An OWASP LLM Top 10 assessment is an evidence-first review of how your specific LLM application handles the ten risks OWASP ranks for 2025 — from prompt injection (LLM01) to unbounded consumption (LLM10). It tests the deployed system, not just the base model, and records a reproducible result, control evidence, and a clear pass-or-remediate signal for every applicable risk. This worksheet gives you one row per risk — what to test, the evidence to capture, and the pass signal — the same structure an enterprise security reviewer will hold you to.
This page is the hub for the framework. Each risk below links to a deep test plan, the worksheet is downloadable, and the honest bar is “prove what you tested,” never a “safe” certificate. The list is the official OWASP Top 10 for LLM Applications 2025 (published by the OWASP GenAI Security Project) — use the exact IDs and names so your findings map cleanly to what a reviewer already recognizes.
This worksheet is for product security teams, engineering teams, founder-CTOs, and owners of deployed LLM applications who are preparing for launch or enterprise review.
Want it run against your system?
Scope an OWASP LLM Top 10 assessment.
Bring the AI workflow, what it can read or do, and the buyer or launch deadline. We map every applicable risk to a test, run it, and hand you the evidence — not a checkbox.
What goes in an OWASP LLM Top 10 checklist?
A useful checklist is not ten green ticks. For each of the ten risks it records four things: what you tested, the evidence you captured, the pass signal you observed, and — for risks that do not apply — why they are out of scope. That “applies to” decision is part of the assessment: a chatbot with no tools scopes out Excessive Agency, but the reason is written down, because a buyer will ask.
The editable OWASP LLM Top 10 worksheet (CSV) has one reference row per risk — the typical surface, what to test, the evidence to capture, and the pass signal — plus blank columns to record your own applicability call, exclusion rationale, result, evidence link, severity, remediation, and retest status. Fill the applies-to-your-system column first and write down why any risk is out of scope; a logged exclusion is stronger than a silent one. One honesty rule for every row: a pass signal is a statement about the cases you actually ran, not a guarantee about cases you didn’t.
| Risk | What to test | Evidence to capture | Pass signal |
|---|---|---|---|
| LLM01 Prompt Injection | Direct + indirect injection at every entry point (chat, RAG doc, tool result, upload, email, fetched page). | Payload, prompt boundary, model output, tool trace. | No tested payload authorizes an action or overrides policy — untrusted content stays inert. |
| LLM02 Sensitive Information Disclosure | Cross-tenant retrieval, PII/secret restatement, disclosure via tool output. | Caller identity, applied filter, returned IDs, disclosed slice + recipient. | No unauthorized record, tenant, or secret reaches output on any tested path. |
| LLM03 Supply Chain | Inventory models, plugins, MCP servers, datasets, prompt deps; check pinning + provenance. | Version/hash, manifest diff, provenance, approval record. | Unapproved or drifted components fail closed and alert before production use. |
| LLM04 Data and Model Poisoning | Ingest crafted content built to rank for a target query; check ingestion validation. | Ingestion source, stored chunk, later retrieval + answer. | No tested poisoned document shapes another user’s answer or plants a backdoor. |
| LLM05 Improper Output Handling | Feed model output into each downstream sink (SQL, shell, HTML, tool arg) with a payload. | Raw output + downstream sink/execution trace. | Output is encoded or schema-validated for its destination; nothing executes downstream. |
| LLM06 Excessive Agency | Enumerate tools; attempt a privileged action as a low-privilege user via injection. | Caller, tool, arguments, authorization decision, side effect. | Authorization uses caller identity outside the model; high-impact actions gate on a human. |
| LLM07 System Prompt Leakage | Attempt prompt extraction; audit the prompt for secrets/policy that should be a real control. | Attack turns, disclosed fragments, prompt contents. | No secret or access control lives in the prompt; disclosure is inconsequential. |
| LLM08 Vector and Embedding Weaknesses | Cross-tenant/embedding-space probing; check exposed scores or endpoints + per-path filters. | Query, filter, returned IDs, any exposed scores/vectors. | Every tested retrieval path enforces server-side scope; vectors carry the source’s access control. |
| LLM09 Misinformation | Run a correctness/faithfulness eval on real inputs; test refusal both ways; check citations. | Golden-set inputs, scores, judge calibration, mis-cite examples. | Correctness holds on a frozen holdout; tested unfaithful answers are flagged by the eval gate. |
| LLM10 Unbounded Consumption | Drive an unbounded token/tool loop and a cost/latency spike; verify budgets + timeouts. | Token count, tool-call count, latency, cost, timeout behavior. | Per-request budgets stop the run without a side effect; anomalies alert. |
The rest of the page is one section per risk: what it means in a real product, what to test, and the deep test plan that covers it. For a worked example of what the output looks like, see the sample AI assessment report.
