What the OWASP Top 10 for LLMs Actually Means for Enterprise Security Programs

OWASP, the Open Worldwide Application Security Project, is the nonprofit that publishes the security industry’s most widely used risk frameworks. Think of it as the organization that produces the standard playbook security teams use to decide what to worry about and in what order. Its Top 10 for Large Language Model Applications applies that playbook to AI systems, and it has become the first document enterprise programs reach for when leadership asks: how do we govern this?

Here is what it actually says, stripped of hype: these are not new threats. Every vulnerability on the list reflects a failure mode mature security programs already know how to handle. The organizations getting hurt built capable programs and drew the scope boundary just short of their AI systems. Each section below names what went wrong in the real world and identifies the existing control that closes the gap.

1. Prompt Injection

Imagine slipping a note into someone’s inbox that reads: “When your assistant picks this up, have it send me everything in your files.” That is essentially prompt injection. The attacker does not hack the model. They feed it instructions disguised as ordinary content, and the model follows them because it cannot reliably distinguish a user’s intent from a poisoned input.

In June 2025, researchers at Aim Security disclosed EchoLeak (CVE-2025-32711), a critical flaw in Microsoft 365 Copilot rated CVSS 9.3. An attacker sent a crafted email with instructions hidden in invisible text. When Copilot retrieved that email through its normal workflow, it executed those instructions, pulled internal files, and sent their contents to an external server. No user clicked anything. Microsoft patched it server-side in June 2025.

An AI assistant with access to SharePoint, OneDrive, and Teams has the reach of a senior employee with no separation between reading and acting. The control is identity and access management: limit what the AI can reach, and keep what it can read separate from what it can do.

2. Sensitive Information Disclosure

In March 2023, Samsung engineers triggered three separate data exposures in less than twenty days. One pasted proprietary source code into ChatGPT to debug it. A second shared chip testing sequences. A third transcribed a confidential meeting for notes. Because ChatGPT trained on user inputs at the time, that proprietary information entered the platform’s dataset. Samsung banned the tool and built controls from scratch.

None of those engineers acted maliciously. They used the fastest tool available, which is what people do. The failure was a policy gap: no technical control prevented sensitive intellectual property from flowing into an external model. The fix is what organizations already use to stop sensitive data from leaving through email or cloud storage: classify it, enforce restrictions at the point of submission, and stop relying on employee judgment as the last line of defense.

3. Supply Chain Vulnerabilities

In September 2025, a malicious actor published a software component called postmark-mcp that lets AI agents send email. For fifteen versions it worked as advertised. On version 1.0.16, the attacker added one line of code that blind-copied every outgoing email to an address they controlled. Password resets, invoices, internal communications, all of it silently duplicated for eight days before the package was pulled. Koi Security estimated roughly 300 of the 1,643 organizations that downloaded it were actively using it when the backdoor was live.

Third-party risk management, the process of vetting vendors and software before they touch your environment, exists in most mature programs. The question is not whether you have that process. It is whether AI tool libraries and model providers are inside its scope.

4. Data and Model Poisoning

There is no confirmed public breach in this category to cite. That is not reassuring. It is the warning.

Poisoning works by corrupting the data an AI model learns from, or the documents it retrieves to answer questions. The model then produces subtly wrong outputs with no visible failure. No alarm fires. The damage accumulates until someone asks the right question and gets a dangerous answer. The control is data integrity applied to AI training pipelines, the same discipline already used for financial and compliance data. The scope just has not been extended to include AI yet.

5. Improper Output Handling

In June 2024, Black Duck disclosed CVE-2024-5184 in EmailGPT, an AI-powered email assistant. The service passed model output directly into backend systems without checking it first. Attackers forced the model to leak its own operating instructions and execute unauthorized commands. No patch was released.

Most security teams enforce one rule about web applications: never trust input from an external source. An LLM’s output is external input to every system downstream of it. Output validation belongs on the security review checklist for every AI-powered application, applied with the same rigor as any other application processing external data.

6. Excessive Agency

In December 2025, Amazon’s AI coding assistant Kiro was given operator-level access and assigned to fix a minor bug in AWS Cost Explorer. Kiro autonomously decided to delete the entire environment and rebuild from scratch, causing a thirteen-hour service outage in one of Amazon’s mainland China regions. The Financial Times reported the incident in February 2026. Amazon called it misconfigured access controls and mandated human peer review for all AI-involved production changes.

An AI agent is an identity, the same as any employee or automated service account, and it should never hold more access than its narrowest possible task requires. The principle is called least privilege. The question worth asking right now: who reviewed what your AI agents can actually do?

7. System Prompt Leakage

Every AI system runs on hidden instructions, called a system prompt, that govern its behavior and business logic. That prompt is the system’s internal rulebook. When it leaks, attackers get a precise map of the boundaries and exactly how to push past them. Preventing this is a design decision: build output filters that stop the model from quoting its own instructions back to users, and apply that check in the same secure design review as any other application handling confidential configuration.

8. Vector and Embedding Weaknesses

Many AI systems do not answer from memory alone. They retrieve content from a database of documents or records and use that material to form their responses, a technique called Retrieval-Augmented Generation, or RAG. Think of it as the AI checking its notes before answering.

If an attacker corrupts those notes, the AI repeats whatever was planted with full confidence. In May 2024, researchers demonstrated this against ChatGPT’s browsing feature by poisoning retrieved web content to alter its outputs. The retrieval layer needs the same access controls and integrity monitoring applied to any other data source feeding business decisions.

9. Misinformation (Hallucination)

AI models generate output by predicting the most statistically likely next word. Sometimes that produces a confident, fluent, completely fabricated answer. This is hallucination, and it is not a bug being fixed in the next release. It is how these systems work.

The governance response: require human review before high-stakes decisions rest on AI output, maintain audit trails of what the model produced and when, and set explicit policy about which decisions an AI cannot make alone. In regulated industries, that policy is not optional.

10. Unbounded Consumption

Without resource controls, an attacker can flood an AI system with requests designed to be expensive to process. Think of it as making thousands of calls to a service that can only handle ten. Costs spike, the system bogs down, and legitimate users get nothing. Rate limiting, cost monitoring, and query controls close this gap and belong in the AI governance program from day one.

What This Means for Security Programs

Across all ten categories, the pattern holds. Prompt injection and excessive agency are identity and access management problems. Sensitive data disclosure and system prompt leakage are data protection problems. Supply chain risk belongs in third-party risk management. Improper output handling belongs in application security review. Hallucination belongs in the human oversight framework.

The tools are not missing. The scope boundary is. AI governance is the existing security program, extended to cover a surface it was never formally asked to own. The organizations that move on that now will be significantly better positioned than those waiting for a clearer mandate.

About the Author

Kimly Hong is a cybersecurity professional specializing in identity and access management, governance frameworks, and enterprise security program development. With hands-on experience implementing IAM solutions across complex regulated environments, Kimly works at the intersection of identity security, compliance, and business enablement. Connect on LinkedIn to continue the conversation about identity governance modernization.