OWASP Top 10 for LLM

Manipulates large language models (LLMs) through crafted inputs, causing the LLM to perform unintended actions. Direct injections overwrite system prompts, while indirect injections manipulate inputs from external sources.

Sensitive information in LLMs includes PII, financial, health, business, security and legal data. Proprietary models face additional risks from unique training methods and source code.

LLM supply chains face risks across training data, models and platforms, leading to bias, breaches or failures. Unlike traditional software, ML risks include third-party pre-trained models and data vulnerabilities.

Data poisoning manipulates pre-training, fine-tuning or embedding data to introduce vulnerabilities, biases or backdoors. Risks include degraded performance, harmful outputs, toxic content and compromise of downstream systems.

Improper output handling involves insufficient validation of LLM outputs before downstream use. Exploits include XSS, CSRF, SSRF, privilege escalation or remote code execution, which is distinct from overreliance.

LLM systems gain agency to act on prompts through extensions, tools or plugins. Agents dynamically select extensions and perform iterative LLM calls.

System prompt leakage occurs when sensitive information in LLM prompts is unintentionally exposed, allowing attackers to exploit secrets. These prompts guide model behavior but can inadvertently reveal critical data.

Vector and embedding vulnerabilities in RAG with LLMs allow exploitation through weak generation, storage or retrieval. This can inject harmful content, manipulate outputs or expose sensitive data.

LLM misinformation occurs when false but credible outputs mislead users, creating risks of security breaches, reputational damage and legal liability.

Unbounded consumption occurs when an LLM application allows excessive and uncontrolled inference requests, leading to denial of service, denial of wallet through runaway costs, or model extraction.