Sensitive Information Disclosure
OWASP Top 10 for LLM Applications · LLM02:2025
Language-model applications hold sensitive data in several places at once: the training or fine-tuning corpus, the system prompt, retrieved context, and conversation history. Any of these can end up in an output. Disclosure may be memorisation of training data, a retrieval layer returning records the user was not entitled to, or context from one user or tenant surfacing to another.
The project was originally the OWASP Top 10 for Large Language Model Applications and is now published under the renamed OWASP Gen AI Security Project. The identifiers below are the 2025 edition, which is the edition listed on the project's own Top 10 page. OWASP announced a 2026 edition in August 2026; at the time of writing its full category list is distributed as a gated download and is not yet reflected on the project's public list page, so it is not reproduced here.
How it shows up in the real world
- The model reproducing personal data, credentials, or proprietary text that appeared in its training or fine-tuning data.
- A retrieval-augmented assistant returning documents the asking user has no right to see, because retrieval ignores permissions.
- Conversation history or cached context leaking between users or tenants.
- Sensitive internal data pasted into a third-party model that logs or trains on inputs.
How to mitigate it
- Sanitise and classify training and fine-tuning data, and exclude secrets and personal data you do not need.
- Enforce the user's access rights inside retrieval, filtering at query time rather than after generation.
- Isolate context, memory, and caches per user and per tenant.
- Scan outputs for sensitive patterns before they are returned, and minimise what is placed in context.
- Set explicit data-handling and retention terms with model providers and govern what may be sent to them.
Practice this topic
Test your knowledge of Sensitive Information Disclosure with exam-style practice questions.
Rest of the LLM 2025 list
LLM01:2025Prompt Injection
A language model receives instructions and data in the same channel and has no reliable way to tell them apart. Prompt injection exploits that: text placed where the model will read it can redirect its behaviour, override system instructions, or trigger tool calls. Indirect injection is the more serious variant, where the hostile text arrives from a document, web page, email, or retrieved record rather than from the user, so the person operating the system is not the attacker.
LLM03:2025Supply Chain
An AI application depends on components most teams do not build: pre-trained models, adapters, datasets, embedding models, inference servers, and plugin ecosystems. Model artifacts are a distinctive risk because some serialisation formats execute code on load, so downloading a model can be equivalent to running an untrusted program. Provenance for public models and datasets is often weak or absent.
LLM04:2025Data and Model Poisoning
Poisoning manipulates what a model learns, by tampering with pre-training, fine-tuning, or embedding data, or with the corpus a retrieval system draws on. It can degrade quality broadly, or install a targeted backdoor that behaves normally until a trigger appears. Poisoning is hard to detect after the fact because the resulting model is not obviously broken, and pipelines that continuously ingest public or user-supplied content are the most exposed.
LLM05:2025Improper Output Handling
Model output is untrusted input to whatever consumes it. When generated text is inserted into a page, a query, a shell command, or a code path without validation, the model becomes a route to conventional injection vulnerabilities — and an attacker who can influence the model through prompt injection can reach those sinks. The distinction from overreliance matters: this category is about what the surrounding system does with the output, not whether the content is correct.
LLM06:2025Excessive Agency
Agency is the capability an application grants a model to act — tools it can call, systems it can reach, actions it can take without approval. Excessive agency is granting more than the task requires, so that any manipulation of the model translates into real-world impact. It typically appears as excessive functionality, excessive permissions, or excessive autonomy, and it is the multiplier that turns prompt injection from an embarrassment into an incident.
LLM07:2025System Prompt Leakage
System prompts often accumulate more than tone and formatting guidance: business rules, internal criteria, tool descriptions, and sometimes credentials. They are frequently treated as though they were confidential, but they are recoverable in practice through direct requests, paraphrase, or injection. The underlying error is using the prompt as a security control; the leak is a symptom of that assumption.
LLM08:2025Vector and Embedding Weaknesses
Retrieval-augmented systems introduce infrastructure with its own security properties: an embedding model, a vector store, and a retrieval process. Vector databases frequently launch without authentication, and embeddings are not a form of encryption — text can be approximately reconstructed from them. Retrieval is also an access-control boundary that is easy to omit, and one that behaves confusingly when documents from different tenants share an index.
LLM09:2025Misinformation
Models produce fluent, confident output whether or not it is correct, and fluency is routinely mistaken for reliability. Misinformation covers fabricated facts, invented citations, and plausible but wrong technical guidance, together with the organisational overreliance that lets such output reach decisions unchecked. A distinctive variant is hallucinated software dependencies, which attackers can register and populate with malicious code.
LLM10:2025Unbounded Consumption
Inference costs real money and real compute, and a single request can consume a great deal of both. Without limits, an application is exposed to denial of service and to direct financial loss, a pattern sometimes described as denial of wallet. Agentic systems make this sharper because one user request can expand into many model calls, and a reasoning loop can run indefinitely. Unbounded querying also enables model extraction, where systematic queries are used to replicate a model's behaviour.