AI Defense Stack

Framework

OWASP Top 10 for LLM Applications (2025), mapped to tools

The OWASP Top 10 for LLM Applications names ten risks for apps built on large language models. Here is each one in plain English, the kinds of control that address it, and the tools we map to it: 104 of the 111 tools in the directory have at least one mapping.

  • 10 risks
  • Last reviewed
OWASP's own list (opens in a new tab)

OWASP published a 2026 edition of this list on August 3, 2026 Source, checked October 21, 2026: genai.owasp.org (opens in a new tab) . Its resource page does not list the ten 2026 entries, and OWASP's list page and risk pages still show LLM01:2025 to LLM10:2025 Source, checked October 21, 2026: genai.owasp.org (opens in a new tab) , so this site keeps the 2025 ids for now. We will switch to the 2026 list once its final entries are on OWASP's list and risk pages.

Whose words are these?

The ten risks and their names are OWASP's ( Source, checked October 21, 2026: genai.owasp.org (opens in a new tab) ). The explanations, the control categories and the mapping to tools are our analysis, and each tool mapping rests on a capability the vendor documents.

The 10 risks

OWASP Top 10 for LLM Applications 2025: risk, summary, mapped categories and tool count
RiskWhat it isCategoriesTools mapped
LLM01 Prompt Injection Prompt injection happens when input to a model, including input a person cannot see, changes how the model behaves or what it outputs. 61
LLM02 Sensitive Information Disclosure Sensitive information disclosure is when a model, or the application around it, exposes data it should keep private. 64
LLM03 Supply Chain LLM supply chain risk is the chance that something you did not build is compromised before it reaches your application. 19
LLM04 Data and Model Poisoning Data and model poisoning is an integrity attack: someone tampers with pre-training, fine-tuning or embedding data to plant vulnerabilities, backdoors or bias. 6
LLM05 Improper Output Handling Improper output handling means the application does not validate, sanitize or safely handle what a model produces before it reaches other components. 9
LLM06 Excessive Agency Excessive agency is the risk that a model-driven application takes a damaging action because it was given too much functionality, too many permissions or too much autonomy. 51
LLM07 System Prompt Leakage System prompt leakage is the risk that the instructions you give a model reveal something sensitive, because attackers can often get a model to disclose them. 8
LLM08 Vector and Embedding Weaknesses Vector and embedding weaknesses are flaws in how a retrieval-augmented generation system creates, stores or retrieves vectors and embeddings. 3
LLM09 Misinformation Misinformation is the risk that a model produces false or misleading information that sounds credible, and that people or systems act on it. 12
LLM10 Unbounded Consumption Unbounded consumption happens when an LLM application lets users run excessive, uncontrolled inference. 6

Our analysis Categories and tool counts reflect our mapping. A tool appears under a risk only when a documented capability supports it. Coverage Score gives risk coverage 25 of 100 points; see how it is computed.

How to use this list

Start from the risks your application actually has. A retrieval-augmented chatbot should look at prompt injection, sensitive information disclosure and vector and embedding weaknesses. An agent with tools adds excessive agency and improper output handling. Then pick the control category that addresses each risk, and compare the tools inside it.

No tool covers every risk. Where a risk has no mapped tool in this directory, the page says so instead of guessing.

Guides that apply the list

See also MITRE ATLAS and the glossary.

Sources & last reviewed

Last reviewed . We compile from the vendors' own public pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.

Drafted with AI assistance; facts checked against primary sources on October 21, 2026.

OWASP (12 sources)