OWASP's top ten reframed LLM security as an application problem

A checklist assembled by practitioners, not a lab

OWASP's Top 10 for LLM Applications began in 2023 when a group of security professionals started cataloguing how applications built on language models were failing in practice, distinct from failures in the models themselves. The project page, as retrieved on 16 September 2026, describes the effort as community-driven, now drawing on several hundred contributors. The project's release history records an initial version in August 2023, a follow-up revision in October 2023, and a full second edition, the '2025' list, released on 18 November 2024.

What changed between editions

The current list, set out on the OWASP GenAI Security Project's LLM Top 10 page, ranks ten risks: prompt injection, sensitive information disclosure, supply chain weaknesses, data and model poisoning, improper output handling, excessive agency, system prompt leakage, vector and embedding weaknesses, misinformation, and unbounded consumption. Several of these, including system prompt leakage, vector and embedding weaknesses, and unbounded consumption, did not appear as separate entries in the 2023 list, reflecting a shift from single-turn chatbots toward applications that embed retrieval, hold long-lived system prompts, and expose tool-calling agents. The list ranks application-layer risk, not model capability: a model can score well on capability benchmarks while the application wrapped around it remains vulnerable to several of these categories.

What a checklist can and cannot tell a reviewer

Used as a review aid, the list gives a reviewer named categories to test against, such as whether a system enforces output validation before executing a model-suggested action, or whether retrieval sources are isolated from instruction channels. It does not certify that a system is safe: the ranking reflects community judgement about prevalence and severity, not a measured incidence rate across production systems, and OWASP neither audits nor certifies individual applications against it. Because the list changes across editions, a review conducted against the 2023 version would have missed categories the 2025 edition added, which is itself evidence that the list describes an evolving practitioner consensus rather than a fixed specification.

• Which edition of the list was the last security review conducted against, and does that edition still match how the application is built today?
• Does the application have controls addressing the newer 2025 categories, such as system prompt leakage and unbounded consumption?
• Is the list guiding actual testing, or is it being cited as evidence of safety without a corresponding test having been run?

The list's value lies in giving a shared vocabulary to an area of application security that previously had none; its limit is that a shared vocabulary is not the same thing as a shared measurement.