The OWASP GenAI Security Project released the 2025 edition of its Top 10 for LLM Applications. Prompt injection remains the top risk, and the list includes Excessive Agency (LLM06) covering systems granted the ability to call functions and take actions, along with system prompt leakage and vector and embedding weaknesses.
Why it matters
It is OWASP's practitioner checklist for LLM application risk and the direct predecessor of its agent-specific lists.
Key facts
As stated in the sources, with where to find them.
- 2025 list: LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM03 Supply Chain, LLM04 Data and Model Poisoning, LLM05 Improper Output Handling, LLM06 Excessive Agency, LLM07 System Prompt Leakage, LLM08 Vector and Embedding Weaknesses, LLM09 Misinformation, LLM10 Unbounded Consumption.LLM Top 10 archive page
Findings that cite this record
No tracked finding cites this record yet.
Key questions this bears on
- Can prompt injection against AI agents be reliably defended?Not reliably. Defenses reduce injection but none has eliminated it; limiting what untrusted input can trigger is the most defensible approach.
Sources
Related records
Dec 9, 2025
Oct 3, 2024
Feb 17, 2025
Sep 30, 2025
Mar 24, 2025
Jun 19, 2024