OWASP Top 10 for LLM Applications2025Rank #9Last reviewed 2026-07-27

LLM09:2025: Misinformation

Hallucinations and factual errors produced confidently. Especially dangerous when the model is used as an authoritative oracle (medical, legal, financial advice) without grounding or citations.

How it's found

Identified by evaluating model responses in domains where the target presents the model as authoritative, checking for confident hallucination and fabricated citations.

Standards mapping

References: https://genai.owasp.org/llmrisk/llm092025-misinformation/

Where this fits in a TurboPentest engagement

TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.

Frequently asked questions

What is LLM09:2025 Misinformation?

Hallucinations and factual errors produced confidently. Especially dangerous when the model is used as an authoritative oracle (medical, legal, financial advice) without grounding or citations.

How do you find Misinformation?

Identified by evaluating model responses in domains where the target presents the model as authoritative, checking for confident hallucination and fabricated citations.

Does TurboPentest test for Misinformation?

Related OWASP categories

Find these issues before an attacker does

TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.

Start a $99 pentest

OWASP Top 10 for LLM Applications2025Rank #9Last reviewed 2026-07-27

LLM09:2025: Misinformation

Hallucinations and factual errors produced confidently. Especially dangerous when the model is used as an authoritative oracle (medical, legal, financial advice) without grounding or citations.

How it's found

Identified by evaluating model responses in domains where the target presents the model as authoritative, checking for confident hallucination and fabricated citations.

Standards mapping

References: https://genai.owasp.org/llmrisk/llm092025-misinformation/

Where this fits in a TurboPentest engagement

Frequently asked questions

What is LLM09:2025 Misinformation?

Hallucinations and factual errors produced confidently. Especially dangerous when the model is used as an authoritative oracle (medical, legal, financial advice) without grounding or citations.

How do you find Misinformation?

Identified by evaluating model responses in domains where the target presents the model as authoritative, checking for confident hallucination and fabricated citations.

Does TurboPentest test for Misinformation?

Related OWASP categories

Find these issues before an attacker does

TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.

Start a $99 pentest