Overview

The OWASP GenAI Security Project is a global, community-driven and expert-led initiative that produces freely available open-source guidance for securing generative AI and large language model (LLM) systems. It began in 2023 as the OWASP Top 10 for LLM Applications and, after rapid adoption, expanded into a broad project covering the full GenAI security lifecycle.

In March 2025 OWASP promoted it to flagship status. The community now spans over 600 contributing experts from more than 18 countries, over 130 companies, and nearly 8,000 active members, making it one of the most active references for practical AI security.

Core content

OWASP Top 10 for LLM Applications (2025)

The flagship deliverable lists the ten most critical security risks for applications built on LLMs. The 2025 edition refines earlier lists and adds risks specific to agentic and retrieval-augmented systems.

  • LLM01 Prompt Injection — crafted inputs manipulate the model into unintended or malicious behavior.
  • LLM02 Sensitive Information Disclosure — leakage of confidential data, PII or proprietary content through model outputs.
  • LLM03 Supply Chain — vulnerable models, datasets, plugins or dependencies introduced during development and deployment.
  • LLM04 Data and Model Poisoning — corrupted training or fine-tuning data that compromises model integrity and outputs.
  • LLM05 Improper Output Handling — insufficient validation of model output before it reaches downstream systems (XSS, SSRF, code execution).
  • LLM06 Excessive Agency — over-granting tools, permissions or autonomy to an LLM without adequate safeguards.
  • LLM07 System Prompt Leakage — exposure of system prompts that reveal guardrails, secrets or logic.
  • LLM08 Vector and Embedding Weaknesses — security gaps in vector stores, embeddings and RAG pipelines.
  • LLM09 Misinformation — generation of false, biased or fabricated content (including hallucinations) that misleads users.
  • LLM10 Unbounded Consumption — uncontrolled resource use causing denial of service, runaway cost or model extraction.

Initiatives & working groups

Beyond the Top 10, the project runs several specialized working groups (initiatives), each producing dedicated guidance, frameworks and tools for a slice of GenAI security.

  • Agentic Security Initiative — threat models and mitigations for autonomous and multi-agent systems (e.g. the Agentic AI Threats & Mitigations and Multi-Agentic System Threat Modeling guides).
  • AI Red Teaming & Evaluation — methodologies, benchmarks and the GenAI Red Teaming Guide for testing models against vulnerabilities and bias.
  • Secure AI Adoption & Governance — an AI Security Center of Excellence guide and governance frameworks for adopting AI safely and ethically.
  • AI Threat Intelligence & Response — tracking how LLMs are used to generate exploits, plus deepfake threat preparation and incident response.
  • Data Security — best practices for protecting training data, embeddings and data flows across the GenAI lifecycle.
  • Risk & Exploit Data Gathering / Mapping — real-world risk data and crosswalks mapping the Top 10 to NIST, ISO, MITRE and other frameworks.
  • AI Security Solutions Landscape — a directory categorizing commercial and open-source tooling that addresses GenAI risks.

How it's used

Teams use the Top 10 for LLM Applications as a checklist during design reviews, threat modeling and penetration testing of AI features, and as a shared vocabulary between developers, security and leadership. The deeper initiative guides support red teaming exercises, secure-adoption policy, agent architecture review and vendor evaluation.

Map each LLM risk to concrete controls in your stack — input/output validation, least-privilege tool access, supply-chain checks and resource quotas — rather than treating the list as a one-time audit.

History & versions

  • 2023 — First OWASP Top 10 for LLM Applications launched (v1.0, May 2023; v1.1 update in October 2023) as a community response to the rise of LLM apps.
  • 2024 — The effort expanded beyond a single list, adding working groups and being rechartered as the broader OWASP GenAI Security Project.
  • 2025 — The 2025 edition of the Top 10 for LLM Applications was published, and in March 2025 OWASP promoted the project to flagship status.

Resources