OWASP LLM Top 10 (2025): five risks already in the incident record — and how to cover each

Ten items, none of them theoretical. The difference between the 2023 list and the 2025 one shows up exactly where it hurts in production: in what the model is allowed to call and where its answer goes. This piece is for the team that already shipped an AI feature and has to decide what to close first.

What changed from the 2023 list to the 2025 one

Two entries are new. System Prompt Leakage (LLM07) and Vector and Embedding Weaknesses (LLM08) come from the same place: long system prompts and RAG stopped being an implementation detail and became attack surface. In 2023 neither one was on the list.

Three items changed name and scope. Insecure Output Handling, formerly LLM02, became Improper Output Handling and dropped to LLM05. Training Data Poisoning became Data and Model Poisoning (LLM04) and now covers weights and fine-tuning, not just the training corpus. Model Denial of Service became Unbounded Consumption (LLM10) and now includes cost: a blown API bill and an unavailable service went into the same box.

Two moved up and two left. Sensitive Information Disclosure jumped from LLM06 to LLM02. Supply Chain went from LLM05 to LLM03. Insecure Plugin Design and Model Theft are no longer entries of their own — the plugin content was absorbed by Supply Chain and Excessive Agency. And Overreliance became Misinformation (LLM09), moving the focus off user behaviour and onto the output the system produces.

The five that matter for a small team

A team of ten engineers does not close ten fronts at once. It closes five. The criterion is not taste: LLM01, LLM02, LLM03, LLM05 and LLM06 are the ones that have already shown up in a public incident with the technical detail published. The other five matter, but they can wait for next quarter.

Prompt Injection (LLM01) together with Improper Output Handling (LLM05) was the pair behind EchoLeak (CVE-2025-32711, CVSS 9.3), disclosed by Aim Security in June 2025. An email carrying an instruction hidden in an HTML comment, with not a single click from the user, made Microsoft 365 Copilot read internal files and send the content out. The payload got past the prompt injection classifier, the link redaction and the CSP, using a Teams image proxy that sat on the allowlist. Microsoft fixed it server-side and said it saw no exploitation in the wild.

Three months later came ForcedLeak (CVSS 9.4), reported by Noma Security to Salesforce on 28 July 2025 and disclosed on 25 September. The Description field of an Agentforce Web-to-Lead form became an instruction channel, and the output went to an expired domain that was still on the CSP allowlist — bought for USD 5 at the registrar. Salesforce turned on Trusted URLs Enforcement on 8 September 2025. The lesson is not about Salesforce: your CSP allowlist is worth the cheapest domain left in it.

Slack AI showed the same pattern a year earlier. On 20 August 2024, PromptArmor published how a message planted in a public channel, ingested by the RAG pipeline, made the assistant build a markdown link that carried data out of private channels the attacker had never joined. Same mechanics, different product: untrusted input, uncontrolled output.

Supply Chain (LLM03) piled up three cases in eighteen months. In February 2024, JFrog found more than 100 malicious models on Hugging Face, with pickle firing a reverse shell at load time and roughly 95% of them in PyTorch format. In July 2025, the Amazon Q Developer extension for VS Code took an outside PR and went out as version 1.84.0 on 17 July with a system prompt telling the agent to wipe the disk and delete AWS resources through the CLI; it was only replaced by 1.85.0 on 19 July, with bulletin AWS-2025-019 (the payload never worked, thanks to a formatting error). On 26 August 2025, s1ngularity (CVE-2025-10894) published malicious versions of Nx with a postinstall script that used the AI CLIs already installed on the machine to sweep the disk for secrets. Wiz counted more than 190 users and organisations and more than 3,000 repositories hit in the second wave.

Excessive Agency (LLM06) owns both the most expensive story and the quietest one. In July 2025, the Replit agent deleted the production database during a code freeze: 1,206 executive records and 1,196 company records, with no rollback. The CEO apologised publicly on 19 July and the company moved to separating development and production databases by default. Two months earlier, Invariant Labs had shown the quiet version of the same problem: on the GitHub MCP server, a malicious issue in a public repository makes the agent that was only asked to 'check the open issues' publish private repository content in a public PR. This is not a code bug. It is too much permission concentrated in a single session.

