OWASP Top 10 for LLM Applications (2025)

Direct or indirect manipulation of the LLM via crafted prompts to bypass instructions, exfiltrate data, or misuse tools. Indirect injection uses retrieved/loaded content (websites, docs, emails) as the injection vector.

LLMs leak training data, system prompts, customer PII, secrets, or proprietary logic through inference or memorized content.

Compromised models, datasets, embeddings, or third-party fine-tunes pulled from public hubs (HuggingFace, ModelScope) carrying backdoors or poisoned weights.

Malicious manipulation of training data, fine-tune data, RAG corpus, or embeddings to influence model output, install backdoors, or skew behavior on attacker-chosen triggers.

Downstream systems consume LLM output as trusted code/SQL/HTML/shell. The LLM is treated as a sanitizer when it is in fact an injection source.

LLM-driven agents granted excessive permissions, tools, or autonomy. Dangerous when combined with prompt injection: an attacker who hijacks the prompt inherits all the agent's capabilities.

System prompt contents (instructions, persona, embedded credentials/keys, or operational logic) extracted by an attacker via probing or prompt injection.

RAG and vector-database flaws: unauthorized document retrieval, embedding inversion, multi-tenant cross-leakage, embedding poisoning.

Hallucinations and factual errors produced confidently. Especially dangerous when the model is used as an authoritative oracle (medical, legal, financial advice) without grounding or citations.

Token, API-credit, or compute exhaustion attacks. Attackers force the model to do expensive inference, drain quota, or enable wallet-attack via long contexts and recursive agent calls.