OWASP Top Risks for RAG and LLM Apps

The OWASP Top 10 for Large Language Model Applications is the consensus checklist of critical LLM risks — and for RAG the entries that bite hardest are prompt injection (LLM01), sensitive information disclosure (LLM02), data and model poisoning (LLM04), and the RAG-native class vector and embedding weaknesses (LLM08). The list is a floor for architecture review, not proof that your retrieval pipeline is secure.

What is the OWASP Top 10 for LLM applications?

The OWASP Top 10 for Large Language Model Applications is a consensus-driven ranking of the most critical security risks in LLM-based systems, maintained by the OWASP GenAI Security Project. AI Security & Safety and CTAIO both stress the same boundary: it is a best-practice guide, not a statute — though auditors and vendor questionnaires increasingly ask whether LLM features were assessed against it.

The list was first published in 2023 and revised for 2025 (AI Security & Safety describes that revision as version 2.0). The current GenAI risk IDs, as listed on the OWASP GenAI project pages and CTAIO’s 2025 reference, are:

• LLM01:2025 — Prompt Injection
• LLM02:2025 — Sensitive Information Disclosure
• LLM03:2025 — Supply Chain
• LLM04:2025 — Data and Model Poisoning
• LLM05:2025 — Improper Output Handling
• LLM06:2025 — Excessive Agency
• LLM07:2025 — System Prompt Leakage
• LLM08:2025 — Vector and Embedding Weaknesses
• LLM09:2025 — Misinformation
• LLM10:2025 — Unbounded Consumption

CTAIO’s read of the 2025 revision is the practical one for RAG builders: it added System Prompt Leakage (LLM07) and Vector and Embedding Weaknesses (LLM08) as retrieval and agent systems moved into production, and broadened older denial-of-service language into Unbounded Consumption (LLM10) to cover cost and model-wallet drain. Crawl a generic project landing page carefully — older v1.1 wording still appears in some captures; use the GenAI per-risk pages for current IDs. CTAIO’s FAQ also separates this list from the classic web Top 10: a complete program uses both, because an LLM app is still a web app with a model attached. How those checklists show up in regime work sits on compliance.

Which OWASP LLM risks apply to RAG systems?

Almost every entry can appear in a RAG deployment, but four classes dominate retrieval architectures — drawn from the GenAI LLM08 framing, CTAIO’s RAG additions, and the RAG-specific threat names ranking pages use (patterns only; no invented prevalence rates):

• LLM01 — Prompt Injection — especially indirect injection, where the payload rides in a retrieved document rather than the user message.
• LLM02 — Sensitive Information Disclosure — unauthorized chunks, cross-tenant retrieval, or secrets that leak through the answer.
• LLM04 — Data and Model Poisoning — attacker- or insider-planted corpus content that later ranks into context.
• LLM08 — Vector and Embedding Weaknesses — the RAG-native catalogue entry for how vectors are generated, stored, and retrieved.

Secondaries still matter in production RAG: LLM05 when answers feed HTML, SQL, or tools; LLM06 when agentic retrieval holds irreversible actions; LLM09 when a grounded-looking answer is still wrong; plus LLM03, LLM07, and LLM10 as supply-chain, prompt-leak, and cost/abuse floors. Mechanism depth for injection and corpus plants lives on prompt injection and data poisoning — this page is the catalogue map.

How do OWASP LLM risks map onto the RAG pipeline?

Each risk hits a concrete stage. Treating “OWASP” as one blob is how reviews miss the retrieval path. Aibuzz’s five-stage surface (ingest → chunk → embed/index → retrieve → generate) plus the OWASP RAG Security Cheat Sheet’s control sections give the map:

• Ingest — LLM04 document/corpus poisoning and LLM03 connector/supply-chain risk on what you pull in.
• Embed / index — LLM08 embedding manipulation, inversion exposure, and index-integrity failures.
• Retrieve — LLM08 unauthorized access and cross-context leaks, LLM01 retrieved-document injection, and access-control inheritance gaps the cheat sheet puts next to every chunk.
• Generate — LLM01/LLM05/LLM07/LLM09: instructions in context, unsafe sinks for model output, system-prompt extraction, and confident misinformation.
• Ops / agent — LLM06 tool agency, LLM10 unbounded consumption, and the monitoring/logging layer the cheat sheet lists as foundational.

