- The OWASP 2025 list covers ten risks, from prompt injection to unbounded resource consumption.
- Most of them come down to three rules: do not trust the model's input or output, give tools minimal permissions and limit consumption.
- The list is a starting point for review, not complete protection.
Applications built on language models have risks of their own that you will not find in classic checklists. The OWASP Gen AI Security project published a list of the ten most important threats for 2025 for them. This guide translates it into the language of somebody building an application and shows that most items come down to a few rules you can implement today. It complements the article on the five checks for AI code.
Ten risks in one overview
The table below lists the items of the list with numbers according to OWASP and adds what they mean for a builder and what defence is usually applied. The descriptions in the columns are my summary; read the full definitions on the project’s site.
| What it means | A typical defence | |
|---|---|---|
| LLM01 Prompt Injection | Input changes the model's behaviour against intent | Treat outside text as untrusted, limit permissions |
| LLM02 Sensitive Information Disclosure | The model reveals confidential data | Do not pass secrets to the model, filter output |
| LLM03 Supply Chain | Vulnerabilities in models, data and dependencies | Check sources, pin versions, scan dependencies |
| LLM04 Data and Model Poisoning | Poisoned training or embedding data | Control data provenance, test behaviour |
| LLM05 Improper Output Handling | Model output used without validation | Validate and escape output, never run it as code |
| LLM06 Excessive Agency | Too many functions, permissions or too much autonomy | Least privilege, human consent |
| LLM07 System Prompt Leakage | Leak of the system instruction | Keep no secrets or access rules in it |
| LLM08 Vector and Embedding Weaknesses | Weaknesses of vector indexes and RAG | Access control on documents, result filtering |
| LLM09 Misinformation | Confident-sounding but false answers | Sources, verification, a human in the loop |
| LLM10 Unbounded Consumption | Excessive use of resources and costs | Limits on requests, context length, budget |
Three rules that cover most of the list
First: trust nothing that goes into the model or comes out of it. Input includes content from a user, documents fetched by search and tool results; output is everything the model generates. The description of the Improper Output Handling threat speaks of insufficient validation and sanitization of output, and Prompt Injection of a situation in which input changes the model’s behaviour. So validate both directions like data from an unknown user. Second: limit what the model can do. Excessive Agency is, according to OWASP, a vulnerability that enables damaging actions in response to unexpected or manipulated model output, and its root cause is excessive functionality, permissions or autonomy. Third: limit consumption. Unbounded Consumption concerns excessive and uncontrolled use of resources, therefore also costs.
- 01MapWhat data the model sees and what it can do.
- 02InputUntrusted: users, documents, tools.
- 03OutputValidate and escape before use.
- 04PermissionsMinimal functions, rights and autonomy.
- 05LimitsRequests, context, budget.
- 06TestAttack cases in the test set.
A sample review: an assistant with documents
Imagine an assistant that answers employees’ questions from internal documents. Data: the model sees fragments of documents, so the risk of disclosure (LLM02) and index weaknesses (LLM08) depend on access control during retrieval. Tools: if the assistant can only read, excessive agency (LLM06) is low, and if it can also send messages it rises. Input: documents may contain hidden commands (LLM01), so content from the index is data, not instructions. Output: the answer goes to the browser, so output handling (LLM05) requires escaping. Cost: without limits one loop can generate a bill (LLM10). Such a review takes an hour and yields a concrete task list.
How to use the list in practice
The list is not a checklist to tick off but a starting point for a review. Start with a map: what data your model sees, what tools it has, where its output goes. Then go through the ten items and for each write one of three: concerns me and I have a defence, concerns me and I do not, does not concern me. The items in the second group are your task list. Add attack cases to the test set, for example documents with hidden commands, to check that the defence works, which I describe in the article How to evaluate an agent before you trust it. A wider risk management framework is given by the NIST AI RMF, and I write about the human in the loop in the Human in the loop hub.
Last checked: 20 October 2026. The OWASP list has versions; check whether it is still the newest.