OWASP LLM Top 10 for security teams

By Sam Rivera, Founder, SentinelPanda · June 2, 2026 · 3 min read · AI Governance

OWASP's LLM Top 10 is the closest thing the GenAI security space has to a shared vocabulary. Treat it as a threat-model checklist, not a compliance bingo card.

What the LLM Top 10 actually is

The OWASP Top 10 for LLM Applications (current major version published 2025) is a community-maintained list of the most consequential security risks specific to applications built on large language models. It is the LLM-era cousin of the original OWASP Top 10 for web application security — same idea, different attack surface.

Treat it as a shared threat-modelling vocabulary. It is not a control framework, not a compliance checklist, and not an exhaustive risk register. It is useful because it gives security and engineering teams a common reference when discussing GenAI exposure.

The ten risks, in plain language

LLM01 Prompt Injection — adversarial inputs that override system instructions, including indirect injection via tool outputs, retrieved documents, and user-supplied content.
LLM02 Sensitive Information Disclosure — the model emitting training data, system prompts, customer PII, or secrets in its outputs.
LLM03 Supply Chain — compromised models, pre-trained weights, fine-tuning data, or third-party plugins introducing risk via the model supply chain.
LLM04 Data and Model Poisoning — adversarial training or fine-tuning data that degrades model behaviour in attacker-chosen ways.
LLM05 Improper Output Handling — treating LLM output as trusted input downstream (e.g. executing it as code, rendering it as HTML, passing to a SQL builder), enabling classic injection bugs via the model.
LLM06 Excessive Agency — overly permissive tool access, function-calling without authorisation checks, autonomous agents with too few guardrails.
LLM07 System Prompt Leakage — the model revealing system-prompt contents to attackers, including instructions, secrets, or operational logic embedded in the prompt.
LLM08 Vector and Embedding Weaknesses — injection through retrieved documents, embedding-space attacks, weak access control on vector stores.
LLM09 Misinformation — over-reliance on LLM outputs in contexts where hallucinated or biased content has real consequences (legal, medical, financial advice).
LLM10 Unbounded Consumption — token-spend exhaustion, denial-of-wallet attacks, resource exhaustion via complex generation.

Three risks most teams under-rate

LLM03 Supply Chain. Most teams treat the model as a vendor problem, but the supply chain includes fine-tuning datasets, embeddings, and any third-party plugin in the inference path. A compromised embedding library is invisible to your application-layer testing.

LLM05 Improper Output Handling. The instinct to render LLM markdown, execute generated code, or pass generated SQL straight to a database is widespread. Treat model output as untrusted input — the same posture you take with form data.

LLM06 Excessive Agency. Agentic systems with broad tool access turn a prompt injection into an arbitrary action. Limit tool scope, require explicit authorisation for sensitive operations, and log every tool call for incident response.

Mapping it to your governance programme

The LLM Top 10 sits comfortably inside an existing AI governance programme. For ISO 42001, the Top 10 maps to Annex A.6 (AI system lifecycle) and Annex A.8 (information for interested parties) controls. For the NIST AI RMF, prompt injection and output handling fit Measure (specifically subcategories on adversarial robustness and reliability). For the EU AI Act, accuracy, robustness, and cybersecurity obligations under Article 15 are where the Top 10 lands.

Use the Top 10 to drive your AI threat model: for each LLM application, walk the ten items and document either why the risk does not apply, the mitigation in place, or the residual risk you accept. That document is reusable across audits and procurement responses.

What to actually do

Adopt the LLM Top 10 as the shared vocabulary for your threat-modelling sessions.
For each in-scope LLM application, produce a one-page mapping of each Top 10 entry to your specific controls.
Bake prompt-injection testing into your evaluation suite, including indirect injection via documents and tool outputs.
Treat LLM outputs as untrusted: sanitise before rendering, never execute, always re-authorise before tool calls.
Monitor token consumption and add per-request and per-user spend caps to neutralise LLM10.

AI vendor due diligence AI incident response NIST AI Risk Management Framework