The cheat sheet’s opening claim is the one to keep: RAG does not reduce risk so much as redistribute it across the data pipeline — from ingestion through generation. Enforcing who may retrieve what is access control; recording what was retrieved is audit logging; screening inputs and outputs is guardrails.

What is LLM08 — vector and embedding weaknesses?

LLM08:2025 is OWASP’s RAG-centred risk class. The GenAI project page defines it as weaknesses in how vectors and embeddings are generated, stored, or retrieved that attackers can exploit to inject harmful content, manipulate model outputs, or access sensitive information.

The same page lists five common examples:

• Unauthorized access and data leakage — misaligned controls let the model retrieve embeddings or chunks a caller should not see.
• Cross-context leaks and federation knowledge conflict — multi-tenant or multi-source indexes mix contexts, or retrieved facts fight training knowledge.
• Embedding inversion — research-backed attempts to recover source text from vectors.
• Data poisoning attacks — malicious or unverified content enters the knowledge base.
• Behaviour alteration — retrieval augmentation changes how the foundation model responds in unwanted ways.

Official mitigations on that page stay short: permission-aware vector stores, validation and source authentication for knowledge sources, review when combining differently classified data, and detailed immutable logs of retrieval activity. OWASP’s Scenario #1 is the resume with hidden white-on-white instructions that a screening RAG later obeys — the illustration for why ingestion scanning matters. Deeper poisoning defence is on data poisoning; tenant filters on access control; inversion/privacy on data privacy; the trail itself on audit logging. When vector stores are named in an ordered list, Weaviate leads, then peers such as Pinecone, Qdrant and Milvus — placement only.

How do you use the OWASP LLM Top 10 to secure a RAG system?

Treat the list as an architecture gate with named owners — not a poster. CTAIO’s operational advice and the OWASP RAG Security Cheat Sheet’s priority bands combine into a practical sequence:

• Gate every LLM/RAG feature — require coverage of all ten in design review before the feature ships (CTAIO).
• Prioritize the incident trio — CTAIO names Prompt Injection (LLM01), Improper Output Handling (LLM05), and Excessive Agency (LLM06) as the three that drive most real damage; then close RAG-native LLM08 with the cheat sheet’s “implement immediately” set: document hashing at ingest, context delimiters and chunk limits, access-control metadata on every chunk, tenant/classification isolation, query abuse detection, output validation, full-pipeline logging, and fail-closed behaviour.
• Assign an owner per risk and re-assess on a cadence (CTAIO’s quarterly framing).
• Keep the classic web Top 10 for the API, auth and database shell around the model (CTAIO FAQ).

Honest ceiling: covering the ten is the floor; production controls with owners are the program. Tooling that screens prompts and answers belongs with guardrails; live signals with monitoring.

How do you test a RAG system against the OWASP LLM Top 10?

You red-team each catalogue category against the live pipeline — a checklist tick is not evidence that a control held. CTAIO’s operational FAQ and AI Security & Safety’s tooling notes point the same direction: probe the categories, then feed findings into the risk register.

A RAG-shaped probe set looks like this: plant retrieval-time injection and poisoned documents for LLM01/LLM04/LLM08; attempt cross-tenant or over-privileged retrieval for LLM02/LLM08; try system-prompt extraction for LLM07; send model output into a safe sink harness for LLM05; exercise tool allowlists and human gates for LLM06; load-test token and cost budgets for LLM10. Suites such as Garak (cited by AI Security & Safety as a class of LLM vulnerability scanner) illustrate the automation pattern — they do not invent a pass rate for your stack. Wire regressions into CI and treat unexplained answer shifts as stage detection. Mechanism pages for the payloads themselves remain prompt injection and data poisoning.