Evolution of OWASP LLM Risks: 2023 to 2025
- Arjun Ramakrishnan
- AI Security , OWASP
- Published: 09 Apr, 2025
- Updated: 09 Apr, 2025
As large language models (LLMs) have become deeply embedded in critical enterprise systems and public-facing applications, the security landscape surrounding them has evolved as well. The OWASP Top 10 for LLM Applications — a crucial risk reference framework — has incorporated new risks and expanded existing categories to address these changes.
This article examines the shifts between the initial 2023 release and the 2025 update. The evolution reflects not only new attack vectors discovered in production environments but also the changing architecture of LLM applications themselves, particularly with the rise of retrieval-augmented generation (RAG) systems and autonomous agents.
Key Structural Changes
- Renamed/Expanded Entries: 4 categories revised for clarity
- New Additions: 2 entirely new risks added
Comparative Analysis
| 2023 Risk | 2025 Risk & Changes | Impact Shift |
|---|---|---|
| LLM01: Prompt Injection | Retained as LLM01:2025 with expanded mitigation strategies for indirect attacks and adversarial payloads. | Broader focus on hybrid attack vectors (text + multimedia). |
| LLM02: Insecure Output Handling | Renamed to LLM05:2025 Improper Output Handling, emphasizing validation failures in downstream systems. | Shifts blame to integration points rather than pure model behavior. |
| LLM03: Training Data Poisoning | Expanded to LLM04:2025 Data and Model Poisoning, covering both training data and fine-tuning risks. | Addresses supply chain vulnerabilities in third-party datasets. |
| LLM04: Model Denial of Service | Replaced by LLM10:2025 Unbounded Consumption, adding cost overruns and resource exhaustion from unconstrained LLM usage. | Broadened to include cost overruns and resource exhaustion from both malicious attacks and normal usage patterns (e.g., poorly designed agent loops) |
| LLM07: Insecure Plugin Design | Renamed to LLM06:2025 Excessive Agency, with new safeguards for autonomous agent systems. | Reflects increased adoption of agentic architectures with API access. |
New 2025 Entries
- LLM07:2025 System Prompt Leakage
- Targets exposure of hidden prompts via extraction attacks (e.g., “Repeat your instructions verbatim”).
- Mitigation: Secure prompt storage, output filtering.
- LLM08:2025 Vector/Embedding Weaknesses
- Addresses risks in RAG systems like semantic mismatches and poisoned embeddings.
- New defense: Vector database integrity checks.
Enhanced Focus Areas
- Supply Chain Risks (LLM03:2025): Mandates SBOMs for LLM components and stricter model provenance checks.
- Misinformation (LLM09:2025): Combats synthetic media generation with watermarking and content authenticity tools.
Mitigation Trends
- Proactive Controls: 2025 emphasizes runtime guardrails (e.g., LLM output scanners) over static prompts.
- Cost Governance: Rate limiting and budget alerts for API usage.
- RAG-Specific Defenses: Context window validation for retrieval-augmented generation systems.
Conclusion
The 2025 update prioritizes operational risks (costs, autonomous agents) and emerging attack surfaces (RAG, prompt leaks), while refining older categories to match modern architectures. It reflects a shift from theoretical vulnerabilities to battle-tested mitigations, particularly for enterprise-scale deployments.
As LLM-powered applications continue to proliferate in mission-critical contexts, the OWASP framework serves not only as a risk checklist but as a roadmap for secure AI development practices. Organizations implementing generative AI should view these changes as a reflection of both the rapidly evolving threat landscape and the industry’s growing understanding of how to build resilient AI systems.
