The OWASP Top 10 for LLM apps, in plain English
The threat list every AI PM should be able to recite from memory.
The list exists so teams stop inventing their own threat vocabulary. The recurring themes are worth memorising even if the exact ordering shifts between revisions.
Prompt injection and insecure output handling are the two that cause most real incidents. Excessive agency — giving an agent more permission than the task needs — turns both from an embarrassment into a breach.
The rest cluster around data: sensitive information disclosure, poisoning of training or retrieval data, supply chain risk from models and plugins you did not build, and unbounded consumption running up cost or denying service.
The shape of it
- 01
Prompt injection
Untrusted text steers the model. Contain, don't argue with it.
- 02
Insecure output handling
Model output reaching a shell, SQL or the DOM unchecked.
- 03
Excessive agency
Tools and credentials broader than the task requires.
- 04
Data disclosure
Secrets and other users' data leaking through context.
- 05
Supply chain
Third-party models, adapters and plugins you did not review.
Want this applied to your situation?
Sessions are direct and specific — you leave with a decision, not a reading list.
Book a session