Summary: Wiki pages for raw/OWASP-Top-10-for-LLMs/ — the 2025 (v2.0) Top 10 plus the broader OWASP GenAI Security Project.
Sources: raw/OWASP-Top-10-for-LLMs/ (24 files, ~34,200 words)
Last updated: 2026-07-29
Pages
| Page | Covers |
|---|---|
| owasp-llm-top-10 | The framework, provenance, and what changed from 2023-24 to 2025 |
| the-ten-risks | Each entry, with the framing that matters |
| owasp-crosswalk | Mapping across PITAX, ATLAS, the AI Act and this vault |
| genai-security-project | Initiatives, glossary, solutions landscape |
The list
LLM01 Prompt Injection · LLM02 Sensitive Information Disclosure · LLM03 Supply Chain · LLM04 Data and Model Poisoning · LLM05 Improper Output Handling · LLM06 Excessive Agency · LLM07 System Prompt Leakage · LLM08 Vector and Embedding Weaknesses · LLM09 Misinformation · LLM10 Unbounded Consumption
This closes the vault’s most-cited gap
Four previously-ingested sources named OWASP before it existed here — Microsoft (severity adaptation), Cloudflare (poisoning), Snyk (model theft), and PITAX (OWASP LLM01:2025 as an alias). It is the vocabulary the other frameworks assume you have.
Four findings
- Six of ten entries have no counterpart in AI Act Art 15(5). Prompt injection, improper output handling, excessive agency, system prompt leakage, vector weaknesses and misinformation are all unnamed in the Regulation. Third independent confirmation of the agentic gap — see owasp-crosswalk.
- The 2023→2025 changes track the same shift. Model Theft and DoS merged into Unbounded Consumption; Insecure Plugin Design dissolved into Excessive Agency; Vector and Embeddings and System Prompt Leakage were added. Plugins gave way to agents; RAG became core.
- LLM07’s position is unusually sharp: the system prompt “should not be considered a secret, nor should it be used as a security control.” The real risk is “delegating [session management and authorization] to the LLM.”
- LLM05 is the bridge to conventional appsec — treat model output as untrusted input flowing into XSS, CSRF, SSRF and RCE. Neither PITAX nor ATLAS frames it that way; Securing LLM applications implements the layer.
Where OWASP is the best source here
- LLM03 Supply Chain — uniquely covers LoRA/PEFT risk on model hubs and on-device LLM exposure, which the Supply Chain Attacks collection does not.
- LLM04 contributes malicious pickling (code execution on model load) and the sleeper agent framing, neither of which the dedicated Data Poisoning collection had.
Provenance note
The ten entries are canonical markdown from the project repository (2_0_vulns/), CC BY-SA 4.0 — not scraped. The owasp.org project page is now only a pointer to genai.owasp.org. The GenAI project pages were converted from a WordPress site and carry the caveat noted in genai-security-project.
Cross-collection links
- AI Attack Techniques — all 70 PITAX techniques live inside LLM01
- MITRE ATLAS — the attack-chain view
- Data Poisoning — LLM04
- Model Theft — LLM02 and LLM10
- AI Act Article 15 — what the law does and doesn’t name
- Root index
Gaps
- An OWASP Top 10 for Agentic Applications appears to be in progress (an AIUC-1 crosswalk to it is published). Worth tracking.
- The Solutions Landscape is a market map, not a technical reference.
- Individual
llmrisk/web pages were not pulled separately — they mirror the repository markdown already ingested.
Log
See log.