OWASP Top 10 LLM Security Risks
Explore the OWASP Top 10 LLM Security Risks and learn about the most critical vulnerabilities in Large Language Model applications.
OWASP LLM Top 10 Vulnerability Ranking Table
Based on the OWASP Top 10 LLM Security Risks, organizations must implement robust security measures and regular audits to protect their LLM applications. Proper security controls, monitoring, and incident response procedures are essential for mitigating these risks.
| Rank | Vulnerability | Description | Impact |
|---|---|---|---|
| 1 | Prompt Injection | Manipulation of LLM inputs to bypass security controls and perform unintended actions. | Critical |
| 2 | Insecure Output Handling | Failure to properly validate and sanitize LLM outputs leading to various attacks. | Critical |
| 3 | Training Data Poisoning | Manipulation of training data to introduce biases or malicious behavior. | High |
| 4 | Model Denial of Service | Attacks that exhaust resources or overload the LLM system. | High |
| 5 | Supply Chain Vulnerabilities | Security risks in the LLM development and deployment pipeline. | High |
| 6 | Sensitive Information Disclosure | Inadvertent leakage of sensitive data through LLM interactions. | Critical |
| 7 | Insecure Plugin Design | Vulnerabilities in LLM plugin architecture and implementation. | High |
| 8 | Excessive Agency | LLMs performing actions beyond their intended scope. | High |
| 9 | Overreliance | Uncritical trust in LLM outputs leading to security issues. | Medium |
| 10 | Model Theft | Unauthorized access and copying of LLM models and weights. | High |
Key Threat Vector Details
Prompt Injection
Occurs through Direct injection (jailbreaking) or Indirect injection (embedding malicious commands in PDF/web pages ingested by RAG).
Insecure Output Handling
Occurs when LLM outputs are passed without validation to interpreters (executing SQL, JS, or system commands).
Model Theft
Model theft occurs through unauthorized access, model extraction queries, weight stealing, or architecture copying.
Excessive Agency
Granting autonomous LLM plugins or agents excessive permissions to execute destructive commands.