OWASP LLM Top 10 is a community list of the main security risk categories for large language model applications. It groups issues such as prompt injection, data leakage, insecure output handling and excessive agent or tool permissions, so teams can assess controls across model behaviour, prompts, retrieval and runtime access.
What the OWASP LLM Top 10 Covers
The OWASP LLM Top 10 is not a single test or compliance standard, it is a risk taxonomy for large language model applications. It helps teams organise the most common failure patterns into a shared vocabulary for design review, testing and runtime defence.
Its value is that it turns a broad, fast-moving security space into a manageable set of categories. That makes it easier to discuss prompt injection, output handling, data leakage, retrieval weaknesses and agent permissions without treating each issue as an isolated edge case.
Why It Matters for LLM Security Work
LLM applications often blend natural language inputs, retrieved content, external tools and downstream actions, which creates several overlapping trust boundaries. The Top 10 is useful because it reflects where those boundaries tend to fail in practice, especially when model behaviour is trusted more than it should be.
For readers mapping the category set to real-world deployments, NHIMG’s OWASP Top 10 for LLM Applications Guide is a useful companion because it expands the list into prevention and testing guidance, including the 2026 renumbering and the agentic Top 10.
How the Categories Translate into Security Controls
Each risk category points to a different control emphasis. Prompt injection and indirect prompt injection drive input filtering, instruction hierarchy design and retrieval hardening. Data leakage and insecure output handling push teams toward content redaction, permission-aware retrieval and safer response policies. Excessive agent or tool permissions require tighter authorisation around tools, actions and connector scope.
That is why the list is best read as a control-planning aid rather than a checklist of bugs. A team that only reviews prompts but ignores retrieval permissions, model outputs or runtime tool access will usually leave the largest exposure untouched.
Where LLMs sit inside broader application flows, the same risks can surface through chat interfaces, APIs, RAG pipelines, copilots and agentic orchestration. The categories therefore describe system behaviour as much as model behaviour.
Using the OWASP LLM Top 10 in Governance and Testing
The most useful way to apply the Top 10 is to map each category to an owner, a test method and an evidence source. Security teams can use it to structure design reviews, red-team scenarios and control validation, while engineering teams can use it to decide where to add guardrails, logging and permission checks.
For broader programme alignment, the list also fits naturally alongside OWASP Agentic AI Top 10 when LLM features are connected to autonomous tools or delegated actions. The overlap matters because some risks begin as model-output problems and become agent-control problems once execution authority is added.
When teams treat the Top 10 as a living review lens, they are better able to track whether a new feature changes prompt trust, retrieval scope, output handling or permission boundaries.
Risk and Threat Considerations
LLM applications create concentrated exposure because a single prompt path can influence retrieval, generation and action. If the system accepts untrusted instructions or over-trusts model output, an attacker can steer behaviour, extract sensitive context, or trigger downstream misuse through tools and connectors.
Failure mechanism: Weak separation between user input, system instructions, retrieved content and action authority allows prompt injection, data exfiltration, unsafe output handling or permission abuse to propagate through the stack.
Impact: The result can be leakage of confidential data, unauthorised tool use, corrupted decisions, or compromised downstream systems that rely on model output as if it were trusted.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while OWASP ASVS and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP ASVS | V8 — Authorization | LLM apps depend on controlling which actions and resources output can trigger. |
| V16 — Security Logging and Error Handling | LLM risk handling relies on logs to spot prompt abuse, leakage and unsafe outputs. | |
| Recommendation — Enforce least-privilege authorization for tools, connectors and action paths exposed to the LLM. Log model inputs, outputs and tool actions to investigate misuse and content leakage. | ||
| OWASP API Security Top 10 | API6 — Unrestricted Access to Sensitive Business Flows | LLM agents can expose sensitive workflows when model-triggered actions lack proper flow controls. |
| Recommendation — Restrict model-triggered business flows so the LLM cannot bypass approved process boundaries. | ||
| NIST AI RMF | Govern map measure manage | The term is a governance lens for managing and measuring generative AI risk. |
| Recommendation — Map the Top 10 categories to measurable AI risk controls and monitor their residual risk. | ||
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The LLM Top 10 overlaps with delegated authority and privilege misuse in agentic workflows. |
| Recommendation — Constrain agent identity and privileges so LLM-driven actions cannot exceed approved authority. | ||
Practitioner Guidance
Why practitioners should care: The Top 10 is most useful when it becomes a shared review language across product, security and platform teams. It helps prevent the common mistake of securing only the chat front end while leaving retrieval, memory, connectors and action scopes under-governed.
Governance implication: Assign each risk category to a named control owner and make sure review coverage extends beyond the model to prompts, data flows, output consumers and tool permissions. That keeps the framework operational instead of purely educational.
Practitioner takeaway: Treat the list as a way to discover where trust is misplaced, then prove each trust boundary with testing, logging and least-privilege design.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org