OWASP Ranks Prompt Injection First in 2025 LLM Risk List: What Defenders Can Do

The OWASP Top 10 for LLM Applications 2025 ranks prompt injection first, as LLM01:2025. Vendor and academic sources cite that ranking as they explain why the weakness dominates enterprise AI risk.

Obsidian Security describes it as the single most exploited vulnerability in modern AI systems. Vectra AI calls it the most critical security vulnerability facing enterprise AI, and an arXiv preprint calls it the most critical in deployed AI agents.

None of those superlatives rests on independently measured exploitation data. OWASP’s list ranks risk rather than counting incidents. The sources do agree on the mechanism, the documented cases and a set of layered controls.

What prompt injection is

Prompt injection is an attack in which crafted input causes a large AI text model (an LLM) or an AI agent to follow an attacker’s instructions instead of the system’s intended ones. A user can type the input, or it can be hidden in content the model reads. Sysdig, CrowdStrike and OWASP all use this framing.

The technique is not new. Riley Goodside demonstrated it in September 2022, and Simon Willison coined the term soon after. In 2023, Kai Greshake and colleagues showed it works indirectly, through content a model retrieves rather than text a user types.

Vectra compares it to SQL injection, because both mix code or instructions with data. Vectra says prompt injection reaches further, since it affects every AI application that processes external input.

Why it persists

The root cause is structural. These models take trusted instructions and untrusted data in as one stream of natural-language text, and they have no built-in way to tell the two apart. OWASP says there is no foolproof prevention inside the model.

An arXiv preprint pushes the argument further. Its authors say defenses built on separating data from instructions have fundamental limits. They report that prompt-injection classifiers, including Meta’s Prompt Guard and Prompt Guard 2, performed near chance (AUROC 0.43 to 0.59) against attacks that manipulate context without override wording. That is one preprint’s result, and readers should weigh it accordingly.

Direct, indirect and stored injection

Direct injection comes from the person typing into the system, and it still works against exposed chatbots. Indirect injection plants instructions in emails, documents, web pages or retrieved files that an agent reads on its own.

Sysdig and Vectra both describe indirect injection as the dominant pattern in enterprise findings since 2024.

A third variant, stored or persistent injection, places instructions in agent memory, knowledge bases or configuration files so they can reactivate in later sessions. Sysdig and Vectra say this makes detection and cleanup harder, because the malicious text outlives the conversation that introduced it.

Documented cases

The best-known case is EchoLeak. Sysdig and Vectra report that Aim Labs disclosed it in mid-2025 and that its identifier is CVE-2025-32711. In their accounts it was a zero-click data exfiltration attack against Microsoft 365 Copilot, triggered by a crafted email with no user interaction.

Both sources give the flaw a CVSS (Common Vulnerability Scoring System) severity score of 9.3. The scoring comes from their summaries; the vendor advisory or NVD entry is the place to confirm it.

Sysdig and Vectra list other findings. They include Slack AI data exfiltration (PromptArmor, 2024), Cursor remote code execution through an MCP configuration (CVE-2025-54135), the GitHub MCP “toxic agent flow” (Invariant Labs, 2025) and a GitHub Copilot remote code execution flaw (CVE-2025-53773). MCP, the Model Context Protocol, is a standard for connecting agents to tools and data.

The sources do not say whether patches have shipped for any of these CVEs. Readers running the affected products should check each vendor advisory or NVD entry for patch status.

The data-flow pattern behind the incidents

Sysdig notes that nearly every major agent injection finding pairs three conditions. The agent can reach private data, it takes in content from outside parties, and it has a route to send information out. Simon Willison calls this the “lethal trifecta.” Sysdig says removing any one of the three breaks the attack path.

That suggests a design test based on data flow. An agent that reads inbound email, can see internal files and can send data out holds all three. An architecture review can ask which condition is easiest to remove for each deployment.

How big is the exposure?

Vectra’s page cites a meta-analysis reporting attack success rates of 66.9% to 84.1% in agent systems with auto-execution. The same page reports that 83% of organizations plan to deploy agentic AI, 29% feel ready to do so securely and 34.7% have dedicated prompt injection defenses. These are secondary figures relayed by a vendor, so treat them as indicative rather than settled.

Defensive steps the sources recommend

Obsidian Security, CrowdStrike, Galileo and OWASP converge on layered controls and stress that filtering alone is insufficient. The measures below cover what to build, not how attacks work.

• Give the agent and its tokens least-privilege access.
• Require human approval for privileged or irreversible actions.
• Segregate and label untrusted content, and sanitize retrieved content.
• Treat the model as an untrusted component, with trust boundaries around it.
• Check model output and tool calls before they execute.
• Monitor agent behavior against baselines.
• Run red-team exercises continuously, not once.

The first two limit the damage when a filter fails. If an agent’s token can read only one mailbox folder, a successful injection can reach only that folder. If sending data outside needs a person’s approval, the exfiltration step has a checkpoint.

For suspected incidents, Obsidian Security’s guidance lists isolating the agent, preserving logs, reviewing the data accessed, rotating credentials and API keys, and updating detection rules.

What government guidance says

Sysdig reports that the Five Eyes agencies (CISA, NSA and counterparts in the UK, Canada, Australia and New Zealand) issued joint agentic AI guidance in May 2026. This account is secondhand, and readers should check the guidance itself before relying on it.

In Sysdig’s description, the guidance names prompt injection as a core manipulation route, says no single safeguard is enough and recommends incremental adoption with human oversight of consequential decisions.

Prompt injection also appears in the NIST AI Risk Management Framework, in MITRE ATLAS (AML.T0051) and in NIST’s adversarial machine learning taxonomy. Teams that map controls to those frameworks can place injection in existing risk registers.

Why it matters

As AI agents gain access to email, files and tools, a successful injection can leak data or trigger actions using the agent’s own legitimate permissions. That makes the data flow the thing to audit: what the agent can read, what it can send and who approves the step between them.

Obsidian Security and OWASP point toward limiting agent privileges and requiring human approval for risky actions, and OWASP says no foolproof prevention exists inside the model. The preprint’s classifier results are consistent with that, though they are one study.

An open question

The “most exploited” claim comes from Obsidian Security, and the sources offer no independent exploitation counts to test it. Until someone publishes such data, the OWASP ranking is best read as a statement of risk, not a tally of attacks.