Owasp Llm

# 00 Vulnerability Index

This document provides the index for the OWASP Top 10 for LLM Applications (2025) vulnerabilities.
Each entry includes its identifier, title, and primary category.

## Vulnerability catalog

| ID         | Title                            | Category               |
|------------|----------------------------------|------------------------|
| LLM01:2025 | Prompt Injection                 | Input Integrity        |
| LLM02:2025 | Sensitive Information Disclosure | Data Protection        |
| LLM03:2025 | Supply Chain                     | Supply Chain           |
| LLM04:2025 | Data and Model Poisoning         | Data Integrity         |
| LLM05:2025 | Improper Output Handling         | Output Safety          |
| LLM06:2025 | Excessive Agency                 | Access Control         |
| LLM07:2025 | System Prompt Leakage            | Configuration Security |
| LLM08:2025 | Vector and Embedding Weaknesses  | Data Integrity         |
| LLM09:2025 | Misinformation                   | Output Reliability     |
| LLM10:2025 | Unbounded Consumption            | Resource Management    |

## Cross-reference matrix

Each vulnerability document follows a consistent structure:

1. Description — what the vulnerability is and how it manifests in LLM systems.
2. Risk — concrete consequences of exploitation and business impact.
3. Vulnerability checklist — indicators that the system is exposed.
4. Prevention controls — defensive measures and rectification steps.
5. Example attack scenarios — realistic exploitation narratives.
6. Detection guidance — signals and methods to identify exposure.
7. Remediation — immediate and long-term actions to contain and resolve.

## Category groupings

### Input Integrity

* LLM01:2025 Prompt Injection

### Data Protection

* LLM02:2025 Sensitive Information Disclosure

### Supply Chain

* LLM03:2025 Supply Chain

### Data Integrity

* LLM04:2025 Data and Model Poisoning
* LLM08:2025 Vector and Embedding Weaknesses

### Output Safety

* LLM05:2025 Improper Output Handling

### Access Control

* LLM06:2025 Excessive Agency

### Configuration Security

* LLM07:2025 System Prompt Leakage

### Output Reliability

* LLM09:2025 Misinformation

### Resource Management

* LLM10:2025 Unbounded Consumption

## Related OWASP projects

* OWASP Top 10 for Agentic Applications (2026) — agentic risks that build upon LLM vulnerabilities.
* OWASP Machine Learning Security Top 10 — ML-specific security risks.
* OWASP Application Security Verification Standard (ASVS) — general application security controls.

---

Content derived from works by the OWASP Foundation, licensed under CC BY-SA 4.0
(<https://creativecommons.org/licenses/by-sa/4.0/>).
Modifications: Restructured into agent-consumable reference format with added
detection and remediation guidance.

*🤖 Crafted with precision by ✨Copilot following brilliant human instruction, then carefully refined by our team of discerning human reviewers.*


---
title: 'LLM01: Prompt Injection'
description: OWASP LLM Top 10 reference for prompt injection vulnerabilities including direct and indirect injection attack patterns and mitigations
---

# 01 Prompt Injection

Identifier: LLM01:2025
Category: Input Integrity

## Description

A prompt injection vulnerability occurs when user prompts alter the LLM's behavior or output
in unintended ways. These inputs can affect the model even if they are imperceptible to humans,
as long as the content is parsed by the LLM.

Prompt injection vulnerabilities exist in how models process prompts, and how input may force
the model to incorrectly pass prompt data to other parts of the model, potentially causing
them to violate guidelines, generate harmful content, enable unauthorized access, or influence
critical decisions. Techniques like Retrieval Augmented