OWASP Top 10 for LLM Applications
OWASP Foundation·2025 (released March 2025)
OWASP Top 10 for LLM Applications is the de-facto checklist developers reach for when they're building anything on a language model. The 2025 edition (released March 2025) reorganized the list around production LLM-app risks rather than ML research risks, making it the most operationally useful AI security framework in circulation. Ayliea ships an in-app assessment that maps each of the ten risk categories to specific questions, prevention strategies, and ATLAS technique cross-references.
10 risk categories LLM01 through LLM10, weighted by prevalence + impact.
Who it's for
- Engineering teams shipping LLM features in production — RAG apps, agents, copilots, chat surfaces
- Security teams who need a developer-readable framework that maps to actual code-level controls
- Customers being asked by procurement: "How do you handle prompt injection / training data poisoning / model supply chain?"
What it covers
- LLM01 Prompt Injection — direct + indirect, including retrieved-content and tool-output injection paths
- LLM02 Sensitive Information Disclosure — PII / PHI / credential leakage through outputs
- LLM03 Supply Chain — foundation model integrity, fine-tuned weights provenance, plugin trust
- LLM04 Data & Model Poisoning — training data integrity, RAG corpus poisoning
- LLM05 Improper Output Handling — downstream injection from LLM output (SQL, XSS, command injection)
- LLM06 Excessive Agency — tool authorization, function-calling boundaries, autonomy limits
- LLM07 System Prompt Leakage — prompt secrecy, jailbreak resistance
- LLM08 Vector & Embedding Weaknesses — RAG retrieval poisoning, embedding inversion
- LLM09 Misinformation — hallucination management, factuality controls
- LLM10 Unbounded Consumption — denial-of-wallet, token-cost attacks, throughput exhaustion
How Ayliea ships it
- 77 assessment questions across the 10 categories — every prevention strategy from the spec maps to at least one question
- Cross-referenced to MITRE ATLAS techniques (AML.T0051 prompt injection, T0080 prompt extraction, etc.) so red-team work + governance work share vocabulary
- Scored on the standard 0/3/5/8/10 maturity scale used across all AI-focused frameworks in the platform
- Pairs with the AI Security Standard (AISS), AI Agent Security, and ISO 42001 for a complete posture — governance + ops + dev + agentic
Why this matters when you're comparing GRC platforms
Most AI governance comparisons stop at ISO 42001 and NIST AI RMF. This is the framework that distinguishes a practitioner platform from a checklist platform.
Vanta, Drata, and Sprinto all ship the three governance-side AI frameworks (ISO 42001, NIST AI RMF, EU AI Act) but none ship OWASP LLM Top 10. Their AI coverage is for the compliance buyer, not the AI-engineering buyer who's actually writing the prompt-injection defenses.
Sources
Every numeric claim on this page traces back to the publishing body or the in-app framework definition.
Last verified May 13, 2026.
Other practitioner-focused AI frameworks Ayliea ships
The depth advantage shows up across the set. Each one targets a specific AI risk surface competitors don't cover.