Append-only. Newest entries at the bottom.
2026-07-28 — Source folder populated and ingested
Request: pull from owasp.org/www-project-top-10-for-large-language-model-applications/ and genai.owasp.org/, and populate raw/OWASP-Top-10-for-LLMs/ (previously empty).
What the two URLs turned out to be:
- The
owasp.orgproject page is now a pointer page only. It states the project “has now grown into the comprehensive OWASP GenAI Security Project” and directs togenai.owasp.org/llm-top-10/. No Top 10 content on it. genai.owasp.orgis a WordPress/Elementor site. Pages carry ~43 lines of shared navigation each; the Top 10 landing page is a card grid with little unique prose.
Source decision: the ten entries were taken from the canonical markdown in the project repository (OWASP/www-project-top-10-for-large-language-model-applications, 2_0_vulns/) rather than scraped HTML — same reasoning as the ATLAS ingest. Cleaner, authoritative, and the site renders from it. CC BY-SA 4.0.
Version confirmed current: 2_0_vulns is the only version directory (plus Archive), so v2.0 / 2025 is the live list.
Files installed (24, ~34,200 words):
- 11 canonical entries —
LLM00_Preface.mdthroughLLM10_UnboundedConsumption.md(11,716 words), with vault-style frontmatter added and web-version links appended - 12 pages converted from
genai.owasp.org— top-10 overview, 2023-24 list, project intro, mission and charter, glossary, initiatives (index + agentic + AI SBOM), resources, solutions landscape, governance checklist, state of agentic AI (21,178 words of unique content) index.mdlinking all of it
Conversion note: html2text output retained the full nav menu because an event banner is the first H1 on every page, defeating prefix-based cleaning. Resolved by diffing all fetched pages to find the 43-line shared prefix and stripping it. Content is faithful; layout-derived structure (cards, tables) may be flattened. Caveat recorded on genai-security-project.md.
Pages created (6): index.md, log.md, owasp-llm-top-10.md, the-ten-risks.md, owasp-crosswalk.md, genai-security-project.md
Findings recorded:
- Six of ten entries have no counterpart in AI Act Art 15(5) — third independent confirmation of the agentic gap, after PITAX’s indirect-technique targets and ATLAS’s 114 Agentic AI tags.
- 2023→2025 changes: Model Theft + DoS merged into Unbounded Consumption; Insecure Plugin Design dissolved into Excessive Agency; Vector and Embeddings and System Prompt Leakage added; Overreliance became Misinformation.
- LLM01 maps to all 70 PITAX techniques and one ATLAS technique — fine as a risk-register item, far too coarse as a unit of analysis.
- LLM03 is now the vault’s best supply-chain source (that folder is still empty), uniquely covering LoRA/PEFT hub risk and on-device LLMs.
- LLM04 contributes malicious pickling and the sleeper agent framing, absent from the Data Poisoning collection.
- LLM05 is the only source in the vault framing model output as untrusted input flowing to XSS/CSRF/SSRF/RCE.
- The glossary supplies a fourth distinct definition of “AI cybersecurity incident” (CISA), beyond the three already catalogued in
ai-incident-response-wiki.
Existing pages updated: root index.md; ai-incident-response-wiki/microsoft-ir-readiness.md and index.md, data-poisoning-wiki/*, model-theft-wiki/* (all previously flagged this folder as an open gap).
Open items:
- An OWASP Top 10 for Agentic Applications appears to be in development (an AIUC-1 crosswalk to it is already published). Not yet released as a numbered list; worth tracking.
- Individual
genai.owasp.org/llmrisk/pages were not pulled — they mirror the repository markdown. - The Solutions Landscape (~11,400 words) is a vendor market map; ingested for completeness but low technical value.