The OWASP Top 10 for LLM and generative AI applications is a starting point for reviewing common risks. Use the edition explicitly: the official page currently identifies the 2025 list, whose categories differ from the 2023–24 edition.
The 2025 categories
- LLM01: Prompt Injection
- LLM02: Sensitive Information Disclosure
- LLM03: Supply Chain
- LLM04: Data and Model Poisoning
- LLM05: Improper Output Handling
- LLM06: Excessive Agency
- LLM07: System Prompt Leakage
- LLM08: Vector and Embedding Weaknesses
- LLM09: Misinformation
- LLM10: Unbounded Consumption
Apply the list to your application
Map each relevant category to a concrete entry point, trusted resource, action boundary, and test. For a retrieved document, test whether embedded instructions can influence an unauthorized tool action. For generated HTML or code, test the actual downstream interpreter and permissions.
Prefer evidence over coverage claims
Record the release, test input, expected boundary, actual result, and remaining uncertainty. A detector named after a category does not establish that all related vulnerabilities are prevented.
Maintain the review
Revisit the relevant tests when tools, data sources, models, and permissions change. This guide is an application checklist, not an assertion that DriftRail detects or prevents every OWASP risk.
References and further reading
Maintained by DriftRail. AI assisted the October 2026 content and template revision. Examples are illustrative; they are not measured product benchmarks. Suggest a correction.