OWASP LLM Top 10

The OWASP Top 10 for Large Language Model Applications names ten risk categories LLM application teams should consider during design, development, and operation: prompt injection, insecure output handling, training data poisoning, model denial of service, supply chain vulnerabilities, sensitive information disclosure, insecure plugin design, excessive agency, overreliance, and model theft — the current (2025) list evolved meaningfully from the original 2023 version as deployment patterns matured.

It covers the application layer: prompts, integration code, retrieval pipelines, output handling. It does not cover the model weights, the foundation-model training process, or organisational AI governance — those are addressed by different frameworks (OWASP Agentic Top 10 for agent-specific risk, ISO 42001 or NIST AI RMF for governance).

Referencing the OWASP LLM Top 10 in a security review is design-time evidence that LLM-specific risk categories were considered. Referencing it without a control mapping — the specific control, the lifecycle gate it applies at, and the evidence that demonstrates it's operating — is naming the framework, not assessing against it.

A useful assessment produces a structured table for the assessed system: for each of the ten items, the applicable controls, the lifecycle gate by which each should be in place, current evidence status, and any residual risk the AI Committee has explicitly accepted. That table, not a checked-box list of ten items, is what a defensible review actually needs.

Agentic systems need both this taxonomy and the OWASP Agentic Top 10 — the LLM Top 10 covers risks in LLM applications generally; the Agentic Top 10 covers risks that emerge specifically from tool use, delegation, and autonomous action. Non-agentic LLM applications need only the LLM Top 10.