OWASP LLM Top 10

Risk Taxonomy

Source: app.qpoint.io/v2/compliance/framework/owasp-llm-top-10 — v2 Figma (Agent Transition)

The OWASP Top 10 for LLM Applications is an awareness document — a ranked list of the ten most critical security risks specific to applications that build on large language models. It's modeled on the original OWASP Top 10 for web apps. It's produced by a community working group, published free, and revised periodically (the current edition is the 2025 list; the original dropped in 2023).

19 / 23Recommended Controls Active

Requirements

	Risk	Satisfying Policy Controls	Addressability

LLM01	Prompt Injection	Require Tool Approvalview Tool Allow Listview Prompt Inspectionview	Partial — can detect & contain, can't fully prevent
LLM02	Sensitive Disclosure	Deny Credentialsview	Addressable
LLM03	Supply Chain	Provenance Pinningview	Partial — pin at load; sourcing is build-time
LLM04	Data & Model Poisoning	Provenance Pinningview	Out of scope — training-time, ML pipeline
LLM05	Improper Output Handling	Output Validationview Tool Allow Listview Egress Allow Listview	Addressable
LLM06	Excessive Agency	Require Tool Approvalview Tool Allow Listview Sandbox Requiredview No Root Executionview	Addressable — strongest fit
LLM07	System Prompt Leakage	Prompt Inspectionview Deny Credentialsview Output Validationview	Partial — real fix is design-time
LLM08	Vector & Embedding	Deny Credentialsview Egress Allow Listview	Out of scope — RAG/vector pipeline
LLM09	Misinformation	Output Validationview Telemetry Requiredview	Partial — model quality + HITL
LLM10	Unbounded Consumption	Spend Ceilingview Telemetry Requiredview Egress Allow Listview	Addressable — strong fit