OWASP Top 10 for LLM Applications (2025)

5 min readMar 18, 2026

Introduction

In the frantic global race to integrate Large Language Models (LLMs) into the enterprise, a massive “invisible” security debt is being signed into existence. Organizations are deploying AI-driven agents and autonomous tools at breakneck speed, often under the dangerous delusion that the existing architectural paradigms of software security still apply. They don’t. Deploying these models without the specific safeguards found in the 2025 OWASP Top 10 is the digital equivalent of building a skyscraper on shifting sand.

The most uncomfortable truth for strategists is that the very techniques marketed as safety features — such as Retrieval Augmented Generation (RAG) and fine-tuning — do not actually solve the core vulnerability of prompt injection. They merely ground the model; they do not secure it. As we move into 2025, this OWASP update serves as the definitive survival guide for an era where the boundary between “data” and “instruction” has been permanently erased.

Prompt Injection is No Longer Just About Chatting

The most infamous AI risk, Prompt Injection (LLM01:2025), has undergone a terrifying evolution. While early concerns focused on “jailbreaking” a chatbot via a direct chat interface, the threat has shifted toward Indirect Prompt Injection and Cross-modal attacks.

In an indirect attack, the LLM is compromised not by the user, but by the data it consumes. A malicious actor can hide instructions within a website, a PDF, or even the pixels of an image. When the model processes this data, the hidden instructions seize control of the session.

Definition: “A Prompt Injection Vulnerability occurs when user prompts alter the LLM’s behavior or output in unintended ways. These inputs can affect the model even if they are imperceptible to humans, therefore prompt injections do not need to be human-visible/readable, as long as the content is parsed by the model.”

The rise of multimodal AI adds a layer of complexity that traditional bug-squashing cannot touch. These “Cross-modal attacks” exploit the fact that models process text and images concurrently; an instruction mathematically encoded into an image can be entirely imperceptible to humans but perfectly legible to the model. This makes securing multimodal systems a fundamentally different, and harder, problem than traditional software validation.

The “Agent” Problem (Excessive Agency)

We are rapidly moving from passive chatbots to “agentic” architectures — systems that can execute code, call APIs, and make decisions. This shift has propelled Excessive Agency (LLM06:2025) to the forefront of strategic risk. The irony is palpable: the more power you give an AI to “get things done,” the more dangerous the security holes you create.

The 2025 update distills the root causes into three punchy categories:

Excessive Functionality: Granting an agent “tooling” it doesn’t need (e.g., a document-reader agent that inexplicably has the power to delete files).
Excessive Permissions: Allowing an agent to access downstream systems using a generic high-privileged identity rather than the specific user’s OAuth context or least-privilege credentials.
Excessive Autonomy: Designing systems that execute high-impact actions — like moving funds or sending emails — without a “human-in-the-loop” approval step.

Consider an LLM-powered email assistant. If it uses a privileged service account to scan all inboxes, an indirect prompt injection from a single malicious email could command the agent to exfiltrate every user’s sensitive data. The developer’s desire for “seamless automation” becomes the architect of a catastrophic data breach.

RAG is Not a Security Silver Bullet

Retrieval Augmented Generation (RAG) is the industry’s favorite “safety” sedative, often touted as a way to prevent hallucinations and keep data private. However, LLM08:2025 Vector and Embedding Weaknesses clarifies that RAG is a new attack surface, not a shield.

The risk of Embedding Inversion Attacks is particularly chilling: attackers can exploit the mathematical vectors in a database to recover significant amounts of source information, essentially turning a retrieval system into a high-speed data leak tool. Beyond data theft, RAG introduces the risk of Behavior Alteration.

Scenario #3: Behavior Alteration An organization deploys a RAG system to ground its customer service AI in factual financial data. Originally, the base model might respond to a distressed customer with empathy, suggesting debt-management plans. After RAG is applied, the model may become cold and purely transactional, stating: “You must pay off loans quickly to avoid interest; cut unnecessary expenses.” While factually correct, the loss of empathy renders the brand’s AI practically useless and strategically damaging.

The Rise of the “Sleeper Agent”

Perhaps the most unsettling risk in the 2025 list is Data and Model Poisoning (LLM04). This involves “lobotomizing” a model (using techniques like ROME) or introducing backdoors during the fine-tuning process.

A “Sleeper Agent” model appears perfectly healthy during testing. However, it is programmed to bypass security or malfunction only when it encounters a specific “trigger” — a hidden string of characters or a specific code word. Because LLMs are binary “black boxes,” these backdoors are nearly impossible to detect with standard evaluations.

This links directly to the AI Supply Chain (LLM03). Most enterprises don’t build models; they download fine-tuning adapters (LoRAs) from public repositories like Hugging Face. If an attacker “lobotomizes” a popular open-source adapter — a technique seen in “PoisonGPT” — any company using it has effectively invited a pre-compromised agent into their internal network.

Stop Treating System Prompts Like Secrets

The inclusion of System Prompt Leakage (LLM07) in the 2025 list addresses a widespread architectural failure. For years, developers have treated system prompts (e.g., “You are a helpful assistant, do not reveal your database password”) as if they were secure firewalls.

OWASP’s 2025 guidance is blunt: System prompts are not security controls. Because LLMs are stochastic (probabilistic) rather than deterministic, they are inherently incapable of functioning as auditable security boundaries. If a secret is in the prompt, it is already gone.

Pro-Tip: Never Include These in a System Prompt

API Keys or Authentication Tokens: These belong in application code, never the prompt.
Internal Credentials or Connection Strings: If the model knows the password, the attacker does too.
Internal Role Structures: Revealing permission levels gives attackers a roadmap for privilege escalation.

Security controls must be enforced independently of the LLM in a deterministic, auditable environment. If an agent requires different access levels, use multiple agents with least-privilege configurations rather than one “god-mode” prompt.

Conclusion: Beyond the Bot

As Project Leads Steve Wilson and Ads Dawson highlight in their 2025 letter, the community has realized that “isolation” in AI is a myth. System Prompt Leakage was added specifically because real-world exploits proved that instructions cannot be hidden from determined users.

Security in the age of autonomous agents is a community-driven mandate. It requires moving past the “chatbot” mindset and toward rigorous architectural oversight. We can no longer trust the “intelligence” of the model to protect the system.

Need Help?

The functionality discussed in this post, and so much more, are available via the SOCFortress platform. Let SOCFortress help you and your team keep your infrastructure secure.

Website: https://www.socfortress.co/