OWASP Top 10 for LLM Applications 2025: An Australian Guide

The OWASP Top 10 for LLM Applications is the industry reference list of the most critical security risks in applications built on large language models. The current version was published on 12 March 2025 by the OWASP GenAI Security Project. This guide explains all ten risks (LLM01 to LLM10), a practical mitigation for each, and how Australian teams can map them to recognised controls such as ISO/IEC 42001 and the NIST AI Risk Management Framework.

What is the OWASP Top 10 for LLM Applications?

The OWASP Top 10 for LLM Applications is a community-built list of the ten most significant security risks specific to applications that use large language models, including chatbots, copilots, retrieval-augmented generation (RAG) systems and AI agents. It is maintained by the OWASP GenAI Security Project. The 2025 edition (v2025) replaced the original 2023 list and reflects how quickly the risk landscape has moved as organisations move AI from pilots into production.

Why it matters for Australian teams in 2026

AI risk now has a measurable price. IBM’s Cost of a Data Breach Report 2025 found that 20% of breached organisations were compromised through shadow AI, adding around US$670,000 to the average breach, and that 97% of organisations breached through AI lacked proper AI access controls. Looking ahead, Gartner (April 2026) predicts that by 2028, 25% of enterprise generative-AI applications will experience at least five minor security incidents a year, up from 9% in 2025.

For Australian organisations, these risks also carry regulatory weight. Sensitive data leaking from an AI application can trigger obligations under the Privacy Act’s Notifiable Data Breaches scheme, and boards increasingly expect evidence that AI is governed responsibly. The OWASP list gives development and security teams a shared, practical starting point.

What changed from the 2023 list

The 2025 update reflects production experience. Two risks are new: System Prompt Leakage and Vector and Embedding Weaknesses, the latter driven by the rise of RAG. Several items were reframed: “Insecure Output Handling” became Improper Output Handling, “Model Denial of Service” broadened into Unbounded Consumption, and “Overreliance” was sharpened into Misinformation. Standalone entries for model theft and insecure plugin design were absorbed into other risks.

The OWASP Top 10 for LLM Applications 2025 explained

LLM01: Prompt Injection

Crafted inputs, delivered directly or indirectly through content the model reads, alter its behaviour and bypass intended instructions or guardrails. It is the number one risk. Mitigate it with input and output guardrails, clear separation of system and user context, least-privilege access for any tools the model can call, and validation of content pulled from RAG sources or plugins.

LLM02: Sensitive Information Disclosure

The model exposes confidential data, such as personal information, secrets or proprietary logic, in its responses. Mitigate it with data minimisation, output filtering and redaction, and tokenisation of sensitive identifiers before they reach the model.

LLM03: Supply Chain

Vulnerable third-party models, datasets, plugins or dependencies compromise the LLM pipeline. Vet and pin the provenance of every model, dataset and plugin, maintain a bill of materials for your AI components, and verify signatures.

LLM04: Data and Model Poisoning

Malicious manipulation of pre-training, fine-tuning or embedding data corrupts how the model behaves. Source-control and validate training data, track provenance, and apply anomaly detection to spot tampering.

LLM05: Improper Output Handling

Unvalidated model output passed to downstream systems can enable injection, server-side request forgery, cross-site scripting or even remote code execution. Treat model output as untrusted: encode and sanitise it before use, and parameterise any queries it feeds.

LLM06: Excessive Agency

Excessive permissions, functionality or autonomy let an influenced model take harmful real-world actions. Apply least-privilege access to tools, scope agent permissions tightly, and require human approval for high-impact actions.

LLM07: System Prompt Leakage

Internal system prompts leak, exposing operational logic, rules or embedded secrets. Never place secrets in system prompts, assume the prompt is discoverable, and externalise authorisation decisions rather than relying on prompt instructions.

LLM08: Vector and Embedding Weaknesses

Flaws in vector stores and embeddings, common in RAG systems, enable data leakage or manipulation of what the model retrieves. Apply access control and tenant isolation to vector stores, permission and validate RAG sources, and encrypt embeddings.

LLM09: Misinformation

The model generates plausible but false or fabricated content that users may act on. Ground responses in retrieved sources, cite them, and add verification or human review for high-stakes outputs.

LLM10: Unbounded Consumption

Uncontrolled use of compute, tokens or queries causes denial of service, runaway costs or model extraction. Apply rate limiting, quotas and token or compute budgets, and monitor for extraction and cost-abuse patterns.

Mapping the OWASP LLM Top 10 to your controls

The value of the list is not the risks alone, it is turning them into governed controls. Each risk maps to established frameworks, so you can manage AI security as part of your existing programme rather than as a separate silo.

Risks that involve the model taking action or being manipulated (LLM01, LLM06, LLM09) are best validated by adversarially testing the application, which is where penetration testing and AI red-teaming come in.

How CyberPulse helps Australian teams secure LLM applications

CyberPulse secures both sides of AI: how your team uses it, and how safe the AI systems you build really are. We test and harden LLM applications against the OWASP Top 10, apply runtime guardrails, and govern the programme to a recognised standard. That means mapping the risks above to controls, establishing an AI Management System under ISO/IEC 42001, and monitoring AI systems around the clock. See our AI security services for how it fits together.

Frequently asked questions

What is the OWASP Top 10 for LLM Applications 2025?

It is the OWASP GenAI Security Project’s list of the ten most critical security risks in applications built on large language models, from prompt injection to unbounded consumption. It gives developers and security teams a shared reference for building and testing AI applications.

When was the OWASP LLM Top 10 last updated?

The current version, v2025, was published on 12 March 2025. It replaced the original 2023 list and added System Prompt Leakage and Vector and Embedding Weaknesses.

What changed between the 2023 and 2025 OWASP LLM Top 10?

Two new risks were added (System Prompt Leakage and Vector and Embedding Weaknesses), several were reframed (Improper Output Handling, Unbounded Consumption, Misinformation), and standalone entries for model theft and insecure plugin design were absorbed into other risks.

What is the most critical LLM risk?

Prompt injection (LLM01) is ranked first. It covers both direct manipulation of the model and indirect injection through content the model reads, such as documents retrieved by a RAG system.

How does the OWASP LLM Top 10 relate to ISO/IEC 42001 and the NIST AI RMF?

The OWASP list identifies the technical risks; ISO/IEC 42001 and the NIST AI Risk Management Framework provide the governance structure to manage them. Mapping each risk to those frameworks turns a checklist into an auditable programme.

How can Australian organisations deploy LLM apps and stay compliant?

Test applications against the OWASP Top 10, govern AI use and development to ISO/IEC 42001, and account for Privacy Act obligations, including the Notifiable Data Breaches scheme, when AI handles personal information.

Key takeaways

• The OWASP Top 10 for LLM Applications 2025 (published 12 March 2025) is the reference list of critical risks in LLM applications.
• Prompt injection remains the top risk; System Prompt Leakage and Vector and Embedding Weaknesses are new for 2025.
• Each risk maps to controls in ISO/IEC 42001, ISO 27001 and the NIST AI RMF, so AI security can sit inside your existing programme.
• Adversarial testing of AI applications validates the highest-impact risks before attackers find them.