OWASP Top 10 for LLM Applications is a community framework that ranks major security risks affecting systems built with large language models. It helps teams prioritise threats such as prompt injection, data leakage, and excessive agency. Security leaders use it as a practical reference for design reviews and testing.
Expanded Definition
OWASP Top 10 for LLM Applications is best understood as a risk-prioritisation guide for systems that use large language models as part of a broader application stack. It does not define one single technical control set. Instead, it groups recurring failure modes such as prompt injection, insecure output handling, training data leakage, model denial of service, and excessive agency. That makes it useful for design reviews, red-team planning, and governance discussions where the question is not whether an LLM is “safe,” but which attack paths are most credible.
Usage in the industry is still evolving because teams often blend model risk, application risk, and identity risk into one conversation. For NHI and agentic systems, that distinction matters: an LLM can be exploited through prompts while the real blast radius comes from the credentials, tokens, and tool permissions it can reach. The OWASP Agentic AI Top 10 and NIST AI Risk Management Framework both reinforce that security review must extend beyond the model itself into the system context. The most common misapplication is treating the list as a checklist for model selection, which occurs when teams ignore surrounding identity, data, and tool-access controls.
Examples and Use Cases
Implementing this framework rigorously often introduces review overhead, requiring organisations to weigh faster model deployment against deeper validation of prompts, outputs, and connected tools.
- A customer support chatbot is tested for prompt injection so malicious users cannot coerce it into revealing hidden system instructions or internal records.
- An internal coding assistant is reviewed for insecure output handling so generated code does not normalise unsafe dependencies or unsafe command execution.
- An agentic workflow is assessed for excessive agency because the model can call APIs, move data, or trigger transactions through OWASP Non-Human Identity Top 10 style credential and entitlement risks.
- A data-rich retrieval app is evaluated for training data leakage and indirect prompt injection using patterns discussed in the OWASP NHI Top 10 and related NHI guidance.
- A security team maps LLM abuse cases to MITRE ATLAS adversarial AI threat matrix tactics when testing how attackers might steer the model into unsafe actions.
Teams also use this framework to prioritise guardrails for retrieval-augmented generation, code assistants, enterprise copilots, and semi-autonomous agents that can act on behalf of users.
Why It Matters in NHI Security
For NHI security, the value of the OWASP Top 10 for LLM Applications is that it exposes where model abuse becomes identity abuse. A prompt injection issue becomes far more serious when an AI agent can reach API keys, service accounts, or delegated credentials. NHIMG research on the LLMjacking threat path shows how quickly exposed credentials are targeted, and the AI Agents: The New Attack Surface report found that 80% of organisations report agent actions beyond intended scope, including accessing unauthorised systems, sharing sensitive data, or revealing credentials. That is why model risk and NHI governance cannot be separated in practice.
In operational terms, this framework helps teams decide where to enforce input sanitisation, output filtering, human approval gates, least privilege, short-lived tokens, and strict tool boundaries. It also gives auditors a shared language for describing why an LLM incident is not just a hallucination problem but a control failure involving identity, access, and data movement. Organisations typically encounter the need for this framework only after an assistant leaks data, executes an unsafe action, or exposes secrets, at which point the term becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and CSA MAESTRO address the attack and risk surface, while NIST AI RMF and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A1 | OWASP’s agentic AI risks extend LLM app failures into tool use and delegated actions. |
| OWASP Non-Human Identity Top 10 | NHI-02 | LLM applications often fail through exposed secrets and over-privileged non-human identities. |
| NIST AI RMF | NIST AI RMF frames LLM security as governance, mapping, measurement, and management of AI risk. | |
| NIST Zero Trust (SP 800-207) | AC-4 | Zero trust limits what an LLM or agent may access even after initial authentication succeeds. |
| CSA MAESTRO | MAESTRO targets threat modeling for agentic AI systems where LLM behavior drives actions. |
Review LLM-connected agents for prompt abuse, unsafe tool calls, and excessive agency before deployment.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 28, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
