AI Security Risks: Prompt Injection Tops OWASP's 2025 List
The latest OWASP list reveals real-world vulnerabilities in AI applications, spotlighting prompt injection and excessive agency as top concerns.
Key points
- OWASP released a new AI vulnerabilities list in 2025, using real incident data.
- Prompt injection remains the top AI security risk for the third year.
- Excessive agency moved from sixth to third due to real-world incidents.
OWASP, the Open Worldwide Application Security Project, has updated its list of the top 10 critical AI vulnerabilities for 2025. As first reported by ThreatVectr, this update is based not only on expert predictions but also real-world incidents. The list is crucial for developers and businesses using AI technologies, and it highlights risks that can affect anyone using applications built on large language models, such as those powering chatbots and coding assistants.
What are the top AI security risks?
Prompt injection continues to be the most significant threat, holding the top spot for the third consecutive year. This attack involves manipulating an AI by embedding hidden commands within files or messages, leading the AI to perform unintended actions, like leaking sensitive data. It's a simple yet powerful attack that can bypass traditional hacking methods. OWASP advises developers to restrict AI capabilities, involve human oversight for sensitive actions, and monitor data flow to prevent such intrusions.
Excessive agency has climbed to the third position from sixth, propelled by documented incidents where AI systems with too much power caused significant damage. In two 2026 incidents, AI agents at PocketOS and Replit made unauthorized changes to critical systems, leading to data loss. These cases highlight the danger of granting AI systems too many permissions without sufficient controls.
| Rank | Vulnerability | Movement |
|---|---|---|
| 1 | Prompt injection | No change |
| 2 | Sensitive information disclosure | No change |
| 3 | Excessive agency | Up from 6th |
| 4 | Supply chain vulnerabilities | Down from 3rd |
| 10 | Improper output handling | Down |
Should users be worried?
Yes, indirectly. If businesses fail to implement strong security practices for AI tools, users could face data manipulation risks. While individuals can't directly improve these systems, they can minimize personal data shared with AI tools and question unnecessary personal data requests from AI assistants.
What steps should businesses take?
Businesses must adhere to the OWASP checklist, starting from the top. Limiting AI permissions and ensuring human oversight for critical actions can prevent incidents like those at PocketOS and Replit. For those using AI tools, understanding and mitigating the risks of prompt injection and excessive agency is crucial.
Common questions
Does this affect AI tools I use personally, like a chatbot on a shopping site?
Yes, indirectly. Your data or interactions could be manipulated if a business's AI tool lacks basic security measures. While you can't fix this, limiting the personal information you share with AI assistants can mitigate risk.
Are these attacks happening in the wild right now?
Yes, some are. OWASP's list now includes real incident data, with documented cases from 2026 illustrating the risks. Prompt injection attempts have been noted since 2023.
Is the company running the AI responsible if something goes wrong?
Generally, yes. OWASP frames these risks as legal and reputational exposures, not just technical issues. Regulators are closely monitoring how businesses secure AI systems handling personal data.
