artifact. The list is deliberately not a standard, nobody certifies against it, and it changes as the field does. What it buys you is a shared vocabulary between security and engineering at the point where most AI risk is actually introduced, which is the application layer rather than the model.