The OWASP GenAI Security Project has published its most comprehensive update yet to the Top 10 for Large Language Model Applications, reflecting hard-won lessons from two years of enterprise LLM deployments and a rapidly expanding attack surface shaped by agentic AI adoption.
What Changed — and Why It Matters
The 2025 list, produced by more than 500 experts across industry, government, and academia, retains Prompt Injection (LLM01) at the top position — a finding consistent with OWASP's assessment that the vulnerability remains the single most exploited class of LLM flaw. However, the update introduces three entirely new risk categories and significantly reframes several others to account for the shift toward autonomous agent architectures.
The full 2025 list is: LLM01 — Prompt Injection, LLM02 — Sensitive Information Disclosure, LLM03 — Supply Chain, LLM04 — Data and Model Poisoning, LLM05 — Improper Output Handling, LLM06 — Excessive Agency, LLM07 — System Prompt Leakage, LLM08 — Vector and Embedding Weaknesses, LLM09 — Misinformation, and LLM10 — Unbounded Consumption.
Three New Entries Signal an Evolving Threat Landscape
System Prompt Leakage (LLM07) addresses a category many developers did not recognize as a vulnerability until production incidents revealed that attackers could trivially extract system-level instructions — exposing internal logic, access controls, and business rules. Vector and Embedding Weaknesses (LLM08) reflects the mass adoption of Retrieval Augmented Generation (RAG), with 53% of organizations now using RAG instead of fine-tuning, creating a broad surface for knowledge-base manipulation. Unbounded Consumption (LLM10) broadens the former Denial of Service category to include "Denial of Wallet" attacks where adversaries engineer runaway inference costs.
Excessive Agency: The Agentic AI Reckoning
LLM06 — Excessive Agency has been substantially expanded. As autonomous agents gain the ability to execute API calls, modify databases, and trigger downstream workflows without human review, the risks compound exponentially. OWASP warns that unchecked permissions can enable unintended or actively malicious actions at machine speed, reinforcing the need for least-privilege enforcement and mandatory human-in-the-loop controls for high-risk operations.
For defenders, the 2025 update provides a clear implementation roadmap: enforce input validation and output filtering on every LLM interaction, adopt strict privilege boundaries for agent tool access, implement continuous adversarial testing aligned to the Top 10 categories, and integrate AI security telemetry into existing SIEM and SOAR platforms.