OWASP Top 10 for LLM Applications, 2025
LLM09: Misinformation
Misinformation is the risk that a model produces false or misleading information that sounds credible, and that people or systems act on it. OWASP says this can lead to security breaches, reputational damage and legal liability.
Misinformation in more detail
Hallucination is a major cause: the model fills gaps in its training data with plausible but unfounded content. Bias in training data and incomplete information also contribute, and overreliance makes the harm worse, because users trust output they have not checked. The examples OWASP gives include a chatbot that gave travelers wrong information, fabricated legal cases that caused problems in court, and code suggestions that name insecure or nonexistent libraries. Grounding answers in verified data, cross-checking output and keeping human oversight for important content are the main controls, and tools that detect ungrounded output can support them.
The risk and its name come from OWASP; the summary, examples and controls on this page are our plain-English reading of OWASP's page. Source: Source, checked October 21, 2026: genai.owasp.org (opens in a new tab)
How it shows up
- A customer-facing chatbot states something wrong and the company is held to it.
- The model cites legal cases or sources that do not exist.
- A model presents settled health questions as uncertain, or the reverse.
- A coding assistant suggests insecure or nonexistent libraries, and a developer uses them without checking.
Controls that reduce it
- Ground responses in verified external data with retrieval-augmented generation.
- Cross-check outputs against trusted sources, and use human review for critical content.
- Validate key outputs automatically, especially in high-stakes settings.
- Tell users plainly about the limits of AI-generated content, and label it.
- Apply secure coding practices so incorrect code suggestions do not become vulnerabilities.
- Train users on the model's limits and on checking facts independently.
Controls reduce risk, they do not remove it
No single control covers misinformation on its own. Combine controls, and treat any tool as one layer.
Categories that address it
Our analysisThese are the directory categories whose tools we score on this risk. The mapping is our analysis.
Layers that address this risk
Our AI security layers are an editorial model, not a standard. Source states means OWASP's own text for LLM09 names the control the layer delivers. Our analysis means we drew the link.
- L1 Governance and risk Source states
- L4 Testing and red teaming Our analysis
- L6 Runtime guardrails Source states
Tools mapped to LLM09
Our analysis12 tools are mapped. Each tool is mapped only where a documented capability supports it. Open a tool page to see the capability and its source. Coverage Score compares tools within one category.
| Tool | Type | Deployment | Pricing model | OWASP risks | Coverage Score | Last reviewed |
|---|---|---|---|---|---|---|
| garakNVIDIA · Red teaming | Open sourceApache-2.0 |
| Free |
| 82 out of 100 | |
| GiskardGiskard AI · Red teaming | Open sourceApache-2.0 |
| Freemium |
| 81 out of 100 | |
| PromptfooOpenAI (Promptfoo) · Red teaming | Open sourceMIT |
| Freemium |
| 80 out of 100 | |
| Agentic RadarZscaler (SPLX) · Red teaming | Open sourceApache-2.0 |
| Free |
| 71 out of 100 | |
| DeepTeamConfident AI · Red teaming | Open sourceApache-2.0 |
| Free |
| 71 out of 100 | |
| PortkeyPalo Alto Networks (Portkey) · Guardrails Now Prisma AIRS AI Gateway | Open sourceMIT |
| Freemium |
| 69 out of 100 | |
| Bedrock GuardrailsAmazon Web Services · Guardrails | Commercial |
| Usage-based |
| 60 out of 100 | |
| MindgardMindgard · Red teaming | Commercial |
| Not published |
| 59 out of 100 | |
| Granite GuardianIBM · Guardrails | Open sourceApache-2.0 |
| Free |
| 57 out of 100 | |
| Azure AI Content SafetyMicrosoft · Guardrails Renamed | Commercial |
| Freemium |
| 55 out of 100 | |
| Holistic AIHolistic AI · Governance | Commercial |
| Not published |
| 55 out of 100 | |
| Guardrails AIGuardrails AI · Guardrails | Open sourceApache-2.0 |
| Free |
| 52 out of 100 |
No tools match these filters. Clear a filter to see more.
Why each tool is mapped
- garak: Runs hallucination and misinformation probes against a target model.
- Giskard: Targets hallucination and checks answers against a knowledge base.
- Promptfoo: Documents hallucination and overreliance plugins that test a target for misinformation.
- Agentic Radar: The test command checks for fake news generation.
- DeepTeam: Tests a target for misinformation.
- Portkey: An output guardrail checks responses for hallucinations.
- Bedrock Guardrails: Contextual grounding checks flag responses not grounded in the source.
- Mindgard: Safety datasets include misinformation and disinformation prompts.
- Granite Guardian: Groundedness checks flag unsupported or contradicted claims in RAG answers.
- Azure AI Content Safety: Groundedness detection (preview) checks responses against source material.
- Holistic AI: The homepage cites tests for hallucination alongside bias, privacy and robustness.
- Guardrails AI: The homepage lists hallucination detection among its production guardrails.