OWASP’s 2025 LLM risk update raises the bar on AI governance

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Lasso Security's blog post: OWASP's 2025 LLM Top 10 update broadens the GenAI risk picture to include prompt injection, sensitive data disclosure, excessive agency, RAG and embedding risk, misinformation, and unbounded consumption.

Why it matters: IAM and security teams need to treat LLM applications as governed runtime systems, because access scope, data exposure, and output trust now shape the control model as much as deployment security.

Context

LLM application security is no longer limited to model selection or deployment hardening. The governance gap is that generative AI systems can ingest untrusted instructions, surface sensitive content, and act with broader decision scope than traditional applications, so the control problem shifts to runtime behaviour, data boundaries, and authority.

OWASP’s 2025 update reflects that shift by moving several risks from adjacent concerns to core categories. For identity and access teams, that means GenAI governance now intersects with prompt handling, data disclosure, retrieval controls, and the boundaries placed on AI-driven actions.

The result is a more operational view of GenAI risk. Security programmes now have to ask not only whether an application is approved, but also what it can read, what it can reveal, and what it can decide on behalf of the organisation.

Key questions

Q: How should security teams handle prompt injection in production LLM applications?

A: Security teams should treat prompt injection as a runtime control issue, not a content-moderation problem. The practical response is to inspect prompts, retrieved content, and tool outputs for hostile instructions, then block or downgrade unsafe sessions before the model can act on them. The model should never be the only enforcement layer.

Q: Why does excessive agency change how organisations govern GenAI?

A: Because the risk moves from what the model says to what the model can do. If an LLM can call tools, read internal data, or trigger actions, security teams must govern action scope, approval gates, and revocation paths the same way they govern privileged access.

Q: What breaks when retrieval data is not governed in RAG systems?

A: The model can treat poisoned or low-trust content as if it were authoritative context. That undermines answer integrity, increases the chance of misinformation, and can expose sensitive material if the retrieval corpus includes data that should never have been available to the model.

Q: How do organisations know whether LLM access controls are actually working?

A: They should verify that every request is evaluated with identity context, that tool access is logged, and that rephrased prompts cannot reach data outside the caller's scope. If a user can change phrasing and still cross an access boundary, the control is not working as intended.

Technical breakdown

Why prompt injection is a control-bypass problem

Prompt injection is not just malicious text in a user prompt. It is a control-bypass technique that tries to redirect model behaviour away from the developer’s intended instruction hierarchy, especially when the model has access to tools, retrieval layers, or downstream workflows. Direct injection targets the active prompt, while indirect injection hides in content the model later consumes. The security issue is that the model may treat untrusted content as instruction rather than data, which weakens the boundary between user input and system intent. Practical evaluation needs to focus on where instruction sources are mixed, not only on model quality.

Practical implication: separate trusted system instructions from untrusted content paths and treat prompt handling as an access-control problem, not only a content-filtering problem.

How excessive agency changes AI governance

Excessive agency describes LLM systems that are allowed to take actions, not just generate text. Once an LLM can decide to call tools, query data, or trigger workflows, the risk moves from output quality to authority scope. That is why the article’s update matters for governance: the model is no longer only a producer of text, it becomes a runtime actor with potential side effects. In identity terms, the question becomes what the system is authorised to do, under what conditions, and with what review boundary. Without those constraints, decision-making can drift beyond what the original approval model assumed.

Practical implication: define tool permissions, approval boundaries, and action scopes for AI systems before enabling them to execute workflow steps.

Why RAG and embedding risk is now an identity issue as well as a data issue

Retrieval-augmented generation and embedding-based architectures create a new trust layer between source content and model output. If malicious or poisoned content enters the retrieval corpus, the model can be steered by data it was never meant to trust. That makes retrieval governance more than a search problem. It becomes a provenance and authority problem because the model may elevate retrieved material into answer formation without the user seeing the trust boundary. For identity and access programmes, the key issue is not only who can query the system, but who can influence the knowledge base it consults.

Practical implication: govern retrieval sources, ingestion paths, and corpus write access with the same discipline used for privileged content stores.

Threat narrative

Attacker objective: The attacker’s objective is to steer model behaviour into disclosure, misinformation, or unsafe action while preserving the appearance of legitimate AI output.

