The OWASP Top 10 for LLM Applications is the industry reference for risks when building with large language models — the LLM equivalent of the classic web Top 10.
The list
| # | Risk | In short |
|---|---|---|
| LLM01 | Prompt Injection | Untrusted input overrides instructions |
| LLM02 | Insecure output handling | Trusting model output → XSS/RCE |
| LLM03 | Training data poisoning | Corrupted training data → backdoors |
| LLM04 | Model denial of service | Costly prompts exhaust resources |
| LLM05 | Supply-chain | Compromised models/datasets/plugins |
| LLM06 | Sensitive info disclosure | Model leaks secrets/PII from context |
| LLM07 | Insecure plugin/tool design | Over-privileged tools an agent can abuse |
| LLM08 | Excessive agency | Agent can do more than it should (Agentic Tool-Use Loops) |
| LLM09 | Overreliance | Trusting hallucinated output |
| LLM10 | Model theft | Exfiltrating or cloning the model |
The throughline
Most LLM security reduces to one rule: the model and its inputs are untrusted. Don't let untrusted text become trusted instructions or trusted actions.
Related: Prompt Injection · Indirect Prompt Injection · Securing a Public PHP App · AI Red Teaming