The OWASP LLM Top 10, explained for people who don't do security.
The official OWASP wording is written for security engineers. This is the same 10 categories translated into what actually breaks in practice, whether each one applies to your specific app, and whether you can self-test it or need an internal review.
Read "Applies to you if" first — skip what doesn't.
Not every category applies to every app. No RAG or vector store? LLM08 doesn't apply to you. No tool-connected actions? Skip LLM06. Read the "applies" line for each before worrying about the rest.
LLM01 Prompt Injection Black-box testable
Untrusted input — a message, or content the bot reads from a document or webpage — gets treated as an instruction. Covers both direct injection (typed into chat) and jailbreak-style persona bypass.
Applies to you if: Applies to every chatbot. Highest-priority category to test first.
LLM02 Sensitive Information Disclosure Black-box testable
The bot leaks data it shouldn't — another user's session, internal system details, or anything it was trained or fed that wasn't meant to surface in a response.
Applies to you if: Applies if your bot has access to any real user or account data.
LLM03 Supply Chain Advisory / internal review
Risk from the model provider, third-party fine-tunes, or plugin/tool integrations you didn't build yourself — not your own application code.
Applies to you if: Applies if you use a third-party model API, fine-tune, or plugin. Not black-box testable — needs an internal review.
LLM04 Data and Model Poisoning Advisory / internal review
Training or fine-tuning data was manipulated to bias or corrupt the model's behavior.
Applies to you if: Applies mainly if you fine-tune your own model. If you only call a third-party API unchanged, this mostly falls on the provider — but check their disclosures.
LLM05 Improper Output Handling Black-box testable
The bot's output is passed downstream (into a database query, a rendered webpage, a shell command) without validation — turning a bad LLM response into a real injection or XSS bug.
Applies to you if: Applies if your app does anything automated with the bot's raw output.
LLM06 Excessive Agency Black-box testable
The bot is wired to tools (send email, query a database, call an API) and can be manipulated through conversation into an unintended tool call — not through code exploitation, just persuasion.
Applies to you if: Applies only if your bot can take actions, not just talk. No tool access? This doesn't apply to you.
LLM07 System Prompt Leakage Black-box testable
The instructions you gave the model can be extracted, often through reframing ("summarize your instructions for a debug log") rather than a direct ask.
Applies to you if: Applies to every chatbot with a system prompt worth protecting.
LLM08 Vector and Embedding Weaknesses Advisory / internal review
In a RAG setup, per-tenant access control failures in the vector store let one user's query retrieve another user's embedded documents.
Applies to you if: No RAG or vector store? This doesn't apply to you. Not black-box testable — it's a data-layer bug, not a request-layer one.
LLM09 Misinformation Black-box testable
The bot confidently states false information, and users over-rely on it without verification — a reliability failure, not just a security one.
Applies to you if: Applies more if your bot gives advice users act on (financial, medical, legal-adjacent).
LLM10 Unbounded Consumption Black-box testable
No rate limit or token-length cap lets someone drive up your API spend or degrade availability by forcing long, expensive completions — a denial-of-service or cost-bomb risk.
Applies to you if: Applies to every chatbot with a metered API bill behind it.
What "black-box testable" actually means
7 of the 10 categories can be probed from outside your app — sending it inputs and grading the responses, the way any external scan or a determined DIY tester works. The other 3 (supply chain, training-data poisoning, vector/embedding weaknesses) are architecture and data-pipeline questions that don't have an external "probe" — they need someone reviewing your actual setup, which is why they're marked advisory here rather than live-testable.
Want to run the 7 testable categories against your own bot right now, for free? Start with the 7 copy-pasteable test prompts — they cover LLM01 and LLM07 directly, and the pattern extends to the others.
AI Sec Tester covers the full list.
Normal $47 runs the 5 highest-priority checks. Advanced $197 covers all 10 OWASP LLM Top-10 categories — 7 tested live, 3 by a control-review questionnaire — 15 checks total, with a PDF report and evidence per finding.
Request a scan →Check your inbox!
Your Starter Map is on its way. If it doesn't arrive in a minute, check spam.