OWASP
OWASP (Open Worldwide Application Security Project) is an international nonprofit open community organization focused on improving software security. Its mission is to provide security tools, documentation, guidelines, and standards free of charge through open collaboration, helping developers, organizations, and security researchers build more secure web applications. OWASP's most widely recognized outputs include the Web Application Security Top 10 risk list, testing guides, and secure development best-practice frameworks, which are broadly adopted across the global security industry and compliance assessment domains.
Core Facts
OWASP has listed prompt injection as the top security risk for large language model applications.
The PTES (Penetration Testing Execution Standard) divides the penetration testing process into phases including intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and report writing.
OWASP已将Prompt注入列为LLM应用十大安全风险之首
Timeline (last 90 days)
Prompt injection is ranked first on OWASP's list of AI risks.
Prompt injection exploits the inability of large language models to reliably distinguish instructions from data, and OWASP lists it as one of the top security threats for LLM applications.
The OWASP LLM risk list includes the Excessive Agency risk, namely that a model is given too much autonomous decision-making and execution capability without human oversight.
The first edition of the OWASP Top 10 for LLM Applications in 2023 listed Prompt Injection as LLM01, and the 2025 edition still places it first and subdivides it into direct injection and indirect injection.
Claude Code has a built-in security review process that can check for common OWASP issues and limit the scope of service account permissions.
In its security guidance for large language model applications, OWASP recommends performing actions under the identity and context of the end user and placing authorization decisions in downstream business systems rather than at the model layer.
OWASP lists prompt injection as the top risk in its Top 10 for LLM applications, and notes that it is not yet clear whether any foolproof defense exists.
OWASP's LLM01:2025 guidance lists prompt injection as one of the most prevalent and hardest-to-fully-mitigate risk categories in LLM applications, and recommends reducing impact through system-level controls such as limiting model capabilities, constraining tool permissions and adding human confirmation.
The OWASP Transaction Authorization Cheat Sheet emphasizes that authorization decisions should be made server-side based on trusted identity and resource state, rather than relying on claims submitted by the client.
OWASP recommends incorporating red team testing into the agent development lifecycle, regularly updating the attack library, and testing "worst-case" scenarios to assess whether the scope of damage is effectively limited.
30 more timeline events
All Facts (20)
OWASP has listed prompt injection as the top security risk for large language model applications.
90%VerifiedThe PTES (Penetration Testing Execution Standard) divides the penetration testing process into phases including intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and report writing.
80%VerifiedOWASP已将Prompt注入列为LLM应用十大安全风险之首
80%VerifiedVulnerabilities such as SQL injection, XSS, and SSRF have long occupied the OWASP Top 10 security risk list.
80%VerifiedThe OWASP Top 10 threat list specifically targeting LLMs was officially published in 2023.
75%VerifiedOWASP lists prompt injection as the top risk in the LLM Top 10 (LLM01).
70%VerifiedThe OWASP Top 10 vulnerability list's 2021 version added Insecure Design as a new category.
70%VerifiedOWASP ranks prompt injection as the top risk among the ten major risks for large model applications.
65%VerifiedThe principle of least privilege is considered one of the core ideas in agent security, meaning an agent should only be granted the minimum permissions necessary to complete its task.
65%VerifiedSQL injection can fundamentally isolate data from instructions through parameterized queries, whereas there is currently no equivalent "parameterized" solution for the LLM inference process.
65%VerifiedClaude Code's /security review command covers vulnerability checks for SQL injection, XSS, key leakage, and privilege escalation.
65%VerifiedOWASP lists User Enumeration Attacks as a common security risk.
65%UnverifiedThe Secure by Default principle has since been widely adopted by mainstream security frameworks such as OWASP and NIST.
60%UnverifiedThe OWASP Top 10 for LLM Applications list was updated in 2025.
60%UnverifiedThere are currently two mainstream format standards for SBOM: SPDX, led by the Linux Foundation, and CycloneDX, promoted by OWASP.
60%UnverifiedPrompt injection is ranked first on OWASP's list of AI risks.
50%UnverifiedPrompt injection exploits the inability of large language models to reliably distinguish instructions from data, and OWASP lists it as one of the top security threats for LLM applications.
50%UnverifiedThe OWASP LLM risk list includes the Excessive Agency risk, namely that a model is given too much autonomous decision-making and execution capability without human oversight.
50%UnverifiedThe first edition of the OWASP Top 10 for LLM Applications in 2023 listed Prompt Injection as LLM01, and the 2025 edition still places it first and subdivides it into direct injection and indirect injection.
50%UnverifiedClaude Code has a built-in security review process that can check for common OWASP issues and limit the scope of service account permissions.
50%