Summary: Where each OWASP entry lands in PITAX, ATLAS, the AI Act and this vault’s collections. OWASP is the lingua franca the other frameworks assume.
Sources: raw/OWASP-Top-10-for-LLMs/; cross-referenced against PITAX, ATLAS 2026.06, Regulation (EU) 2024/1689
Last updated: 2026-07-29
The master table
| OWASP 2025 | PITAX | ATLAS | AI Act Art 15(5) | Vault collection |
|---|---|---|---|---|
| LLM01 Prompt Injection | All 70 techniques | AML.T0051 (+.000/.001/.002) | not named | Attack Techniques |
| LLM02 Sensitive Info Disclosure | T58 oracle extraction | Exfiltration tactic | confidentiality attacks | Model Theft |
| LLM03 Supply Chain | T46 instruction-file injection | Resource Development | model poisoning | Supply Chain |
| LLM04 Data & Model Poisoning | T13, T32, T44, T64 | Resource Development | data poisoning | Data Poisoning |
| LLM05 Improper Output Handling | T63 structured-output coercion | Execution | not named | Secure Coding |
| LLM06 Excessive Agency | T42, T43, T47, T53, T65, T69, T70 | AML.T0053 | not named | Agentic attacks |
| LLM07 System Prompt Leakage | T58, T05 CoT introspection | Discovery tactic | not named | — |
| LLM08 Vector & Embedding | T64, T13 | Resource Development | not named | RAG poisoning |
| LLM09 Misinformation | T57, T67 (offensive use) | Impact tactic | not named | — |
| LLM10 Unbounded Consumption | T09, T41 (query-hungry attacks) | AI Model Access | confidentiality attacks | Model Theft |
What the crosswalk exposes
Six of ten OWASP entries have no counterpart in AI Act Art 15(5). The Act names five attack classes drawn from the adversarial-ML canon — data poisoning, model poisoning, adversarial examples, confidentiality attacks, model flaws. Prompt injection, improper output handling, excessive agency, system prompt leakage, vector weaknesses and misinformation are all absent by name.
This is the third independent line of evidence for the same conclusion already recorded in Article 15:
- PITAX has 6 purely-indirect techniques, all targeting agent infrastructure.
- ATLAS tags 114 techniques as Agentic AI — its largest platform category.
- OWASP devotes three of ten entries (LLM05, LLM06, LLM08) to agent and retrieval plumbing.
Three taxonomies built by different communities converge on an attack surface the Regulation does not name.
LLM01 is not a peer of the others. It maps to all 70 PITAX techniques and to one ATLAS technique. As a risk-register line item it is fine; as a unit of analysis it is far too coarse. Anyone working on prompt injection needs PITAX underneath it.
Granularity comparison
| Framework | Prompt injection is… | Total objects |
|---|---|---|
| OWASP | 1 of 10 entries | 10 |
| ATLAS | 1 technique + 3 sub-techniques | 173 techniques |
| PITAX | the entire taxonomy | 70 techniques |
Each is correctly scoped for its job. OWASP names the risk for a board; ATLAS places it in an attack chain for a SOC; PITAX describes the payload for a red team.
Where OWASP is the best source in the vault
Two entries carry material nothing else here covers:
- LLM03 Supply Chain uniquely covers LoRA/PEFT fine-tuning risk on model hubs and on-device LLM exposure — detail absent from the Supply Chain Attacks collection, whose taxonomy operates a layer above.
- LLM05 Improper Output Handling frames LLM output as untrusted input flowing into XSS, CSRF, SSRF and RCE — the bridge to conventional appsec, which neither PITAX nor ATLAS offers. Securing LLM applications implements this layer.
LLM04 also contributes two things the dedicated Data Poisoning collection lacks: malicious pickling (code execution on model load, not model misbehaviour) and the sleeper agent framing for trigger-gated backdoors.
Regulatory usage
Microsoft’s IR readiness pattern cites the OWASP Top 10 for LLMs under severity adaptation — supplementing “traditional metrics with contextual factors: domain, user population, content nature, and misuse potential” (source: raw/AI-incident-response/Incident response for AI systems.md).
That is the practical role: an incident taxonomy vocabulary for AI-specific harm categories, which is exactly what Microsoft identifies as missing when “incidents default to generic buckets.” See Microsoft IR readiness.