The OWASP Top 10 for LLM applications: A first security framework for the AI era

In 2023, the security community confronted a familiar problem in an unfamiliar form. Large language models had exploded into everyday use, powering chatbots, code assistants, and a wave of new products, but there was no shared vocabulary for the security risks they introduced. Teams that had spent years refining their understanding of web application threats suddenly faced a technology whose failure modes did not fit the old categories. OWASP, the Open Worldwide Application Security Project, answered with something the industry badly needed: the first Top 10 list for large language model applications. Here is what the list covers and why it became an instant reference point.

Why LLMs needed their own framework

OWASP's original Top 10 for web applications had long been the common language of application security, a prioritized list of the most critical risks, from injection to broken access control. But LLMs broke the model. A chatbot is not a traditional application, and its vulnerabilities, like a prompt that convinces the model to reveal secrets, or training data that poisons its behavior, did not map cleanly onto SQL injection or cross-site scripting. The OWASP Top 10 for LLM Applications, released in 2023, was an acknowledgment that a new class of system needed a new class of taxonomy. It gave security teams a place to start.

Prompt injection topped the list

The most prominent risk was prompt injection, where an attacker crafts an input that overrides the model's intended instructions. An attacker might tell a customer service bot to ignore its guidelines, or embed a hidden instruction in a document that the model later reads, causing it to exfiltrate data or perform an unintended action. Prompt injection was not a theoretical concern by 2023; it was being demonstrated against real systems, and it represented a fundamentally new kind of threat. It is hard to defend against because the model, by design, follows instructions, and distinguishing legitimate instructions from malicious ones is exactly the problem the technology has not solved.

Insecure output handling and the downstream risk

A less obvious but equally important risk was insecure output handling. A large language model is rarely deployed alone; it is wired into other systems, and its output is often fed into code, databases, or other applications without sufficient validation. When that output is attacker-influenced, it can become a vehicle for injection into those downstream systems. The risk was familiar in principle, echoing the classic injection vulnerabilities, but the LLM added a new and unpredictable source of untrusted input. Teams had to learn to treat model output with the same suspicion they applied to user input, a discipline that was not yet instinctive.

Training data poisoning and supply chain risk

The list also highlighted risks in the data and components that feed LLMs. Training data poisoning, where an attacker introduces malicious or biased content into the data a model learns from, is a slow-burning threat that can shape a model's behavior in ways that are hard to detect. Supply chain vulnerabilities in the models, libraries, and datasets that organizations import from third parties extended the software supply chain problem into the AI era. These risks echoed the hard lessons of recent years, Log4Shell and its aftermath, and made clear that the security of an AI system depended on far more than the code an organization wrote itself.

Where security awareness fits in

The OWASP LLM Top 10 was aimed primarily at developers and security teams, but it had clear implications for the broader workforce. Many of the risks, data leakage through prompt, over-reliance on model output, and the manipulation of AI agents, are triggered by everyday users, not just engineers. An employee who pastes sensitive data into a chatbot, or who trusts an AI-generated summary without verification, is acting on the human side of the very risks the list catalogs. This meant security awareness training had to expand beyond phishing and passwords to cover the safe use of AI, a theme that would only grow in the years that followed.

A framework for a moving target

The OWASP LLM Top 10 was not a finished answer, and it was never meant to be. Large language models were evolving faster than any security guidance could keep pace with, and the list was explicitly a first pass, a living document to be revised as the technology and its threats matured. Its real value in 2023 was that it gave the industry a shared starting point. Teams that had been improvising their AI security posture now had a prioritized catalog of risks to assess against, a common vocabulary to use with vendors and auditors, and a clear signal that AI security was no longer a niche concern but a core discipline.