OWASP mapping
Every lab on GenAI Security Lab has an OWASP category tag. This page explains the categories, what they cover, and where the mapping appears in the product.
How the mapping works
Every lab across the 200+ live labs has at least one category tag: an OWASP LLM Top 10 (2026) code or an MCP/agentic extension code. Labs that cover multiple classes of flaw may have several tags.
These tags drive lab catalogue filters, team coverage reporting, and the GSCE exam blueprint. A lab's category names the primary OWASP-LLM class it teaches. An Agentic or MCP cross-reference is added only where the lab maps to that list.
OWASP LLM Top 10 (2026)
| Category | What it is | Example lab theme |
|---|---|---|
| LLM01 — Prompt Injection | Input crafted to override the system's instructions | Rewriting ShopBot's rules mid-conversation to leak SUMMER30-VIP |
| LLM02 — Sensitive Information Disclosure | The target reveals data it should keep private | A support bot revealing another customer's order history |
| LLM03 — Excessive Agency | A target does more than the task requires | An assistant with tool access that oversteps its intended scope |
| LLM04 — Supply Chain | A trusted dependency, plugin, or model is untrustworthy | A third-party plugin the target loads without checking it |
| LLM05 — Data and Model Poisoning | Training or retrieval data is tampered with before prompting | A retrieval index seeded with a malicious document |
| LLM06 — Unbounded Consumption | A request can incur excessive costs without restriction | A target with no limit on how much work one prompt can trigger |
| LLM07 — Misinformation | The target confidently presents fabricated information | A target inventing a policy, price, or citation |
| LLM08 — Hidden Context Exposure | Instructions meant to stay server-side are exposed | Extracting a target's system prompt word for word |
| LLM09 — Vector and Embedding Weaknesses | The retrieval step returns incorrect or attacker-chosen content | Steering what a RAG pipeline retrieves before the model reasons over it |
| LLM10 — Improper Output Handling | The target's output is trusted and executed downstream without checks | An unsanitized reply executed as code further down the pipeline |
OWASP Agentic (ASI) Top 10
The final version was published on 2025-12-09 by the OWASP GenAI Security Project, which also maintains the LLM list.
| Category | What it is |
|---|---|
| ASI01 — Agent Goal Hijack | An attacker redirects the agent's objective |
| ASI02 — Tool Misuse & Exploitation | A tool call is used beyond its intended scope |
| ASI03 — Identity & Privilege Abuse | An agent acts with more privilege than the requester has |
| ASI04 — Agentic Supply Chain | A trusted skill, tool, or sub-agent is compromised |
| ASI05 — Unexpected Code Execution | A code-execution capability runs more than the task requires |
| ASI06 — Memory & Context Poisoning | A planted memory entry covertly steers a later session |
| ASI07 — Insecure Inter-Agent Communication | One agent trusts a forged or manipulated message from another |
| ASI08 — Cascading Failures | One compromised step propagates through the rest of an automated chain |
| ASI09 — Human-Agent Trust Exploitation | An approval step is completed without substantive review |
| ASI10 — Rogue Agents | An agent operates outside its intended boundary |
OWASP MCP Top 10 (beta)
This remains an OWASP Incubator project. It provides provisional guidance and is not a final release.
| Category | What it is |
|---|---|
| MCP01 — Token Mismanagement & Secret Exposure | A connector token leaks or has more scope than it needs |
| MCP02 — Privilege Escalation via Scope Creep | A connector gains more access than the task requires |
| MCP03 — Tool Poisoning | A malicious tool description hijacks model behavior before the tool runs |
| MCP04 — Supply Chain & Dependency Tampering | An MCP server's dependency is tampered with |
| MCP05 — Command Injection & Execution | Unsanitized input reaches a shell or system call through a tool |
| MCP06 — Intent Flow Subversion | A request is rewritten mid-flow to change its intent |
| MCP07 — Insufficient AuthN/AuthZ | A tool call executes without properly checking the requester |
| MCP08 — Lack of Audit & Telemetry | An action leaves no observable record for later review |
| MCP09 — Shadow MCP Servers | An unsanctioned server impersonates one the target trusts |
| MCP10 — Context Injection & Over-Sharing | A tool response introduces instructions the model was not meant to receive |
Where the mapping appears
- Catalogue filters narrow 200+ labs to one category at a time.
- Team coverage reporting shows which categories your roster has completed and where gaps remain.
- The GSCE exam blueprint scopes the certification against the same categories used by the labs.
Edition updates
OWASP periodically re-ranks the LLM Top 10, which can change category numbers and names. Excessive Agency was LLM06 in the 2025 edition and is LLM03 in 2026. The 2025 category System Prompt Leakage was renamed Hidden Context Exposure for 2026, giving the same underlying category a clearer name.
Your progress doesn't move with the numbersLab URLs and your evidence history are tied to the lab, not its category number. A re-rank never resets your completed work; only the label next to a lab may change.
Catalogue filters, coverage reporting, and the GSCE blueprint are expected to adopt a new edition's categories together, shortly after OWASP publishes it.