AI Security
The full OWASP Top 10 for LLM Applications, the standard, practitioner-focused list of what goes wrong in production AI systems.
AI Model & Training Data Supply Chain Risks
A third-party model, dataset, or hosting component compromised before it reaches an application, the same supply-chain pattern as any other dependency, applied to the AI pipeline.
Ceiling: CriticalAI Sensitive Information Disclosure
A model reveals fragments of its training data, another user's conversation context, or internal instructions it was never meant to disclose, through nothing more than an ordinary-looking query.
Ceiling: CriticalExcessive Agency
An AI system given more real-world tool access, permission, or autonomy than its actual task requires, so any manipulation of its behavior can trigger real, unauthorized actions.
Ceiling: CriticalInsecure Output Handling
Trusting a large language model's output enough to render or execute it directly, without giving it the same validation any other untrusted input would get.
Ceiling: HighMisinformation
A model states false or unsupported information with the same fluent confidence as a correct answer, and a user or downstream system relies on it as fact.
Ceiling: CriticalPrompt Injection
Getting a large language model to follow attacker-supplied instructions hidden inside the content it's asked to process, rather than the instructions its own developer gave it.
Ceiling: HighSystem Prompt Leakage
A model's confidential developer instructions, meant to stay hidden, get extracted through the same conversation channel a user talks to it through.
Ceiling: CriticalTraining Data Poisoning
An attacker deliberately corrupts the data used to train or fine-tune a model, so the model learns a behavior that benefits the attacker later, without anyone reviewing the training data noticing.
Ceiling: HighUnbounded Consumption
An AI system with no limit on how much computation, tokens, or cost a single request or user can drive, turning metered inference into a denial-of-service and denial-of-wallet risk.
Ceiling: CriticalVector and Embedding Weaknesses
A retrieval-augmented system's vector database inherits the access-control and integrity risks of any other database, while typically getting far less security scrutiny.