The current OWASP Top 10 for LLM Applications is the 2025 list, led by Prompt Injection — but an older page on OWASP’s own site still serves the archived 2023 v1.1 list, and a plain search for the topic can hand you that one first.
I had a link saved for the OWASP Top 10 for LLM Applications that I used as a reference in security reviews for well over a year, and I never once checked whether the page behind it was still the current version of the list. It looked authoritative. It was hosted on OWASP’s own site, under a URL that named the exact topic, and I treated still online as a proxy for still current. Those are not the same claim, and the gap between them is exactly where this went wrong.
The list actually current now, the one OWASP’s own live page for this topic actually lists, runs to ten items in a specific order: LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM03 Supply Chain, LLM04 Data and Model Poisoning, LLM05 Improper Output Handling, LLM06 Excessive Agency, LLM07 System Prompt Leakage, LLM08 Vector and Embedding Weaknesses, LLM09 Misinformation, and LLM10 Unbounded Consumption. That is the 2025 list, and it is the one I should have been citing every time I referenced this topic over the last year. Reading it side by side with what I had actually been citing, the overlap in spirit is obvious even where the wording is not identical, but overlap in spirit is not the same as overlap in fact, and I had been presenting the older wording as though it were this one.
It is not the list my old bookmark pointed to. An older page, sitting at a different address on OWASP’s own domain, still serves the archived 2023 v1.1 list, with entries including Insecure Output Handling, Model Denial of Service, Insecure Plugin Design, Overreliance, and Model Theft. Different names, different emphasis, a different year, and I only found this out because I went back to verify the list properly, and the first fetch I did, on the exact search terms I had been using all along, returned that archived page rather than the current one.
What makes this the specific trap it is, rather than an ordinary case of a stale bookmark, is that nothing about landing on the old page announces that you have landed on the past. It is still hosted by the same organisation, still titled recognisably the same thing, still a perfectly real document. It simply is not the current one, and current is not a property you can tell just from a page looking legitimate. Two live pages from the same source, describing what sounds like the same top ten, and only one of them is the list anyone citing OWASP today actually means.
I had been treating a security standard the way I treat a fact learned once and filed away: true until proven otherwise, rather than true as of a publication date I should be rechecking. A fast-moving category like LLM security is exactly the kind of reference that gets superseded on a shorter timescale than the gap between my own reviews, and the only defence against citing the superseded version is treating every citation as something to reverify at the point of use, not something to trust because I checked it once, a while ago. That habit was never limited to this one list, it is just the place I happened to catch it, because the archived page was still live and specific enough to expose the gap between the two.
I have since gone back through the other standards references sitting in my own notes and past reviews, not to re-verify every fact again from scratch, but to check that each one still names a current source rather than a URL I bookmarked once and never revisited. Most held up fine. The OWASP list did not, and the only reason I noticed is that this round of writing forced me to fetch the source again rather than quote my own earlier summary of it, which is exactly the discipline a fast-moving reference actually needs and exactly the one a bookmark quietly lets you skip.