Context
What happened, and why it matters
The 2025 list covers prompt injection, sensitive information disclosure, supply-chain risks, data and model poisoning, improper output handling, excessive agency, system prompt leakage, vector and embedding weaknesses, misinformation and unbounded consumption.
Not every item has equal relevance to every chatbot. A public FAQ assistant with no customer data and no tools has a different impact profile from an agent that reads a CRM and sends emails.
Testing should include the surrounding application: authentication, conventional web security, retrieval permissions, output rendering, costs, logging and the human escalation process.
Separate the announcement from the outcome
The named source explains what its publisher announced or recommended. It does not guarantee availability, suitability or results for every organisation.
Check the current primary source
Confirm dates, account eligibility, contractual terms and current documentation before changing a live service. Fast-moving products may differ from the version described here.
Use a controlled change
Define the intended result, owner and rollback route. Test with a limited scope, review evidence and document the decision before wider use.
Details
A useful way to read the update
| Test area | Evidence to collect |
|---|---|
| Threat model | Data, users, attackers, tools and consequences |
| Access control | Results for authorised and unauthorised accounts |
| Adversarial prompts | Inputs, outputs and observed tool behaviour |
| Cost limits | Rate, token and provider budget enforcement |
| Recovery | Disable, revoke, investigate and restore procedure |
Work through the guide
Make the next decision clearer.
The OWASP list is a risk-awareness framework, not a certificate or a complete penetration test. Teams should map relevant risks to the actual data, tools and decisions in their application.
Start by separating a published update from what needs changing in your own setup.
Decision check
Put the update in your own context
Decision path
Move from news to a controlled change.
- 1ReadPrimary source
- 2CheckYour context
- 3TestLimited scope
- 4ReviewUseful evidence
- 5RecordDecision & owner
Practical response
What to do next
- 01
Choose applicable risks through threat modelling.
- 02
Create repeatable tests with expected outcomes.
- 03
Test indirect as well as direct instructions.
- 04
Verify access in source systems, not only prompts.
- 05
Retest after model, prompt or connector changes.
Work through the guide
Choose applicable risks through threat modelling.
OWASP GenAI Security Project
Create repeatable tests with expected outcomes.
Questions
How to use this update responsibly
What period does this article cover?
2025 edition. The article was published on 17 September 2026; check the linked source for changes made later.
Does the announcement mean every organisation should adopt it?
No. Availability, cost, risk and usefulness depend on the specific workflow. A limited test with an owner and measurable acceptance criteria is more informative than a provider demonstration.
How should unverified discussion be treated?
Forum posts, rumours and individual reviews can reveal questions worth testing, but they do not establish prevalence or fact. Confirm material decisions through primary documentation, direct testing and qualified advice where necessary.
Relevant service
Need help applying this to your own setup?
Our security, privacy & accessibility service can help you review the current position, decide what is proportionate and plan a clearly scoped next step.
Explore Security, privacy & accessibilitySources
Read the original material
These sources support the factual description above. External pages can change after our publication date.