OWASP LLM Top 10 Adopt

security governance compliance llm-risk owasp threat-modeling red-team standards

May 2026

Overview

The OWASP Top 10 for Large Language Model Applications is a community standard that catalogs the most critical security risks when building and deploying LLM-powered software. The 2025 edition added System Prompt Leakage and Vector and Embedding Weaknesses, broadened Denial of Service into Unbounded Consumption, expanded Excessive Agency for agentic architectures, renamed training data poisoning to Data and Model Poisoning, and keeps Prompt Injection at LLM01 (OWASP LLM Top 10 2025 PDF); agent-specific risks now have their own Top 10 for Agentic Applications (OWASP Top 10 for Agentic Applications for 2026).

Adopt as the baseline threat model for every LLM or agent project during design review, vendor assessment, and red teaming. Map each item to concrete controls in your application, data, and operations layers rather than treating the document as audit wallpaper.

Adoption Signals

The current 2025 list runs from LLM01 Prompt Injection to LLM10 Unbounded Consumption and is maintained by the OWASP GenAI Security Project, which the original Top 10 project has grown into (OWASP GenAI Security Project, OWASP project page).
OWASP published a separate Top 10 for Agentic Applications for 2026 on 9 December 2025, developed with more than 100 industry experts, researchers and practitioners, for agents that plan and act autonomously (OWASP GenAI Security Project).
AWS published defense-in-depth guidance for generative AI applications on AWS that is structured around the OWASP Top 10 for LLMs (January 2024, based on the 2023 list) (AWS Machine Learning Blog).
The open-source red-teaming tool Promptfoo ships an OWASP LLM Top 10 preset that tests each category and reports findings per category from LLM01 to LLM10 (Promptfoo docs).

Risks

Treating the Top 10 as exhaustive misses organization-specific threats and business logic abuse.
Generic mitigations may not cover multimodal or tool-using agent attack surfaces.
Documentation drift if engineering ships features faster than security updates mappings.
Overclassification of all AI issues under LLM risks can neglect classic AppSec fundamentals.

Pros & Cons

Advantages

Provides a shared vocabulary for LLM-specific risks from prompt injection to supply chain issues.
The 2025 list adds system prompt leakage and vector and embedding weaknesses, broadens denial of service into unbounded consumption, and has a companion Top 10 for agentic applications.
Its LLM01 to LLM10 IDs are used by cloud security guidance and built into red-teaming tools such as Promptfoo.

Disadvantages

Checklist usage without threat modeling can create checkbox compliance without real controls.
Does not prescribe specific implementations; teams still must map risks to their stack.
Attacker tactics change faster than the list is revised, so continuous monitoring is still needed.

Recommendation

Adopt the OWASP LLM Top 10 as mandatory input to architecture review for any GenAI feature. Maintain a living control matrix mapping each risk to tests, monitors, and owners. Refresh mappings when you add agents, tools, or new data sources, and apply the Top 10 for Agentic Applications to any agent that calls tools or acts on its own.