For coding assistants, six of the ten OWASP LLM risks matter most: prompt injection, sensitive information disclosure, supply chain, improper output handling, excessive agency and misinformation. The rest apply mainly to teams building their own model applications rather than using an assistant.
The 2025 list
OWASP's Top 10 for LLM Applications (2025) is: prompt injection, sensitive information disclosure, supply chain, data and model poisoning, improper output handling, excessive agency, system prompt leakage, vector and embedding weaknesses, misinformation, and unbounded consumption.
Mapping to coding assistants
| Risk | Developer scenario | Control |
|---|---|---|
| Prompt injection | Agent reads a hostile issue or README | Least privilege, approval for risky actions |
| Sensitive information disclosure | Secret in context or pasted log | Data rules, file exclusion, scanning |
| Supply chain | Assistant suggests an unvetted package or tool | Dependency policy, approved extensions and servers |
| Improper output handling | Generated code runs without checking | Review, tests, static analysis |
| Excessive agency | Agent has broad tokens and shell access | Scoped identity, sandbox, allowlists |
| Misinformation | Invented function or package name | Verify references, lockfile review |
The ones that matter less, and when they matter more
Data and model poisoning, vector and embedding weaknesses and system prompt leakage matter mostly if you build products on models, for example a retrieval system over internal docs. If you build an internal coding assistant on your own code index, vector and embedding weaknesses move up the list. Unbounded consumption is a cost and availability concern. For hosted assistants it often shows up as runaway agent loops and budget surprises.
How to use the list
- Copy the table above into your policy review.
- For each of the six, name the owner and the check that proves the control works.
- Mark any row with no check as a gap.
- Revisit when you adopt a new kind of tool, such as cloud agents.
Do not treat the list as a certification checklist. It is a risk catalog. It tells you what to think about, not how much control is enough.
Related standard
NIST published SP 800-218A in July 2024, an SSDF community profile for generative AI and dual-use foundation models, aimed at producers of models, producers of systems using them, and acquirers. It is mostly relevant if you produce or procure AI systems, and it is meant to be used with SP 800-218.
Quick check
Is the OWASP list a compliance requirement?
No. It is community guidance. Customers may ask you about it, but it is not a certification.
Which risk should we address first?
Start where you have exposure: if developers use agents, excessive agency and prompt injection. If only autocomplete, data disclosure and output review.
Safeguard offers dependency scanning, policies and gates, and MCP Guardrail, and a free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
