⭐ Star on GitHub

Append-only. Newest entries at the bottom.


2026-07-28 — Source folder populated and ingested

Request: pull from owasp.org/www-project-top-10-for-large-language-model-applications/ and genai.owasp.org/, and populate raw/OWASP-Top-10-for-LLMs/ (previously empty).

What the two URLs turned out to be:

  • The owasp.org project page is now a pointer page only. It states the project “has now grown into the comprehensive OWASP GenAI Security Project” and directs to genai.owasp.org/llm-top-10/. No Top 10 content on it.
  • genai.owasp.org is a WordPress/Elementor site. Pages carry ~43 lines of shared navigation each; the Top 10 landing page is a card grid with little unique prose.

Source decision: the ten entries were taken from the canonical markdown in the project repository (OWASP/www-project-top-10-for-large-language-model-applications, 2_0_vulns/) rather than scraped HTML — same reasoning as the ATLAS ingest. Cleaner, authoritative, and the site renders from it. CC BY-SA 4.0.

Version confirmed current: 2_0_vulns is the only version directory (plus Archive), so v2.0 / 2025 is the live list.

Files installed (24, ~34,200 words):

  • 11 canonical entries — LLM00_Preface.md through LLM10_UnboundedConsumption.md (11,716 words), with vault-style frontmatter added and web-version links appended
  • 12 pages converted from genai.owasp.org — top-10 overview, 2023-24 list, project intro, mission and charter, glossary, initiatives (index + agentic + AI SBOM), resources, solutions landscape, governance checklist, state of agentic AI (21,178 words of unique content)
  • index.md linking all of it

Conversion note: html2text output retained the full nav menu because an event banner is the first H1 on every page, defeating prefix-based cleaning. Resolved by diffing all fetched pages to find the 43-line shared prefix and stripping it. Content is faithful; layout-derived structure (cards, tables) may be flattened. Caveat recorded on genai-security-project.md.

Pages created (6): index.md, log.md, owasp-llm-top-10.md, the-ten-risks.md, owasp-crosswalk.md, genai-security-project.md

Findings recorded:

  • Six of ten entries have no counterpart in AI Act Art 15(5) — third independent confirmation of the agentic gap, after PITAX’s indirect-technique targets and ATLAS’s 114 Agentic AI tags.
  • 2023→2025 changes: Model Theft + DoS merged into Unbounded Consumption; Insecure Plugin Design dissolved into Excessive Agency; Vector and Embeddings and System Prompt Leakage added; Overreliance became Misinformation.
  • LLM01 maps to all 70 PITAX techniques and one ATLAS technique — fine as a risk-register item, far too coarse as a unit of analysis.
  • LLM03 is now the vault’s best supply-chain source (that folder is still empty), uniquely covering LoRA/PEFT hub risk and on-device LLMs.
  • LLM04 contributes malicious pickling and the sleeper agent framing, absent from the Data Poisoning collection.
  • LLM05 is the only source in the vault framing model output as untrusted input flowing to XSS/CSRF/SSRF/RCE.
  • The glossary supplies a fourth distinct definition of “AI cybersecurity incident” (CISA), beyond the three already catalogued in ai-incident-response-wiki.

Existing pages updated: root index.md; ai-incident-response-wiki/microsoft-ir-readiness.md and index.md, data-poisoning-wiki/*, model-theft-wiki/* (all previously flagged this folder as an open gap).

Open items:

  • An OWASP Top 10 for Agentic Applications appears to be in development (an AIUC-1 crosswalk to it is already published). Not yet released as a numbered list; worth tracking.
  • Individual genai.owasp.org/llmrisk/ pages were not pulled — they mirror the repository markdown.
  • The Solutions Landscape (~11,400 words) is a vendor market map; ingested for completeness but low technical value.