What are the OWASP Top 10 risks for LLM applications, and which would you address first?

The OWASP Top 10 for LLM Applications (2025) is the standard checklist of security risks for apps built on language models. In an interview, name the list, then prioritise for the system in front of you. For most products the first three to tackle are prompt injection, excessive agency and improper output handling, because together they turn a fooled model into real damage.

The 2025 list

1. LLM01 Prompt Injection: input that changes the model's behaviour, typed directly or hidden in content it reads.
2. LLM02 Sensitive Information Disclosure: personal data, secrets or confidential data leaking through outputs.
3. LLM03 Supply Chain: risky third-party models, datasets, plugins and libraries.
4. LLM04 Data and Model Poisoning: tampered training, fine-tuning or retrieval data.
5. LLM05 Improper Output Handling: model output passed to a browser, database or shell without validation.
6. LLM06 Excessive Agency: too many tools, permissions or autonomy.
7. LLM07 System Prompt Leakage: secrets or rules in the system prompt that get revealed.
8. LLM08 Vector and Embedding Weaknesses: leaks and poisoning through RAG stores.
9. LLM09 Misinformation: confident wrong answers that people rely on.
10. LLM10 Unbounded Consumption: runaway cost or denial of service.

Why those three first

A model will sometimes be fooled (prompt injection has no complete fix). What decides the damage is what it can do (excessive agency) and whether its output is trusted downstream (improper output handling). So:

• Least privilege: only the tools and permissions the task needs, with read-only credentials where possible, and approval for anything irreversible.
• Treat output as untrusted: escape it before rendering as HTML, use parameterised queries instead of model-written SQL, never pass it straight to a shell.
• Separate untrusted content: keep retrieved and tool text in its own blocks, marked as data.

Then, depending on the system

• RAG product: LLM08 (permission-aware retrieval) and LLM02.
• Public chat app: LLM10 (rate limits, quotas) and LLM09 (grounding, citations).
• Fine-tuned or self-hosted model: LLM03 and LLM04 (provenance of models and data).
• Any system: LLM07. Assume the system prompt can leak, so keep secrets and keys out of it, and enforce rules in code.

How to show depth

Map each risk to a control and a test: "Excessive agency: the support agent has no refund tool above 50 euros without approval, and we test with injected documents asking for refunds." A list of controls without tests is a wish list.