Skip to main content

> ML_STANDARD // OWASP-TOP-10-FOR-LARGE-LANGUAGE-MODELS_v1.0

OWASP Top 10 for Large Language Model Applications (2025 Edition)

Open Web Application Security Project (OWASP Foundation) · Global Cyber Security Standard · active

guidanceGlobal Cyber Security Standardactive
Official StandardBack to Standards

Regulatory & Technical Framework Summary

Industry-standard vulnerability taxonomy detailing the top 10 security risks in deploying generative AI and LLMs in production systems.

Key Compliance Requirements

  • LLM01: Prompt Injection (Direct jailbreaks and indirect injection via retrieved context)
  • LLM02: Sensitive Information Disclosure (PII leakage, model inversion, memorization extraction)
  • LLM03: Supply Chain Vulnerabilities (Compromised weights, toxic datasets, poisoned LoRA adapters)
  • LLM04: Data and Model Poisoning (Manipulating training data to introduce backdoors)
  • LLM05: Improper Output Handling (Cross-Site Scripting, SQLi via untrusted model outputs)

Applicable Sectors & Tasks

Affected Sectors:
financetechnologyhealthcareecommerce
Affected Tasks:
text generationautonomous agentsquestion answering

TinyCTO provides regulatory summaries and technical engineering alignment for informational purposes only. This content does not constitute formal legal advice or regulatory compliance certification.