OWASP is the leading reference in application security. Its LLM risk list¹, in its 2025 version, covers the ten most important problems of applications that use generative AI. It is written for technical teams, so here I translate it into what it means for a company.

The first on the list, LLM01, is prompt injection²: instructions hidden in a text the AI reads, to make it do something you did not ask for. OWASP points out that these instructions can be imperceptible to a person, as long as the model processes them. I covered it in more detail in what prompt injection is and in the indirect prompt injection examples.

LLM06, excessive agency³, is what turns that flaw into a serious problem. It happens when the assistant has more functions, more permissions or more autonomy than it needs. OWASP gives very concrete examples: a document-reading extension that can also modify and delete documents, or one that connects to a database with an account that can write when it should only read. It is the subject of my article on AI agents with too many permissions.

LLM05, improper output handling⁴, is the same problem seen from the other side. If the text the model generates is passed unchecked to another system, you can end up running code or sending a database query that someone manipulated through the model. OWASP recommends treating the model like any other user and validating what it produces before it reaches the rest of your systems.

LLM02, sensitive information disclosure⁵, covers personal data, financial details, health records, confidential business information, credentials and legal documents that the AI may end up showing in its answers. Among the measures, OWASP includes applying least privilege to data and telling users not to enter sensitive information. The practical version is in what not to paste into ChatGPT.

LLM07, system prompt leakage⁶, carries a simple lesson: an assistant's internal instructions should not be treated as secret or used as a security control. According to OWASP, keys, connection strings and permissions should not be written in the prompt, and important rules should be enforced outside the model.

LLM08, vector and embedding weaknesses⁷, affects assistants that consult company documents, the ones that use RAG. If all documents sit in the same database and nobody controls who can see which, one group's information can reach another group's queries. OWASP recommends permission-aware vector databases and checking what goes into the knowledge base, and gives an example that is easy to picture: a CV with hidden text, white on white, telling the screening system to recommend that candidate. I go deeper in the article on the AI assistant with your company's documents.

LLM03, supply chain⁸, is a reminder that an assistant is built from third-party parts: models, libraries and data. OWASP cites the PoisonGPT attack, which changed a model's parameters directly to get past Hugging Face's safety features, and describes a scenario with a fake copy of a popular model carrying malware. For a small business the takeaway is simple: use models from verifiable sources and keep what you install up to date.

LLM04, data and model poisoning⁹, is the manipulation of the data used to train or fine-tune a model, or the data it is given to consult, in order to introduce bias or backdoors. It mostly affects those who train their own model, but also anyone feeding an assistant documents of doubtful origin.

LLM09, misinformation¹⁰, covers false answers that look credible. OWASP mentions the Air Canada chatbot case, which gave travellers incorrect information, and ChatGPT fabricating legal cases that caused problems in court. Its recommendations include checking answers against trusted external sources and keeping human oversight on anything critical.

LLM10, unbounded consumption¹¹, covers the fact that excessive or abusive use can take the service down or inflate the bill. OWASP calls it "denial of wallet" and proposes usage limits, quotas and consumption monitoring. A related real-world case is stolen API keys, which I explained in what LLMjacking is.