Large language models are now in production — powering support bots, copilots and autonomous agents that touch internal systems. With the capability came a new class of vulnerabilities that classic web security never accounted for. The OWASP Top 10 for LLM Applications 2025 is the industry reference for those risks. Here is the complete breakdown: how each is attacked, and how to defend.
This is a practical guide from the agent::offense LLM testing team — we see these attacks on real products, not in theory.
LLM01 · Prompt Injection
The model cannot tell a developer instruction from user data — it is all just text. An attacker embeds a command in the input, and the model follows it. Injection is direct (via the prompt) or indirect — hidden in a document, email or web page the model processes automatically. The deeper the model’s privileges, the worse the impact. See our deep-dive: Prompt Injection Explained. Tested via prompt injection testing.
LLM02 · Sensitive Information Disclosure
The model reveals what it should not: PII from training data, other users’ session content, internal documents, secrets pulled into context. Often a well-phrased question is enough. This is a direct legal and reputational risk.
LLM03 · Supply Chain
AI apps are assembled from third-party models, datasets, adapters and plugins — any of which can be compromised. One trusted-but-tampered model poisons the whole product. Covered by an AI supply chain security audit.
LLM04 · Data and Model Poisoning
Malicious examples injected into training or fine-tuning data teach the model wrong behaviour or a hidden backdoor that triggers on a specific input. Invisible until it fires.
LLM05 · Improper Output Handling
Model output is passed downstream — into the browser, a SQL query, a shell command, an API call — as if it were safe. Classic bugs return with the AI as the source: XSS, SSRF, injection, code execution.
LLM06 · Excessive Agency
Models get too many permissions — tools, APIs, the ability to act without confirmation. When such a model is driven by an injection, that agency turns a leak into real damage. This is the defining risk of AI agents. See: How to Secure an AI Agent.
LLM07 · System Prompt Leakage
The system prompt is assumed hidden, yet it can almost always be extracted. Worse if it holds secrets or security logic. Probed during jailbreak & guardrail testing.
LLM08 · Vector and Embedding Weaknesses
In RAG systems, weak isolation lets one user reach another’s documents, uploaded content carries indirect injections, and embeddings can leak source text. See our RAG security guide and RAG assessment.
LLM09 · Misinformation
The model confidently outputs false information — invented facts, non-existent APIs, wrong advice. If a business process trusts output without verification, errors scale automatically.
LLM10 · Unbounded Consumption
Without limits, an AI service is exposed to denial-of-service and cost attacks — heavy queries, mass requests, expensive tool-call chains — plus model extraction through bulk querying.
Building AI defense systematically
These risks compound: injection (LLM01) plus excessive agency (LLM06) plus unsafe output (LLM05) is a full attack chain. Defense is layered — test, fix, retest. Start with an LLM application penetration test, and for agents that act, AI agent penetration testing.
Shipping an LLM app or already in production?
We test your application against all ten OWASP LLM risks and show exactly where it breaks — before attackers do.
Read next: Prompt Injection Explained, How to Secure an AI Agent.