OWASP Top 10 for LLM Applications

The OWASP Top 10 for LLM Applications is a categorised list of the risks that are specific to LLM-backed software, published and maintained by the OWASP community and revised as the field moves. It names the recurring failure classes (among them prompt injection, sensitive information disclosure, excessive agency, and system prompt leakage) and gives each a description, example scenarios and mitigations. Its role is the same as the long-standing OWASP Top 10 for web: a shared vocabulary and a coverage checklist, so a test and its report speak in terms a reviewer already recognises rather than an assessor’s private taxonomy.

A framework is a floor, not a ceiling, and two mistakes follow from forgetting that. The first is treating the list as a compliance checkbox: mapping each item to a control and declaring the system safe, without ever attempting the attacks the list describes. The second is using it to bound the test, so anything the current revision does not name is never examined, even though the field produces new failure modes faster than any list is updated. From the offensive side, the list is where we start structuring coverage, not where we stop looking; the real work is chaining the categories into an exploit on the specific application.

We map each finding to a Top 10 category and cite the framework by name and version, which lets the reader place our result against a published standard rather than take our word for the taxonomy. This is the same discipline that makes a web report legible: named categories, cited source, reproducible evidence. Coverage of the list is reported explicitly, including items assessed and found not applicable. This is part of how we structure an AI penetration test, complementing the exploratory work of LLM red teaming.