Answer capsule
The list helps teams ask better questions about prompt injection, data disclosure, supply chains, outputs, agency, and consumption.
What the source establishes
- The 2025 list is maintained by a community-driven OWASP project.
- It addresses application-level risks such as prompt injection and excessive agency.
- The project has continued to add agentic security resources.
Turn categories into tests
A risk name has little value until it becomes an abuse case against the real application, permissions, data, and tool chain.
The accountable team should translate this point into a named workflow, affected population, source data, human owner, approval right, exception path, retained evidence, and review date. That translation is what separates an interesting AI development from a decision that can be governed and evaluated.
Scope the assembled system
A foundation model may resist one attack while a retrieval connector or downstream parser remains exploitable. Test the product architecture, not only the model endpoint.
The accountable team should translate this point into a named workflow, affected population, source data, human owner, approval right, exception path, retained evidence, and review date. That translation is what separates an interesting AI development from a decision that can be governed and evaluated.
Consumption is architecture
Retries, long contexts, tool loops, and adversarial requests can create unexpected cost and availability consequences. Limits and circuit breakers belong in production design.
The accountable team should translate this point into a named workflow, affected population, source data, human owner, approval right, exception path, retained evidence, and review date. That translation is what separates an interesting AI development from a decision that can be governed and evaluated.
Evidence to request
Ask for threat models, test cases, results, residual risks, monitoring, vulnerability response, and the customer's responsibilities for every relevant category.
The accountable team should translate this point into a named workflow, affected population, source data, human owner, approval right, exception path, retained evidence, and review date. That translation is what separates an interesting AI development from a decision that can be governed and evaluated.
Decision test
Ask whether the source changes the decision itself, the evidence required, the implementation sequence, or only the language used to describe an existing capability. Record which claims are directly supported, which are provider statements, which require an independent test, and which remain unknown. A source-linked review should make uncertainty easier to see, not bury it inside a blended score.
Questions to take into review
- Which services are common and which remain workload-specific?
- How can a team change a model without rewriting the application?
- Are source permissions enforced at retrieval and answer time?
- How are stale or superseded documents handled?
- Which repositories and dependencies are exposed?
- What checks gate generated changes?
- What actions can the assistant execute?
- Which record remains authoritative for incident and change state?
The publication supports research and executive decision preparation. It does not provide legal, financial, accounting, employment, clinical, cybersecurity, investment, procurement, or implementation advice.