OWASP LLM09:2025 Misinformation is the risk that a model produces false or misleading content that looks credible, and people or systems act on it. The main cause is hallucination: the model fills gaps with plausible fabrications. The fixes are grounding, verification, human review and clear limits on where outputs can be trusted.
What does OWASP say it is?
OWASP says the model fills gaps in its training data with statistically plausible text, and that biased data and incomplete information add to it. Overreliance makes it worse, because users trust output they have not checked. The consequences it lists are security breaches, reputational damage and legal liability.
Which real cases does OWASP cite?
The page names four kinds of example.
- Factual inaccuracy. Air Canada's chatbot gave travellers false information, which led to operational problems and a lawsuit the airline lost.
- Unsupported claims. ChatGPT fabricated legal cases that caused problems in court.
- Misrepresented expertise. KFF found health chatbots that misstated the level of uncertainty, making unsupported treatments seem still under debate.
- Unsafe code. Models suggest insecure or nonexistent libraries. Lasso Security documented the package hallucination issue.
This post links only to the OWASP page that summarises them, and I did not fetch the original reports. Read those before quoting details.
Why does this belong in a security programme?
The package case is a supply chain problem. OWASP's first scenario describes attackers finding package names that coding assistants commonly hallucinate, publishing malicious packages under those names, and waiting for developers to install them. No vulnerability in your code is needed. The model's mistake does the delivery.
The second OWASP scenario needs no attacker at all. A company deploys a medical chatbot without enough accuracy checks, it gives poor advice, and the company is sued. Weak oversight alone creates the incident.
What reduces the risk?
OWASP lists eight strategies: retrieval augmented generation grounded in trusted data, model tuning, cross-verification and human oversight, automatic validation of key outputs, risk communication to users, secure coding practices, interface design with filters and labels, and training users. Two matter most in practice.
Grounding. Answer from sources you control and show the source. A model that cites the document it used is easier to check than one that does not.
Validation before action. If the output triggers something, such as installing a package or sending money, a machine check should come first.
What to do
- Name each place a model output drives an action. Install, publish, approve, send, deploy.
- Add a check before each action. For dependencies, confirm the package exists, has real history and matches an approved list.
- Pin and review new dependencies that an assistant proposes, using a dependency inventory. Safeguard's SCA inventory and malware detection fit here for packages you consume.
- Ground customer facing answers in your own documents, and show the source.
- Label AI content and say what it cannot be trusted for.
- Keep a human in the loop for high stakes decisions in health, legal and finance.
- Sample and score outputs monthly against known answers, and record the rate of wrong answers.
- Write a policy for chatbot promises. The airline case shows a bot's statement can bind the company.
Quick check
What causes LLM misinformation?
Mostly hallucination, where the model fills gaps with plausible but fabricated content. Biased or incomplete data and user overreliance add to it, per OWASP.
How can misinformation become a supply chain attack?
A coding assistant may suggest a package name that does not exist. An attacker who registers that name with malicious code can reach developers who install it without checking.
Sources
Last reviewed: 18 October 2026.