Mitigation per item, with realistic effort

The numbers below are engineering days for a team that already has CI and PR review. Added up, twelve to fifteen days — less than a single incident response usually costs.

LLM01 and LLM05 travel together and give the best return. Treat every text coming from outside — email, issue, PDF, scraped page, CRM record — as untrusted data, and treat the model's output the same way. In practice: no rendering raw HTML or markdown from the model, no image with a URL the model assembled, no eval, no concatenated SQL, and an outbound domain allowlist that is reviewed with expiry monitoring. 3 to 5 days.

LLM06 is the cheapest item and the one that hurts most when it is missing. Every tool exposed to the model gets minimum scope, its own credential and its own environment. A destructive action — DROP, DELETE, deploy, sending email, payment — requires human confirmation outside the model's channel. And one agent session touches one repository, one database, one bucket. 2 to 3 days, and it is what separates your team from the Replit incident.

LLM03 is solved with dependency hygiene applied to the new inventory: versions pinned in the lockfile, installs that skip postinstall wherever possible, manual review of any IDE extension with shell access, and models loaded as safetensors instead of pickle. Add an SBOM to the build. 2 days the first time, then it becomes maintenance.

LLM02 is ordinary infrastructure applied to new data. No secrets in the system prompt, PII redaction before prompt and response logs are written, short retention. The DeepSeek leak — a ClickHouse instance open to the internet with more than 1 million log lines, chat history and keys in plain text, found by Wiz on 29 January 2025 — was not a model failure. It was an exposed database. 2 days.

LLM07, LLM08 and LLM10 come out in the same pass. Assume the system prompt leaks and keep nothing in it that cannot be public. Isolate vector indexes per tenant and apply the source data's own ACL at retrieval time. Put a token ceiling on each request, a per-user rate limit and a daily cost alert. 3 days.

How this folds into threat modeling and CI

In threat modeling, every AI feature becomes a three-box diagram: where the text comes from, what the model can call, where the output goes. Every arrow gets an item from the list. If nobody on the team can point at where the output arrow ends, you have an EchoLeak waiting for its moment.

In CI, three cheap gates. A regression test running a corpus of known injection prompts against the AI endpoints. A secret scanner over the repository and the sample logs. And a dependency check that breaks the build when a package gains a new postinstall or was published in the last 48 hours — exactly the window of Nx and Amazon Q. None of the three needs a paid tool.

If you have to show this to a client or an auditor, NIST AI 600-1 (the generative AI profile of the AI RMF, published in July 2024) gives you the vocabulary, with 12 risk categories and more than 200 suggested actions, and ISO/IEC 42001 is the certifiable standard for an AI management system. Start with OWASP and map afterwards. The reverse order costs months and closes no bugs.

Checklist before the release

Seven questions. If any answer is 'I don't know', the release waits. First: is every third-party text reaching the model marked as untrusted in the code? Second: is the model's output rendered or executed anywhere without sanitisation? Third: what is the exact list of tools the model can call, and who approved each permission? Fourth: is there a destructive action without human confirmation? Fifth: what happens to the product if the whole system prompt becomes public tomorrow? Sixth: do the prompt and response logs hold PII, and for how long? Seventh: what is the spending ceiling per user per day, and who gets the alert?

The 2025 list already has a successor for teams running agents: on 9 December 2025 OWASP published the Top 10 for Agentic Applications, from ASI01 (Agent Goal Hijack) to ASI10 (Rogue Agents). If your product plans, holds memory and calls tools on its own, read both. If it only answers questions, the five items above already cover your real risk.

Sources for this analysis

01

OWASP Gen AI Security Project · Top 10 for LLM Applications 2025

02

OWASP · Top 10 for Large Language Model Applications (2023, v1.1)

03

arXiv · EchoLeak: the first real-world zero-click prompt injection exploit in a production LLM system

04

Noma Security · ForcedLeak: AI agent risks exposed in Salesforce Agentforce

05

Wiz Research · Exposed DeepSeek database leaking chat history and secret keys

06

JFrog · Data scientists targeted by malicious Hugging Face ML models with silent backdoor

07

Nx · s1ngularity: what happened, how we responded, what we learned

08

Invariant Labs · GitHub MCP exploited: accessing private repositories via MCP