The Open Worldwide Application Security Project (OWASP) is a non-profit organization with over 20 years of experience in promoting software security education and best practices.
Table of Contents
What is OWASP?
Owasp flagship initiative, the OWASP Top 10, is a regularly updated list of the most critical web application security risks.
In May 2023, OWASP launched the Generative AI Security Project to address emerging risks associated with large language models (LLMs) and generative AI. As organizations rapidly adopt these technologies, concerns have grown around prompt injection, data leakage, and governance risks. The absence of a systematic security framework for AI prompted OWASP to create this project, which classifies risks and proposes mitigation strategies.
Trend Micro proudly supports the OWASP Generative AI Security Project as a Gold Sponsor. With nearly two decades of research and product development in AI technologies, we remain committed to our mission of “creating a world where digital information can be exchanged securely” by identifying and mitigating AI-related security risks.
"Securing LLMs is not just about technology—it’s about governance, transparency, and trust."
Source: https://www.trendmicro.com/
OWASP Top 10 for LLM Applications - 2025
Under this project, OWASP has released several versions of its AI-focused Top 10 list:
Version 0.5 (May 2023)
Version 1.1 (October 2023)
Version 2025 (November 2024)
The latest version, OWASP Top 10 for LLM Applications & Generative AI, outlines the most critical risks, recommended mitigations, and example attack scenarios. Below is an overview of the Top 10 Risks for 2025:
Prompt Injection
Prompt injection occurs when user inputs unintentionally alter the behavior or output of an LLM. This can lead to guideline violations, harmful content generation, unauthorized access, or influence over critical decisions. Techniques like retrieval-augmented generation (RAG) and fine-tuning aim to improve output quality but do not fully eliminate prompt injection vulnerabilities.
Fine-tuning refers to training a pre-trained general-purpose model on a domain-specific dataset to add specialized knowledge.
Prompt injection and jailbreaking are related concepts:
Prompt injection manipulates responses through crafted inputs.
Jailbreaking is a form of prompt injection where attackers bypass safety protocols.
Safeguards in system prompts (instructions defining the application’s intent) can help, but continuous model training and updated safety mechanisms are more effective.
Sensitive Information Disclosure
LLMs risk leaking confidential data, proprietary algorithms, or other sensitive information. Outputs may lead to unauthorized access, privacy violations, or IP infringement. Users should avoid entering confidential data into LLMs, as it could later be exposed.
Mitigation strategies include:
Sanitizing data and excluding sensitive content from training sets.
Providing clear terms of use and opt-out mechanisms for user data.
Adding restrictions in system prompts (though these can be bypassed via prompt injection).
Supply Chain Vulnerabilities
The LLM supply chain faces risks affecting training data, models, and deployment platforms. These can result in biased outputs, breaches, or failures. Unlike traditional software, LLM risks extend to third-party pre-trained models and datasets.
Open-access models and fine-tuning methods (e.g., on Hugging Face) increase exposure. On-device LLMs further expand the attack surface.
Training data poisoning
Data poisoning manipulates pre-training, fine-tuning, or embedding stages to introduce vulnerabilities or biases. This can degrade performance, ethics, and security.
Risks include:
Malicious content in external data sources.
Malware [internal link] embedded in shared or open-source models.
Backdoors acting as “sleeper agents,” triggered by specific inputs.
Insecure output handling
When LLM outputs are not validated or sanitized before reaching downstream systems, attackers can exploit vulnerabilities such as:
Cross-Site Request Forgery (CSRF)
Server-Side Request Forgery (SSRF)
Privilege escalation and remote code execution
This risk grows when LLMs have excessive privileges or when third-party extensions lack input validation.
Excessive Agency
LLM-based systems often have “agency” - the ability to invoke functions or extensions dynamically. Excessive functionality, permissions, or autonomy can compromise confidentiality, integrity, and availability, depending on connected systems.
System Prompt Leakage
System prompts guide model behavior but may contain sensitive data like credentials or connection strings. Leakage can enable attacks such as bypassing guardrails or privilege escalation. Even without full disclosure, attackers can infer guardrails through interaction patterns.
Insecure Plugin Design
In RAG-based systems, vulnerabilities in generating, storing, or retrieving vectors and embeddings can allow malicious content injection, output manipulation, or unauthorized data access.
Overreliance
LLMs may generate false or misleading content (hallucinations) that appears credible, causing reputational damage or legal risk. Causes include:
Statistical gap-filling without true understanding
Bias or incomplete training data
Overreliance on unverified outputs by users
Model theft
Uncontrolled inference requests can lead to denial of service (DoS), financial loss, model theft, or degraded service. Cloud environments are especially vulnerable due to high computational demands.
How can organizations secure LLMs?
Securing Large Language Models (LLMs) is critical as they become integral to enterprise workflows. Organizations must address risks proactively by implementing robust governance, monitoring, and technical safeguards. The OWASP Top 10 for LLMs highlights key vulnerabilities that can lead to data leaks, prompt injection attacks, and misuse if not properly mitigated.
"OWASP’s mission is to make software security visible so that individuals and organizations can make informed decisions."
Source: https://owasp.org/
Key steps organizations can take:
Implement Strong Access Controls: Restrict who can interact with LLMs and enforce authentication and authorization to prevent unauthorized use.
Validate and Sanitize Inputs: Prevent prompt injection and malicious instructions by applying strict input validation and filtering.
Monitor Outputs for Sensitive Data: Use automated tools to detect and redact confidential or personally identifiable information in generated responses.
Apply Rate Limiting and Abuse Detection: Limit excessive requests and monitor for patterns that indicate misuse or automated exploitation.
Establish Model Governance and Logging: Maintain detailed logs of interactions for auditing and compliance, and define clear policies for acceptable use.
Regularly Update and Patch Models: Keep LLM frameworks and dependencies up to date to address emerging vulnerabilities.
Train Staff on Secure Usage Practices: Educate employees on risks like data leakage and prompt injection to reduce human error.
Strengthening LLM Security with Trend Micro
The OWASP Top 10 for LLMs warns of risks like prompt injection, data leakage, and insecure plugins. Trend Vision One™ helps organizations address these challenges with:
AI Application Security – Blocks malicious prompts and plugin exploits.
Zero Trust Access – Enforces strict identity and permissions.
AI Security Posture Management – Scans for misconfigurations and vulnerabilities.
Threat Intelligence – Detects emerging AI-specific attacks.
Centralized Governance – Monitors usage and enforces policies.
With Trend Vision One™, enterprises can confidently deploy LLMs while staying secure and compliant.
Frequently Asked Questions (FAQs)
What is OWASP in cyber security?
OWASP is an open-source project providing resources, tools, and guidelines to improve web application security globally.
What is OWASP Top 10?
OWASP Top 10 is a list of the most critical web application security risks, updated regularly for developers.
How often is OWASP Top 10 updated?
OWASP Top 10 is typically updated every three years, reflecting emerging threats and evolving web application security practices.
How to use OWASP?
Use OWASP by implementing its guidelines, tools, and best practices to identify, prevent, and mitigate web application vulnerabilities.