OWASP Top 10 for LLM and Gen AI apps (2025): questions to put to a vendor

Why this page: buyers of generative AI tools keep meeting the OWASP list in security questionnaires, and the site had no page that reads it. This page covers five of the ten entries that matter most when a model is wired to data and actions. It quotes OWASP’s own text. The questions at the end of each section are the site’s editorial judgment, not OWASP’s. For where this fits next to NIST, see the NIST AI RMF explainer.

What the list is

OWASP’s index page presents the 2025 Top 10 Risk & Mitigations for LLMs and Gen AI Apps and describes it as covering the latest Top 10 risks, vulnerabilities and mitigations for developing and securing generative AI and large language model applications across the development, deployment and management lifecycle. The ten entries it teases include prompt injection, sensitive information, supply chain, data poisoning, improper output handling, excessive agency, system prompt leakage, vectors and embeddings, misinformation and unbounded consumption.

LLM01 Prompt injection

OWASP defines it: A Prompt Injection Vulnerability occurs when user prompts alter the LLM’s behavior or output in unintended ways. It also says that it is unclear if there are fool-proof methods of prevention for prompt injection, so the listed measures reduce impact. One of them: Restrict the model’s access privileges to the minimum necessary for its intended operations.

Question for the vendor (editorial): what can the model do if its instructions are overridden, and which of those actions need a human or a deterministic check first?

LLM03 Supply chain

OWASP says LLM supply chains are susceptible to various vulnerabilities, which can affect the integrity of training data, models, and deployment platforms. Its mitigations include Maintain an up-to-date inventory of components using a Software Bill of Materials (SBOM) and Only use models from verifiable sources and use third-party model integrity checks with signing and file hashes to compensate for the lack of strong model provenance. Our own SBOM and AIBOM article goes further on provenance.

Question for the vendor (editorial): which third-party models and datasets are in the product, and how are their hashes or signatures checked?

LLM04 Data and model poisoning

OWASP says Data poisoning occurs when pre-training, fine-tuning, or embedding data is manipulated to introduce vulnerabilities, backdoors, or biases. Among its mitigations: Track data origins and transformations using tools like OWASP CycloneDX or ML-BOM.

Question for the vendor (editorial): can you show where fine-tuning and retrieval data came from and who can change it?

LLM05 Improper output handling

OWASP says it refers specifically to insufficient validation, sanitization, and handling of the outputs generated by large language models before they are passed downstream to other components and systems. The first mitigation is to treat the model as any other user, adopting a zero-trust approach, and apply proper input validation on responses coming from the model to backend functions.

Question for the vendor (editorial): what validates model output before it reaches a database, a file system or an actuator?

LLM06 Excessive agency

OWASP names three root causes: excessive functionality; excessive permissions; excessive autonomy. The first mitigation is Limit the extensions that LLM agents are allowed to call to only the minimum necessary.

Question for the vendor (editorial): list every tool the agent can call and the permission each tool runs with.

What the list does not do

Nothing on the pages we fetched makes the list a certification or a regulatory means of compliance. It is a security-risk catalogue. A buyer in a regulated program still needs the program’s own assurance evidence; see prompt guardrails versus airborne runtime assurance and AI red-teaming requirements for defense programs.

Questions

Is the OWASP list the same as NIST AI 600-1?

No. They are separate documents from separate bodies. The site covers NIST’s side in NIST AI 600-1 for defense contractors.

Does prompt injection have a complete fix?

OWASP’s own wording on the prompt-injection page is that it is unclear if there are fool-proof methods of prevention for prompt injection. Ask for layered controls and tested limits, not a single filter.