OWASP
OWASP (Open Worldwide Application Security Project) is an international nonprofit open community organization focused on improving software security. Its mission is to provide security tools, documentation, guidelines, and standards free of charge through open collaboration, helping developers, organizations, and security researchers build more secure web applications. OWASP's most widely recognized outputs include the Web Application Security Top 10 risk list, testing guides, and secure development best-practice frameworks, which are broadly adopted across the global security industry and compliance assessment domains.
Core Facts
OWASP has listed prompt injection as the top security risk for large language model applications.
The PTES (Penetration Testing Execution Standard) divides the penetration testing process into phases including intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and report writing.
OWASP已将Prompt注入列为LLM应用十大安全风险之首
Timeline (last 90 days)
In its security guidance for large language model applications, OWASP recommends performing actions under the identity and context of the end user and placing authorization decisions in downstream business systems rather than at the model layer.
OWASP lists prompt injection as the top risk in its Top 10 for LLM applications, and notes that it is not yet clear whether any foolproof defense exists.
OWASP's LLM01:2025 guidance lists prompt injection as one of the most prevalent and hardest-to-fully-mitigate risk categories in LLM applications, and recommends reducing impact through system-level controls such as limiting model capabilities, constraining tool permissions and adding human confirmation.
The OWASP Transaction Authorization Cheat Sheet emphasizes that authorization decisions should be made server-side based on trusted identity and resource state, rather than relying on claims submitted by the client.
OWASP recommends incorporating red team testing into the agent development lifecycle, regularly updating the attack library, and testing "worst-case" scenarios to assess whether the scope of damage is effectively limited.
OWASP has added System Prompt Leakage to its Top 10 list of risks for large language model applications.
The OWASP Top 10 list of risks for large language model applications was first published in 2023 and updated in 2025.
An OWASP 2026 tracking effort surveyed 53 agentic AI projects and found that 28 of them (more than half) are coding agents.
OWASP lists prompt injection as LLM01, the highest risk for LLM-powered applications in 2026.
The OWASP Top 10 for LLM Applications (2025 version) is the standard most teams use to categorize LLM security findings.
25 more timeline events
All Facts (20)
OWASP has listed prompt injection as the top security risk for large language model applications.
90%VerifiedThe PTES (Penetration Testing Execution Standard) divides the penetration testing process into phases including intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and report writing.
80%VerifiedOWASP已将Prompt注入列为LLM应用十大安全风险之首
80%VerifiedThe OWASP Top 10 threat list specifically targeting LLMs was officially published in 2023.
75%VerifiedVulnerabilities such as SQL injection, XSS, and SSRF have long occupied the OWASP Top 10 security risk list.
75%VerifiedOWASP lists prompt injection as the top risk in the LLM Top 10 (LLM01).
70%VerifiedThe OWASP Top 10 vulnerability list's 2021 version added Insecure Design as a new category.
70%VerifiedThe principle of least privilege is considered one of the core ideas in agent security, meaning an agent should only be granted the minimum permissions necessary to complete its task.
65%VerifiedSQL injection can fundamentally isolate data from instructions through parameterized queries, whereas there is currently no equivalent "parameterized" solution for the LLM inference process.
65%VerifiedClaude Code's /security review command covers vulnerability checks for SQL injection, XSS, key leakage, and privilege escalation.
65%VerifiedOWASP lists User Enumeration Attacks as a common security risk.
65%UnverifiedThe Secure by Default principle has since been widely adopted by mainstream security frameworks such as OWASP and NIST.
60%UnverifiedThe OWASP Top 10 for LLM Applications list was updated in 2025.
60%UnverifiedThere are currently two mainstream format standards for SBOM: SPDX, led by the Linux Foundation, and CycloneDX, promoted by OWASP.
60%UnverifiedIn its security guidance for large language model applications, OWASP recommends performing actions under the identity and context of the end user and placing authorization decisions in downstream business systems rather than at the model layer.
50%UnverifiedOWASP lists prompt injection as the top risk in its Top 10 for LLM applications, and notes that it is not yet clear whether any foolproof defense exists.
50%UnverifiedOWASP's LLM01:2025 guidance lists prompt injection as one of the most prevalent and hardest-to-fully-mitigate risk categories in LLM applications, and recommends reducing impact through system-level controls such as limiting model capabilities, constraining tool permissions and adding human confirmation.
50%UnverifiedThe OWASP Transaction Authorization Cheat Sheet emphasizes that authorization decisions should be made server-side based on trusted identity and resource state, rather than relying on claims submitted by the client.
50%UnverifiedOWASP recommends incorporating red team testing into the agent development lifecycle, regularly updating the attack library, and testing "worst-case" scenarios to assess whether the scope of damage is effectively limited.
50%UnverifiedThe OWASP Top 10 list of risks for large language model applications was first published in 2023 and updated in 2025.
50%