OWASP published a Top 10 for LLM applications. We read the list from an IT team perspective.
Most of the framework targets AI engineers building models. But three risks apply to every organization using AI, whether you built it or not. Here’s what we think you should know.
Risk 1: Sensitive information disclosure (LLM02)
This is the headline risk. Customer data, financial information, source code, internal strategies, all flowing into AI tools and out the other side.
The danger isn’t the obvious leak. It’s the slow drip. An employee pastes a contract into ChatGPT to summarize it. The vendor’s name, the price, the termination clauses, all sitting in a third party’s logs. Multiply that by hundreds of employees doing similar things every day. You don’t have one breach. You have a continuous exposure surface most organizations have never measured.
What to ask: What data is flowing to AI tools right now? Not what you approved. What’s actually moving. If the answer is “we’d have to check,” that’s the answer.
Risk 2: Excessive agency (LLM06)
This one sneaks up on organizations. Excessive agency happens when AI systems get more permissions than they need. An AI agent that reads your CRM, writes to your email, and accesses your file shares is convenient. It’s also a single point of compromise.
The pattern: a team enables Copilot, Salesforce Einstein, or a Slack agent. Each one gets connected to internal systems “to make it more useful.” Six months later, no one has a complete picture. Permissions accumulated. Nobody audited them.
What to ask: What can your AI integrations actually access? If a prompt injection or compromised account exploited one, what would it reach?
Risk 3: Supply chain vulnerabilities (LLM03)
This is the one most IT teams haven’t thought about. And it carries the biggest compliance implications.
When you use an AI tool, you’re trusting every model it was built on, every dataset it was trained on, every plugin it integrates with. The AI tool is a black box. The supply chain behind it is a deeper black box.
We’ve seen this story before. SolarWinds. Log4j. A trusted component turns out to have hidden dependencies that introduce risk you didn’t know you were carrying.
The compliance angle: Law 25, GDPR, and similar regulations require you to know where personal data is processed. If your AI tool runs on a model trained on data you can’t audit, hosted by a vendor with sub-processors you can’t trace, you have a compliance gap most boards haven’t been told about.
The cybersecurity angle: Compromised models and vulnerable plugins can introduce risk into your environment silently. The blast radius depends on what those tools are connected to.
What to ask: For every AI tool you use, do you know what model it runs on, where it’s hosted, and what data it touches? Could you answer that for an auditor next week?
The bigger signal
Step back. What does it mean that OWASP, the organization that defined modern application security, decided AI needed its own Top 10?
AI security has crossed a threshold. It’s no longer emerging. It’s operational. The framework exists because the industry needed a shared way to talk about these risks.
The organizations getting the hardest questions right now, from regulators, boards, and customers, are the ones running AI without a clear answer to “where are your controls?” OWASP gives you the structure. It doesn’t write the answers.
Worried about your AI exposure?
Map where your sensitive data is going, what your AI integrations can access, and where your supply chain has gaps, with the help of our specialists.
Sources:
- OWASP. (2025). OWASP Top 10 for Large Language Model Applications.
- Government of Quebec. (2021). Act to modernize legislative provisions as regards the protection of personal information (Law 25).
- Gartner. (2024). Predicts 2025: Shadow AI Security Breaches Will Affect 40% of Enterprises by 2030.
