OWASP Top 10 for AI apps: a plain-English guide

Why AI apps need their own checklist

The OWASP Top 10 for Large Language Model Applications is a community-maintained list of the most important security risks for products built on AI models. Traditional web security still matters, but AI features add new ways for things to go wrong — mostly because language models follow instructions from whatever text they read.

1. Prompt injection

Someone writes text that makes your AI ignore its rules. It can be typed straight into the chat, or hidden in a web page, document or email the AI is asked to read.

• Treat everything the model reads as untrusted
• Never rely on the system prompt alone to enforce security
• Check permissions in your own code before any action runs

2. Sensitive information disclosure

The AI reveals data it shouldn’t — other customers’ details, internal notes, API keys or its own hidden instructions.

• Only give the model data the current user is allowed to see
• Keep secrets out of prompts entirely

3. Supply chain risks

Third-party models, plugins, datasets and libraries can carry vulnerabilities or be tampered with.

• Use reputable providers and keep dependencies up to date
• Review what each plugin or integration can access

4. Data and model poisoning

If attackers can influence training data or the documents your AI searches, they can steer its answers.

• Control who can add content to your knowledge base
• Review sources before they’re indexed

5. Improper output handling

Your website trusts what the AI returns — for example rendering its HTML or running a query it wrote — which can lead to cross-site scripting or worse.

• Escape or sanitise AI output like any user input
• Never execute model-generated code or queries without strict checks

6. Excessive agency

An AI agent that can send emails, issue refunds or update records can be tricked into doing so on an attacker’s behalf.

• Give agents the fewest permissions possible
• Require human approval for high-impact actions

7. System prompt leakage

Hidden instructions often contain business rules or even credentials. Assume users can extract them.

• Don’t put anything secret in the system prompt

8. Vector and embedding weaknesses

In retrieval (RAG) systems, documents from one customer or department can surface in another’s answers.

• Filter search results by the user’s permissions before they reach the model

9. Misinformation

Models can produce confident but wrong answers, which matters when customers rely on them.

• Ground answers in your own content and show sources
• Make it easy to reach a human

10. Unbounded consumption

Attackers can run up large AI bills or slow your service by sending huge or repeated requests.

• Set rate limits, input size limits and spending caps

Where to start

If your AI feature can see customer data or take actions, prompt injection, data disclosure and excessive agency are the three to test first. Our complimentary AI pentest includes these checks for UK businesses.