LLM09:2025 — Misinformation

Slide 2 · The Word

Misinformation — and why OWASP made it one category.

Two failures. One risk entry.

The OWASP Definition

LLM09:2025 covers two linked failures: the model generating false information, and users placing excessive trust in that information without verification.

Why OWASP Merged These in 2025

In 2023, OWASP listed “Overreliance” as a separate risk. In 2025 they merged it into Misinformation. The reason: they are the same problem viewed from two angles. The model produces the false output. The user acts on it without checking. Both halves are required to explain the harm.

The Model’s Half

Hallucination — generating false content as if it were true

Confident tone — no hedging, no visible uncertainty signal

Plausible fabrication — wrong details that sound exactly right

The User’s Half

Overreliance — using output without independent verification

Authority bias — assuming the AI knows more than it does

Skipped review — acting on output before checking it

The Key Insight

Fixing only the model (better calibration, more hedging) is not enough if users still skip verification. Fixing only the user (better training) is not enough if the model confidently fabricates. You need both halves addressed.

← Back Next → How hallucination works