The OWASP LLM Top 10 (2025) is the most widely referenced framework for LLM security risks. It covers everything from prompt injection to misinformation, spanning model-level and application-level threats.
Pipelock’s published documentation mapping at v3.7.1 rates LLM Top 10 threats as shown below. These documentation ratings describe product capabilities and limits; they aren’t guarantees of prevention or compliance certification. Pipelock Assess v3.7.1 does not include this framework in its report catalog. Its shipped OWASP report mappings are MCP Top 10 and Agentic Top 10.
Published documentation mapping
The documentation rates seven of ten categories Strong, Moderate, or Partial; three are out of scope.
| ID | Threat | Documentation rating | Documentation status |
|---|---|---|---|
| LLM01 | Prompt Injection | Strong | Shipped |
| LLM02 | Sensitive Information Disclosure | Strong | Shipped |
| LLM03 | Supply Chain Vulnerabilities | Partial | Shipped |
| LLM04 | Data and Model Poisoning | N/A | Out of scope |
| LLM05 | Improper Output Handling | Moderate | Shipped |
| LLM06 | Excessive Agency | Strong | Shipped |
| LLM07 | System Prompt Leakage | Moderate | Shipped |
| LLM08 | Vector and Embedding Weaknesses | N/A | Out of scope |
| LLM09 | Misinformation | N/A | Out of scope |
| LLM10 | Unbounded Consumption | Partial | Shipped |
LLM01: Prompt Injection
Attackers craft inputs that override the model’s instructions. Direct injection comes through user input. Indirect injection comes through fetched content, tool results, or documents the model reads. This is the #1 risk for a reason.
LLM02: Sensitive Information Disclosure
The model leaks API keys, credentials, PII, or proprietary information through network requests. This happens when an agent gets tricked (via injection) into exfiltrating secrets, or when the model includes credential material in tool calls unprompted.
LLM03: Supply Chain Vulnerabilities
Malicious or tampered tools, packages, or plugins compromise the application through its dependencies. In the MCP world, this means poisoned tool servers.
LLM04: Data and Model Poisoning
Training data gets manipulated to embed backdoors or biases into the model itself.
LLM05: Improper Output Handling
LLM outputs get passed to downstream systems without validation. The model generates a URL, the application fetches it. The model generates SQL, the application runs it. If that output contains XSS, SSRF payloads, or command injection, the downstream system is compromised.
LLM06: Excessive Agency
The model has more permissions, autonomy, or tool access than the task requires. Combined with prompt injection, excessive agency turns a content-reading agent into one that can delete databases, send emails, or transfer money.
LLM07: System Prompt Leakage
The system prompt gets exposed through crafted queries, revealing internal instructions, API keys, or business logic embedded in the prompt.
LLM08: Vector and Embedding Weaknesses
Attackers manipulate vector embeddings in RAG pipelines, injecting malicious content through similarity search or poisoning the knowledge base.
LLM09: Misinformation
The model generates false or fabricated information.
LLM10: Unbounded Consumption
The application allows uncontrolled resource consumption: excessive API calls, token usage, or data transfer that enable denial-of-service.