International · Risk taxonomy
OWASP Top 10 for LLM Applications: governance guide
The OWASP Top 10 for LLM Applications lists the most critical security risks in applications built on large language models, from prompt injection to unbounded consumption. Agents built on LLMs inherit every entry. FairMind maps the 2025 edition, numbered LLM01 to LLM10. The OWASP GenAI Security Project published a 2026 edition on 3 August 2026; re-mapping to it is pending, so evidence stays pinned to the 2025 IDs until then.
In the FairMind catalogue: 10 requirements mapped to 41 workflows and 23 evaluations.
Source: OWASP Top 10 for LLM Applications 2025; OWASP GenAI LLM Top 10 2026
OWASP LLM Top 10: what it asks of AI systems
The parts most relevant to governing AI systems and agents, summarised from the OWASP Top 10 for LLM Applications 2025.
- LLM01Prompt injection
- Inputs, typed or hidden in retrieved content, change the model's behaviour against its instructions.Mapped to: Evaluation and testing, Threat modelling, guardrails and vulnerabilities
- LLM02Sensitive information disclosure
- The application reveals personal data, credentials or confidential business data in its output.Mapped to: Threat modelling, guardrails and vulnerabilities
- LLM03Supply chain
- Third-party models, datasets, adapters or packages introduce vulnerabilities.Mapped to: AI inventory and intake, Responsible design and secure development, Threat modelling, guardrails and vulnerabilities
- LLM04Data and model poisoning
- Training, fine-tuning or embedding data is manipulated to plant backdoors, bias or errors.Mapped to: AI inventory and intake, Data governance and provenance
- LLM05Improper output handling
- Model output reaches downstream systems without validation, opening injection and code execution paths.Mapped to: Responsible design and secure development, Threat modelling, guardrails and vulnerabilities
- LLM06Excessive agency
- The model is given more functions, permissions or autonomy than the task needs.Mapped to: Agent identity, access and permission bounding, Threat modelling, guardrails and vulnerabilities
- LLM07System prompt leakage
- System prompts expose secrets or rules an attacker can use.Mapped to: Responsible design and secure development, Threat modelling, guardrails and vulnerabilities
- LLM08Vector and embedding weaknesses
- Weaknesses in how vectors and embeddings are generated, stored or retrieved in RAG systems.Mapped to: Agent identity, access and permission bounding, Data governance and provenance
- LLM09Misinformation
- The model produces false or misleading content that people or systems rely on.Mapped to: Evaluation and testing
- LLM10Unbounded consumption
- Uncontrolled inference use leads to denial of service, runaway cost or model extraction.Mapped to: Human oversight and intervention, Monitoring and logging, Threat modelling, guardrails and vulnerabilities
Evidence FairMind helps you produce
FairMind links technical evidence to OWASP LLM Top 10 obligations for a human reviewer to accept. It is not legal advice and does not decide compliance.
- 23 evaluations mapped to LLM01 to LLM10, each with a declared metric, threshold and evaluator status
- Runtime guardrail reviews and red-teaming results linked to the entries they cover
- AI-BOM and supply chain review records for models, datasets and packages
- Cost and consumption guardrails for unbounded consumption
OWASP LLM Top 10 questions
Which edition of the LLM Top 10 does FairMind map?
The 2025 edition, LLM01 to LLM10. The 2026 edition renames and reorders entries. Until the catalogue is re-mapped, every record keeps the 2025 ID it was tested against.
Does the LLM Top 10 cover AI agents?
Partly. Excessive agency (LLM06) addresses agents directly, but risks such as goal hijack, memory poisoning and rogue agents sit in the OWASP Top 10 for Agentic Applications. FairMind maps both lists to the same common controls.
How does FairMind map the LLM Top 10?
The catalogue maps all 10 entries to 8 common controls and 41 workflows. Each evaluation names its metric and threshold, and every evaluator declares whether it is validated, runs through an external provider, reads metadata only, or is not yet available.