Prompt Injection occurs when attacker-controlled text causes a Large Language Model to ignore its intended instructions and follow the attacker's instructions instead. Because an LLM receives its developer instructions (the system prompt), the conversation, retrieved documents, and tool outputs as one undifferentiated stream of tokens, it has no reliable, built-in way to tell "the instructions I should obey" apart from "text I should merely process.

Sensitive Information Disclosure occurs when Large Language Models inadvertently reveal confidential, private, or sensitive data in their outputs. This can include personally identifiable information (PII), API keys, credentials, proprietary business data, or training data memorization.

Supply-Chain Vulnerabilities in LLM applications occur when attackers exploit weaknesses in the components, dependencies, models, or data sources that make up the LLM ecosystem. This includes compromised pre-trained models, poisoned datasets, vulnerable third-party libraries, malicious plugins, and insecure model repositories.

Data and Model Poisoning occurs when an attacker deliberately manipulates the data a model learns from—or the model artifact itself—so that the deployed system carries hidden biases, backdoors, or degraded behaviour that the operator never intended. Unlike prompt injection, which attacks a model at inference time, poisoning attacks the model at build time: the malicious influence is baked into the weights or into the knowledge base the model retrieves from, and it persists long after the attacker has walked away.

Improper Output Handling (LLM05 in the 2025 OWASP Top 10 for Large Language Model Applications) is the insufficient validation, sanitization, and encoding of the text a model produces before that text is handed to another component. The vulnerability is not in the model and not in what the model "meant" — it is in the code that consumes the model's output and treats it as if it were trusted, well-formed data.

Excessive Agency occurs when LLM-based systems are granted excessive permissions, autonomy, or functionality without appropriate controls, allowing them to perform high-impact actions without human oversight. This vulnerability is critical because it enables AI agents to cause significant damage through unrestricted access to sensitive operations.

A system prompt is the set of instructions a developer places above the conversation to steer a language model: its persona, tone, task, the tools it may call, and the rules it should follow. It is invisible to the end user in normal use, so teams often treat it as a private, trusted region of the context window.

Vector and Embedding Weaknesses (LLM08:2025) are security flaws in how embeddings are generated, stored, and retrieved in systems that use Retrieval-Augmented Generation (RAG). This is a new category introduced in the 2025 edition of the OWASP Top 10 for LLM Applications, added because RAG has become the default pattern for grounding a model in private, up-to-date, or domain-specific knowledge—and the retrieval layer it depends on is now a first-class attack surface.

Misinformation (LLM09:2025 in the OWASP Top 10 for LLM Applications) is the risk that a language model produces false, misleading, or fabricated information and presents it as if it were credible. The output is fluent, confident, well-formatted, and often internally consistent — which is exactly what makes it dangerous.

Unbounded Consumption occurs when an application lets clients drive a Large Language Model to perform inference — and the work it will do, the resources it will spend, and the money it will cost — without effective limits. Every request an LLM serves consumes compute (usually GPU), memory, wall-clock time, and, on a metered API, real currency billed per token.