OWASP LLM Top 10 (2025): what changes for whoever is integrating AI today
The 2025 OWASP LLM Top 10 brings ten risk classes specific to applications using generative models. It doesn't replace the web Top 10 — it adds to it. In SMBs building AI features, these ten items must become a threat-modeling checklist before the first PR.
Three most frequent in real systems: Prompt Injection (LLM01) — model behavior manipulated via user input; Sensitive Information Disclosure (LLM02) — confidential data leaking through responses; Improper Output Handling (LLM05) — model output being executed/rendered without sanitization.
The ones that surprise product teams most: Excessive Agency (LLM06) when the LLM has more agency (tool-calling, action execution) than needed; Vector and Embedding Weaknesses (LLM08) in poorly-isolated RAG architectures; System Prompt Leakage (LLM07) when the system prompt (containing instructions and confidential data) leaks via extraction technique.
Collective mitigation rests on three principles: treat all input as hostile, treat all LLM output as hostile too, and give the model the minimum agency required to execute the task. These three pillars cover 7 of the 10 items. And the field moved on: in December 2025 OWASP published the Top 10 for Agentic Applications (ASI01–ASI10), covering planning, tool use, memory and inter-agent communication risks — required reading for anyone shipping agents to production.
Threat modeling for LLMs is not an academic exercise. Five of the ten items have already shown up in public incidents in 2025.