OWASP Top 10 for LLMs

An attacker crafts inputs that override the LLM's original instructions, causing it to execute unintended actions. This is the most widely exploited LLM vulnerability.

LLMs may reveal confidential data through their outputs — including training data, system prompts, PII, or proprietary information they were never meant to share.

LLM applications depend on third-party models, training data, plugins, and packages that can be compromised — introducing vulnerabilities before your code even runs.

Attackers manipulate the data used to train or fine-tune an LLM, embedding biases, backdoors, or vulnerabilities that persist in the deployed model.

When LLM outputs are passed to downstream systems without validation, they can trigger XSS, SSRF, SQL injection, or remote code execution in connected applications.

LLMs with too many permissions, tools, or autonomous capabilities can take harmful actions — sending emails, modifying data, or executing code without adequate oversight.

Attackers extract the system prompt — revealing hidden instructions, internal logic, access to other systems, and security controls that were meant to stay confidential.

Vulnerabilities in retrieval-augmented generation (RAG) systems — where attackers manipulate vector databases or embeddings to poison the context an LLM receives.

LLMs generate confident but factually incorrect outputs (hallucinations) that users trust and act on, spreading misinformation through AI-generated authority.

Attackers exploit LLMs to consume excessive resources — through denial-of-service attacks, runaway token generation, or deliberate cost inflation of pay-per-token APIs.