LLM Vulnerabilities: The Top Risks Every Security Team Must Know

An LLM vulnerability is a weakness in a large language model application that lets an attacker manipulate the model's behavior, extract data it shouldn't reveal, or turn its outputs into a vector for downstream attacks. In cybersecurity, "LLM" refers to the AI models (like GPT, Claude, or Llama) now embedded in chatbots, code assistants, and internal tools — and their vulnerabilities differ from traditional software bugs because the attack surface is the natural-language input itself. The authoritative reference is the OWASP Top 10 for LLM Applications, which catalogs the ten most critical risks.

What are the top 10 LLM vulnerabilities (OWASP list)?

The OWASP Top 10 for LLM Applications is the industry-standard list — the "best LLM vulnerabilities" reference most teams start with, and the OWASP GenAI project maintains it publicly on GitHub. The ten risks are:

• LLM01: Prompt Injection — malicious input overrides the system prompt or intended instructions.
• LLM02: Insecure Output Handling — passing raw model output to downstream systems, enabling XSS, SSRF, or code execution.
• LLM03: Training Data Poisoning — tampering with training or fine-tuning data to introduce backdoors or bias.
• LLM04: Model Denial of Service — resource-heavy queries that spike cost or degrade availability.
• LLM05: Supply Chain Vulnerabilities — compromised third-party models, datasets, or plugins.
• LLM06: Sensitive Information Disclosure — the model leaking data it memorized or was given.
• LLM07: Insecure Plugin Design — plugins with insufficient input validation or access control.
• LLM08: Excessive Agency — granting the model too much autonomy, permission, or tool access.
• LLM09: Overreliance — trusting model output without verification, propagating hallucinations.
• LLM10: Model Theft — unauthorized copying or extraction of proprietary model weights.

What is the biggest problem with LLMs?

The single most consequential risk is prompt injection (LLM01), because it undermines every trust boundary you assume exists. Unlike SQL injection, there is no reliable way to fully separate instructions from data in a natural-language interface — the model reads both as text. Indirect prompt injection is worse: an attacker plants instructions in a web page, email, or document that your LLM later ingests, hijacking it without ever touching your system directly. If your LLM has tool access (email, code execution, database queries), a successful injection converts into real-world action. That intersection with Excessive Agency (LLM08) is where prompt injection stops being an annoyance and becomes a breach.

Sensitive information disclosure: the leak you don't see coming

Data leakage deserves special attention because it is silent. According to the OWASP Top 10 for LLM Applications v1.1, Sensitive Information Disclosure is ranked risk #6, and the report notes that LLMs can memorize and reproduce training data including PII, credentials, and proprietary code. This happens two ways: a model fine-tuned on internal data may regurgitate secrets to any user who prompts cleverly, and a model given confidential context in one session can expose fragments of it in another if you're not isolating tenants. The practical controls are straightforward but often skipped:

• Sanitize training and fine-tuning data — strip credentials and PII before they ever reach the model.
• Enforce least privilege on context — don't feed the model data the current user isn't authorized to see.
• Filter outputs — apply data-loss-prevention (DLP) rules to responses, not just inputs.

How to prioritize LLM vulnerabilities

Don't try to fix all ten risks at once. Prioritize by your architecture:

• If your LLM can take actions (agents, plugins, tool-calling): start with Prompt Injection (LLM01), Excessive Agency (LLM08), and Insecure Output Handling (LLM02). Constrain the blast radius — scope tokens, require human confirmation for high-impact actions, and treat every model output as untrusted input.
• If you fine-tuned on internal data: prioritize Sensitive Information Disclosure (LLM06) and Training Data Poisoning (LLM03). Audit what went into the model.
• If you rely on external models or plugins: focus on Supply Chain (LLM05) and Insecure Plugin Design (LLM07). Verify provenance and validate every plugin's input handling.

A concrete first move: map each integration point in your LLM application to the OWASP risk it exposes, then write a threat model that treats the prompt as an attacker-controlled channel. That single reframe catches most of the top risks at design time rather than in production.