LLM01:2025 — Prompt Injection
The model cannot tell your instructions from instructions hidden in the data it reads — a support ticket, a retrieved document, a fetched web page — so untrusted text can override policy or drive a tool call. This is the top risk for a reason: it is the entry point that turns every other capability into an exploit.
What to test: direct and indirect injection at every entry point — chat input, RAG documents, tool results, uploaded files, inbound email, fetched pages. Evidence: the payload, the final prompt boundary, the model output, and the tool trace. Pass signal: no tested payload authorizes an action or overrides policy — untrusted content stays inert data across repeated attempts.
Deep test plan: Prompt Injection Testing: 14 copy-paste tests. To have it run adversarially against your system, see the LLM red teaming service.
LLM02:2025 — Sensitive Information Disclosure
The system reveals data it should not: another tenant’s records, PII, secrets sitting in context, or private fields restated in an answer. In multi-tenant SaaS this is the deal-ending finding, because the leak often happens through retrieval or a tool, not the model’s “knowledge.”
What to test: cross-tenant retrieval, PII and secret restatement, and disclosure via tool output — probe with another tenant’s own text as the query. Evidence: caller identity, the applied filter, returned document IDs, and the disclosed slice plus recipient. Pass signal: no unauthorized record, tenant, or secret reaches model output or an egress tool on any tested path.
Deep test plans: RAG security for cross-tenant retrieval mechanics and AI agent security for exfiltration via tools. Service: RAG security assessment.
LLM03:2025 — Supply Chain
A model, plugin, MCP server, dataset, or prompt dependency is compromised, drifted, or unpinned — you inherit the risk of components you did not build and do not monitor. The failure is usually silent: an unversioned dependency changes behavior and nothing alerts.
What to test: inventory every model, plugin, MCP server, dataset, and prompt dependency; check pinning, provenance, and change-alerting. Evidence: version or hash, manifest diff, provenance, and the approval record. Pass signal: unapproved component or manifest changes fail closed and alert before production uses them.
The highest-leverage supply-chain surface for most teams is third-party tool servers — deep test plan: MCP security checklist. Service: MCP security assessment.
LLM04:2025 — Data and Model Poisoning
Attacker-shaped training, fine-tune, or ingested content changes behavior — a poisoned document that ranks into retrieval, or a backdoor triggered by a phrase. For most product teams the live surface is ingestion: what any user or source can put into your index.
What to test: ingest a crafted document engineered to rank for a target query with hostile or false content, and check ingestion validation. Evidence: the ingestion source, the stored chunk, and the later retrieval plus resulting answer. Pass signal: no tested poisoned document shapes another user’s answer or plants a backdoor; ingestion attributes and validates every chunk.
Deep test plan: RAG security for content poisoning at ingestion. Service: RAG security assessment.
LLM05:2025 — Improper Output Handling
Model output flows into a downstream sink — SQL, a shell, HTML, a tool argument, a browser — without validation, turning a text bug into XSS, SSRF, or command injection. The model is now an untrusted input source for the rest of your stack.
What to test: feed model output into each downstream sink (parser, renderer, SQL, shell, tool argument) with an injected payload. Evidence: the raw model output and the downstream sink or execution trace. Pass signal: output is encoded or schema-validated for the destination context; no tested injection executes downstream.
Deep test plan: the unsafe-output-handling cases in the LLM red teaming guide. Service: LLM red teaming service.
LLM06:2025 — Excessive Agency
The agent can do more than the task needs — over-broad tools, permissions, or autonomy — so a single injection becomes a real action: a send, a delete, a payment. The control is not a better prompt; it is authorization enforced outside the model.
What to test: enumerate tools and attempt a privileged action (send, delete, pay, write) as a low-privilege user via injection or tool composition. Evidence: caller, tool name, arguments, the authorization decision, and the side effect. Pass signal: tool authorization uses caller identity and blocks out-of-scope actions outside the model; high-impact actions gate on a human.
