OWASP publishes Top 10 for Large Language Model Applications

The Open Worldwide Application Security Project (OWASP), the volunteer body best known for its Top 10 list of web application vulnerabilities, published a companion list for applications built on large language models. Version 1.0 named ten risk categories: prompt injection, insecure output handling, training data poisoning, model denial of service, supply chain vulnerabilities, sensitive information disclosure, insecure plugin design, excessive agency, overreliance, and model theft.

Four of the categories — prompt injection, insecure output handling, denial of service and sensitive information disclosure — mapped loosely onto risks OWASP already tracked in conventional web applications. The other six were framed as specific to how LLM-based systems are built: training data poisoning and supply chain vulnerabilities addressed the provenance of models and their data; insecure plugin design and excessive agency addressed the growing practice of letting models call external tools and take actions; overreliance addressed the tendency of users and developers to trust model output without verification.

The project, led by Steve Wilson with a group of co-leads, drew on contributions from security researchers and practitioners rather than a single vendor, and positioned itself as a starting vocabulary rather than a finished standard — the document itself flagged prompt injection in particular as an unsolved problem with no reliable technical fix. It was revised within months (v1.1 that October) and became an annually updated reference, eventually rebranded under OWASP’s broader GenAI Security Project.

The list’s significance was less in any individual finding than in giving procurement teams, auditors and developers a shared checklist at a moment when companies were embedding LLMs into products faster than security practice had caught up. It began appearing in vendor risk assessments and compliance frameworks within the following year.