The Open Worldwide Application Security Project (OWASP) lists the top 10 most critical vulnerabilities often seen in large language model (LLM) applications. Prompt injections, poisoned training data, data leaks, and overreliance on LLM-generated content are still on the list, while newly added threats include model denial of service, supply chain vulnerabilities, model theft, and excessive agency.
The list aims to educate developers, designers, architects, managers, and organizations about the potential security risks when deploying and managing LLMs, raising awareness of vulnerabilities, suggesting remediation strategies, and improving the security posture of LLM applications.
“Organizations considering deploying generative AI technologies need to consider the risks associated with it,” says Rob T. Lee, chief of research and head of faculty at SANS Institute. “The OWASP top 10 does a decent job at walking through the current possibilities where LLMs could be vulnerable or exploited.” The top 10 list is a good place to start the conversation about LLM vulnerabilities and how to secure these AIs, he adds.
