OWASP mapping
Every lab on GenAI Security Lab is tagged to an OWASP category — this page explains the taxonomy, what each category covers, and where the mapping surfaces across the product.
How the mapping works
Across 200+ live labs, every lab carries at least one category tag: an OWASP LLM Top 10 (2026) code, or one of the MCP/agentic extension codes, and sometimes several at once when a lab genuinely spans more than one class of flaw.
The tag isn't decoration. It's what the lab catalogue filters by, what a team's coverage reporting rolls up by, and what the GSCP exam blueprint is built from. A lab's category names the primary OWASP-LLM class it teaches; a cross-reference to the Agentic or MCP list is added only where a genuine mapping exists, not assumed for a fuller-looking tag.
OWASP LLM Top 10 (2026)
| Category | What it is | Example lab theme |
|---|---|---|
| LLM01 — Prompt Injection | Input crafted to override the system's own instructions | Rewriting ShopBot's rules mid-conversation to leak SUMMER30-VIP |
| LLM02 — Sensitive Information Disclosure | The target reveals data it was supposed to keep back | A support bot surfacing another customer's order history |
| LLM03 — Excessive Agency | A target does more than the task actually calls for | An assistant with tool access that oversteps its intended scope |
| LLM04 — Supply Chain | A trusted dependency, plugin, or model turns out not to be | A third-party plugin the target loads without questioning it |
| LLM05 — Data and Model Poisoning | Training or retrieval data gets tampered with before you ever prompt it | A retrieval index seeded with a hostile planted document |
| LLM06 — Unbounded Consumption | Nothing stops a request from costing more than it should | A target with no limit on how much work one prompt can trigger |
| LLM07 — Misinformation | The target states a fabrication with total confidence | A target inventing a policy, price, or citation that doesn't exist |
| LLM08 — Hidden Context Exposure | Instructions meant to stay server-side leak out instead | Extracting a target's system prompt word for word |
| LLM09 — Vector and Embedding Weaknesses | The retrieval step returns the wrong, or attacker-chosen, content | Steering what a RAG pipeline retrieves before the model reasons over it |
| LLM10 — Improper Output Handling | The target's output gets trusted and run downstream without a check | An unsanitized reply executed as code further down the pipeline |
OWASP Agentic (ASI) Top 10
Published final on 2025-12-09 by the same OWASP GenAI Security Project that maintains the LLM list.
| Category | What it is |
|---|---|
| ASI01 — Agent Goal Hijack | An attacker redirects what the agent is actually trying to do |
| ASI02 — Tool Misuse & Exploitation | A tool call gets used well beyond what it was scoped for |
| ASI03 — Identity & Privilege Abuse | An agent acts with more privilege than the requester actually has |
| ASI04 — Agentic Supply Chain | A skill, tool, or sub-agent the agent trusts turns out compromised |
| ASI05 — Unexpected Code Execution | A code-execution capability runs more than the task called for |
| ASI06 — Memory & Context Poisoning | A planted memory entry quietly steers a later session |
| ASI07 — Insecure Inter-Agent Communication | One agent trusts a forged or manipulated message from another |
| ASI08 — Cascading Failures | One compromised step propagates through the rest of an automated chain |
| ASI09 — Human-Agent Trust Exploitation | An approval step gets rubber-stamped without a real review |
| ASI10 — Rogue Agents | An agent operates outside the boundary it was meant to stay inside |
OWASP MCP Top 10 (beta)
Still an OWASP Incubator project rather than a final release — treat it as directional, not definitive.
| Category | What it is |
|---|---|
| MCP01 — Token Mismanagement & Secret Exposure | A connector token leaks, or carries more scope than it needs |
| MCP02 — Privilege Escalation via Scope Creep | A connector ends up with more access than the task requires |
| MCP03 — Tool Poisoning | A malicious tool description hijacks model behavior before it ever runs |
| MCP04 — Supply Chain & Dependency Tampering | One of an MCP server's own dependencies gets tampered with |
| MCP05 — Command Injection & Execution | Unsanitized input reaches a shell or system call through a tool |
| MCP06 — Intent Flow Subversion | A request gets rewritten to a different intent mid-flow |
| MCP07 — Insufficient AuthN/AuthZ | A tool call executes without properly checking who's asking |
| MCP08 — Lack of Audit & Telemetry | An action happens that nobody would notice after the fact |
| MCP09 — Shadow MCP Servers | An unsanctioned server impersonates one your target actually trusts |
| MCP10 — Context Injection & Over-Sharing | A tool's response smuggles in instructions the model wasn't meant to receive |
Where the mapping shows up
- Catalogue filters — narrow 200+ labs down to one category at a time.
- Team coverage reporting — see which categories your roster has cleared, and which are still gaps.
- The GSCP exam blueprint — the certification is scoped against the same categories your labs already use.
Edition updates
OWASP re-ranks the LLM Top 10 periodically, and a re-rank can move more than a number. Excessive Agency was LLM06 in the 2025 edition and is LLM03 in 2026; System Prompt Leakage, also 2025, was renamed Hidden Context Exposure for 2026 — the same underlying category, a clearer name.
Your progress doesn't move with the numbersLab URLs and your evidence history are tied to the lab, not to a category number, so a re-rank never resets what you've completed — only the label next to a lab may change.
Expect catalogue filters, coverage reporting, and the GSCP blueprint to pick up a new edition's categories together, shortly after OWASP publishes it.