Standard application security frameworks were built for a world of fixed code paths and predictable inputs, which is exactly what an LLM application isn’t. The OWASP Top 10 for LLM Applications exists to fill that gap: a ranked list of failure modes unique to systems built around a language model, covering prompt injection, sensitive information disclosure, supply chain risk, data and model poisoning, excessive agency, and unbounded resource consumption.
Prompt injection has held the top spot since the list’s first edition, and it hasn’t moved, because the underlying problem is architectural rather than something a patch fixes. An LLM can’t reliably separate “instruction from the system” from “text it happens to be reading,” which means every other category on the list is, in some sense, a consequence of that one unresolved gap.
Treat the list as a review checklist for anything given tool access or an API credential, not just a reference document. A security review that only checks for injected prompts and ignores excessive agency or unbounded consumption is reading half the list.