Deep test plans: AI agent security for the tool-permission test plan and MCP security for side-effect gates. Service: AI agent security assessment.
LLM07:2025 — System Prompt Leakage
Hidden rules, policy, or secrets stored in the system prompt get extracted by a user — and worse, teams put access controls in the prompt, where they were never a boundary. The finding is not just “the prompt leaked”; it is that something load-bearing lived there at all.
What to test: attempt system-prompt extraction, and audit the prompt for secrets or policy that should be a real control. Evidence: the attack turns, the disclosed fragments, and the prompt contents. Pass signal: no secret or access control lives in the prompt; protected policy text is not disclosed, or its disclosure is inconsequential.
Deep test plans: system-prompt extraction in Prompt Injection Testing and the extraction cases in LLM red teaming. Service: LLM red teaming service.
LLM08:2025 — Vector and Embedding Weaknesses
The retrieval and embedding layer leaks: missing tenant filters on a shared index, exposed similarity scores or embedding endpoints, or inversion of sensitive source text. Access control that exists in the app can quietly vanish at the vector layer.
What to test: cross-tenant and embedding-space probing; check for exposed similarity scores or embedding endpoints and per-path filtering. Evidence: the query, the filter, returned IDs, and any exposed scores or vectors. Pass signal: every tested retrieval path enforces server-side scope; vectors and scores carry the same access control as the source documents.
Deep test plan: the embedding-space leakage and vector checklist in RAG security. Service: RAG security assessment.
LLM09:2025 — Misinformation
The system states confident, wrong, or unfaithful answers users act on — hallucinated facts, mis-cited sources, or over-reliance on unverified output in a decision path. In a workflow that drives an action, a wrong answer is a security event, not just a quality one.
What to test: run a correctness and faithfulness eval on real inputs; test refusal both ways; check citation integrity. Evidence: golden-set inputs, scores, judge calibration, and mis-cite examples. Pass signal: correctness holds at or above baseline on a frozen holdout; tested unfaithful or fabricated answers are flagged by the eval gate before a user acts on them.
Deep test plan: LLM evals for correctness golden sets and calibrated judges. Service: AI product readiness assessment.
LLM10:2025 — Unbounded Consumption
Crafted inputs or tool loops drive runaway tokens, calls, latency, or spend — “denial of wallet” and availability loss with no per-request budget to stop it. The blast radius is your bill and your uptime, and it is trivially reachable from a single input.
What to test: drive an unbounded token or tool loop and a cost/latency spike; verify per-request budgets and timeouts. Evidence: token count, tool-call count, latency, cost, and timeout behavior. Pass signal: per-request budgets and step limits stop the run without a side effect; cost and latency anomalies alert.
Deep test plans: the tool-loop test in AI agent security and cost/latency alerts in the AI production readiness checklist. Service: AI product readiness assessment.
Is the OWASP LLM Top 10 enough for an enterprise review?
It is the right coverage map, not the whole answer. The Top 10 tells you what to consider; a reviewer wants adversarial evidence for each applicable risk — a reproducible trace, the control that failed, severity, the fix, and retest status. Where they apply, map the same findings to the OWASP Agentic Top 10, MITRE ATLAS, and the NIST AI RMF, so one assessment answers several questionnaires. The through-line is the same one every Phixe guide holds: a finding is a replayable artifact, not a screenshot of a vibe.
The three deliverables compose. This worksheet is the coverage frame organized by the ten official risks. LLM red teaming actively attacks those surfaces. The AI production readiness checklist scores the production controls that close them. Use this page to prove every OWASP risk was considered, then go deep where your product actually has the surface.
How Phixe runs it
Phixe scopes an OWASP LLM Top 10 assessment the same way it scopes any AI product readiness assessment: map what the AI can see and do, decide which of the ten risks apply, then test each applicable one and record the evidence. The methodology and the reproducibility standard behind every finding are documented in how we verify, and the sample AI assessment report shows the output shape a buyer receives.
If a buyer is already asking questions, or a launch date is fixed, scope an OWASP LLM Top 10 assessment. The outcome is simple: for every applicable risk you know what was tested, what passed, what failed, what was fixed, and what evidence you can send onward.