OWASP Top 10 for LLM Applications 2025/2026

Manipulating LLM behavior through crafted inputs that override original instructions. Includes both direct (user input) and indirect (external data) injection.

LLMs inadvertently revealing private, confidential, or proprietary information through model outputs.

Compromised or vulnerable components in the LLM supply chain including models, APIs, plugins, and third-party services.

Introducing malicious or biased data into training pipelines, fine-tuning data, or RAG knowledge bases to compromise model integrity.

Failing to validate, sanitize, or properly handle LLM outputs before passing them to downstream systems or users.

Granting LLM systems too much functionality, autonomy, permissions, or enabling unauthorized or harmful actions.

Exposing confidential system prompts, instructions, or internal logic through manipulation or inadequate protections.

Security vulnerabilities in Retrieval-Augmented Generation (RAG) systems, vector databases, and embedding pipelines.

LLMs generating false, misleading, or biased content that appears credible, leading to informed decisions based on incorrect information.

Allowing excessive or uncontrolled resource usage by LLM applications, leading to denial of service, financial exploitation, or service degradation.