OWASP Top 10 for LLM Applications

1. LLM01 Prompt Injection

   Direct and indirect prompt injection and jailbreaking that alter model behavior.

2. LLM02 Sensitive Information Disclosure

   Leakage of PII, secrets and proprietary data through model outputs.

3. LLM03 Supply Chain

   Compromised models, datasets, plugins and third-party components.

4. LLM04 Data and Model Poisoning

   Poisoned training, fine-tuning and embedding data and backdoors.

5. LLM05 Improper Output Handling

   Unvalidated LLM output passed to downstream systems leading to XSS, SSRF or code execution.

6. LLM06 Excessive Agency

   Over-broad tool permissions, autonomy and functionality granted to LLM agents.

7. LLM07 System Prompt Leakage

   Exposure of system prompts containing secrets or guardrail logic.

8. LLM08 Vector and Embedding Weaknesses

   RAG and vector store access control, embedding inversion and poisoned retrieval.

9. LLM09 Misinformation

   Hallucination, overreliance and unverified model output.

10. LLM10 Unbounded Consumption

    Denial of service, denial of wallet, model extraction and resource abuse.

Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.