OWASP Top 10 for Large Language Model Applications
Names prompt injection, sensitive information disclosure, excessive agency, and improper output handling among the top risks for applications built on language models, with mitigations for each.
Draft mapping. Drafted by the Register's agents from the rule's text and not yet confirmed by a person. It is the Register's reading, not legal advice: whether and how the rule applies to you is a question for counsel.
Controls this rule maps to
Required by the text The rule's text requires a measure that is this control, or plainly includes it. Implied A binding rule whose purpose needs this control, but whose text does not name it. The Register's reading. Recommended A voluntary standard or guidance recommends it; nothing binds you to it. Proposed Appears in a proposed rule or proposed provision that is not yet in force.
| Control | Strength | Where in the rule, and why | Confidence | Missing or failed in |
|---|---|---|---|---|
| Retrieved content as data C-I1 | Recommended | LLM01 prompt injection: treat retrieved and user content as data | high | 5 cases |
| Least-privilege credential scoped to task C-E1 | Recommended | LLM06 excessive agency: limit the extensions, permissions, and autonomy granted | high | 5 cases |
| Destructive-action gate C-E3 | Recommended | excessive agency mitigations include human approval for high-impact actions | medium | 5 cases |
| Independent audit log C-V1 | Recommended | logging and monitoring of agent actions | medium | 1 case |