1. Entry occurs when a user or embedded external source supplies content that the model ingests as if it were part of the trusted instruction stream.
2. Credentialed access or authority abuse follows when the LLM is allowed to use tools, retrieval results, or internal context beyond its intended scope.
3. Impact occurs when the system reveals sensitive information, produces misleading outputs, or triggers unintended actions at scale.

Breaches seen in the wild

• Moltbook AI agent keys breach: Moltbook breach exposed 1.5M AI agent keys.
• LiteLLM PyPI package breach: LiteLLM PyPI supply chain attack, credentials stolen from users.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

OWASP’s 2025 LLM update shows that GenAI governance has moved from model approval to runtime control. The article’s risk list is not a collection of isolated issues. It describes a class of systems where data, instructions, retrieval, and action all intersect in the same execution path. Practitioners should treat that as a control-model change, not a feature update.

Prompt injection is the named concept that best captures the current LLM trust failure. The core problem is that models can no longer assume inputs are merely inputs when those inputs may carry operational instructions. That weakens the boundary between content and control, which is exactly where many current AI governance designs remain thin. The implication is that instruction provenance has to become a governed boundary.

Excessive agency is the point where AI security becomes identity governance. Once a model can take actions, the programme must decide what authority it has, what it can reach, and when human review is required. That is the same governance question IAM teams already ask of privileged accounts, now applied to AI runtime behaviour. Practitioners should review scope, not just safeguards.

RAG and embedding risk expose a new trust perimeter around knowledge ingestion. Retrieval systems expand the attack surface beyond prompts into the sources the model consults. Poisoned or malicious content becomes an authority problem because the model may treat retrieved data as reliable context. The practitioner conclusion is straightforward: govern write access to retrieval corpora as carefully as read access to the model itself.

Unbounded consumption shows that AI risk is also a resource-governance issue. Once GenAI usage scales, costs, throttling, and denial conditions become security-relevant because they affect availability and control stability. That matters for programme owners who still separate spend management from security governance. The implication is that AI controls must cover operational limits, not only content safety.

From our research library:

• AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
• According to Gartner, worldwide spending on generative AI is set to reach $644 billion in 2025, a nearly 77% year-over-year increase.
• Read next: AI Agent Identity Security Buyer's Guide

What this signals

Prompt injection and excessive agency together redefine the GenAI attack surface. Security teams should assume that the model layer is now a runtime decision point, not a passive text service. That changes how access, tool use, and output review have to be governed across the AI stack.

LLM governance has to cover who can influence the retrieval corpus, who can grant tool scope, and who can approve action paths. The old separation between application security and IAM is breaking down here. If those controls live in different teams, the programme will miss the point where model behaviour becomes operational risk.

AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers. That scale reinforces why identity and secrets governance around AI infrastructure matters as much as model content safety.

For practitioners

• Tighten prompt boundary controls Separate system instructions from user and retrieved content, and test whether untrusted text can influence tool use or policy output.
• Limit agentic authority Define explicit action scopes, approval gates, and tool permissions before enabling any LLM to initiate workflow steps.
• Govern retrieval write paths Restrict who can add or modify corpus content, and review ingestion pipelines for poisoning, drift, and stale source material.
• Add controls for disclosure and output trust Monitor for sensitive information disclosure, system prompt leakage, and unsupported model assertions in high-risk workflows.

Key takeaways

• OWASP’s 2025 update treats LLM risk as a runtime governance problem, not just a model safety problem.
• The article’s focus on prompt injection, disclosure, agency, retrieval, misinformation, and consumption shows that GenAI controls must span instructions, data, and actions.
• Security teams need to govern who can influence AI behaviour, what the system can access, and what it is allowed to do.

Key terms

• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Excessive agency: A condition where an AI system is given more operational authority than its task requires. The risk is not just poor output. It is that mistakes, manipulation, or compromise can produce destructive actions at machine speed across the systems the agent can reach.
• Retrieval-augmented Generation: Retrieval-augmented generation is a pattern where an AI model pulls external information before generating output. The security challenge is that access rules can weaken when data is chunked, embedded, cached, or reused, so source permissions may not automatically follow the content into the model's context.
• System Prompt Leakage: System prompt leakage is the exposure of hidden prompt content to users or attackers. The real security problem is usually not the prompt itself, but the secrets, policy logic, and internal architecture details placed inside it. If those details are sensitive, they should live in code or secrets management instead.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.