OWASP LLM Top 10 Threat Modeling

Try it out loud first. Then check yourself:

1. Use the list (2025 edition) as a threat-modeling checklist of app-level LLM risks, not a compliance standard to certify against.
2. Plain chatbot: prompt injection, sensitive info disclosure, system prompt leakage, misinformation and cost abuse dominate.
3. RAG adds poisoned or ACL-blind retrieval (vector/embedding weaknesses); agents add excessive agency, turning injection into action.
4. Prompt injection cannot be fully patched: instructions and data share one channel, so assume it succeeds and contain the blast radius.
5. Contain: least-privilege tools, human approval for consequential actions, and treat model output as untrusted input downstream.

If the interviewer pushes back

• Which two items would you prioritize for a customer-facing RAG chatbot with no tools, and why?
• Where does the list fall short for multi-step agents, and what would you add (e.g. MITRE ATLAS techniques)?

Go deeper

• owasp.org/www-project-top-10-for-large-language-model-applications/
• atlas.mitre.org/