Introduction
Businesses, eager to harness the potential of LLMs and Generative AI are rapidly integrating them into their operations and client facing offerings. Yet, the breakneck speed at which LLMs are being adopted has outpaced the establishment of comprehensive security protocols, leaving many applications vulnerable to high-risk issues.
Who is it for?
Our primary audience is developers, data scientists, and security experts tasked with designing and building applications and plug-ins leveraging LLM technologies.
Affiliated Standards Organizations and Projects
Explore the Top 10
Creating the OWASP Top 10 for LLM Applications list is a significant undertaking, built on the collective expertise of an international team of more than 500 experts and over 150 active contributors. Our contributors come from diverse backgrounds, including AI companies, security companies, ISVs, cloud hyperscalers, hardware providers, and academia.
Frequently Asked Questions
The OWASP Top 10 for LLMs is a list of the most critical vulnerabilities found in applications utilizing LLMs. It was created to provide developers, data scientists, and security experts with practical, actionable, and concise security guidance to navigate the complex and evolving terrain of LLM security
The primary audience is developers, data scientists, and security experts tasked with designing and building applications and plug-ins leveraging LLM technologies.
While the list shares DNA with vulnerability types found in other OWASP Top 10 lists, it does not simply reiterate these vulnerabilities. Instead, it delves into the unique implications these vulnerabilities have when encountered in applications utilizing LLMs. The goal is to bridge the divide between general application security principles and the specific challenges posed by LLMs
The creation of the OWASP Top 10 for LLMs list was a major undertaking, built on the collective expertise of an international team of nearly 500 experts, with over 125 active contributors. The team brainstormed and proposed potential vulnerabilities, refined these proposals down to a concise list of the ten most critical vulnerabilities, and each vulnerability was then further scrutinized and refined by dedicated sub-teams and subjected to public review.
Yes, the first version of the list will not be the last. The team expects to update it on a periodic basis to keep pace with the state of the industry. They will be working with the broader community to push the state of the art, and creating more educational materials for a range of uses.
Announcements
Events
- In-Person
- Sep
- 21
- Sep
- 22
InfoSec World 2024
- In-Person
- Sep
- 10
- Sep
- 12
Cloud Security Alliance – SECtember.AI
- Virtual
- Sept
- 5
RSAC 365 Virtual Seminar: Intersection of AI & Security
- In-Person
- Sep
- 23
- Sep
- 24
OWASP Global AppSec San Francisco 2024
In the News
Lessons for CISOs from OWASP’s LLM Top 10
- Dark Reading
- 2024-04-23
- Kevin Bocek
Mitigating the OWASP Top 10 For Large Language Models Applications using Intelligent Agents
- IEEE
- 2024-02-06
- Mohammad Fasha
OWASP Top 10 for LLM Applications and Mitigation
- Security Boulevard
- 2024-02-05
- MicroHackers
What the OWASP Top 10 for LLMs Means for the Future of AI Security
- Infosecurity Magazine
- 2023-08-08
- Kevin Poireault
100+ Supporting Organizations
