Orientation: OWASP, the two tracks, and scope
One page to get your bearings. OWASP is a nonprofit that publishes community security standards; the OWASP LLM Top-10 is its list of the ten most important LLM risk categories, and it is the spine of this platform - the map from the previous section with names on it. You will work through it on one of two tracks: an Offensive (Pentester) track, where you attack a live target to feel how each risk breaks, and a Defensive (Developer and Defender) track, which is defence-first and needs no attack prerequisite. Two rules govern everything: test only what you own or are explicitly authorised to test, and keep everything you learn inside that scope.
OWASP, and the map with names on it
This part is orientation, not a new mechanism. The sections before it did the real teaching: how a model reads text as one flat token stream, and the single attack-surface map every risk lives on — user prompt, your orchestration code, the model, the output, the sink it flows into, plus the two side-channels that feed the model, retrieval and tools. You already have the territory. This part hands you the two things you were missing: names for it, and a lane to walk it.
OWASP is a vendor-neutral nonprofit. It publishes open, community-built security standards with no vendor selling anything behind them. Its OWASP LLM Top-10 is a list of the ten most important LLM risk categories, LLM01 through LLM10, and it is the spine of everything on this platform. It is not a new idea to learn. It is the map you already drew, with an agreed name written on each edge.
The one-line versionThe Top-10 is not a syllabus you work through in order. It is a shared set of labels for the pipeline you already understand, so a risk you meet on any later path arrives with an address you recognise.
Ten addresses, not a checklist
The ten names are not a compliance list to tick, and not a glossary to memorise. Each one is an address on the shared map. Read a name and you should be able to point at where on the pipeline it lives:
- LLM01 Prompt Injection — the prompt-and-orchestration seam, where ShopBot's standing rules and a shopper's message melt into one token stream.
- LLM02 Sensitive Information Disclosure — whatever secret is sitting in the model's context, like the staff discount code baked into ShopBot's system prompt.
- LLM03 Excessive Agency — the tools channel: the refund function ShopBot is allowed to call.
- LLM09 Vector and Embedding Weaknesses — the retrieval channel, the product reviews ShopBot pulls in to answer a question.
- LLM10 Improper Output Handling — the output-and-sink edge, where ShopBot's reply lands in a browser, a query, or a shell.
The other five ride the same map: LLM04 Supply Chain and LLM05 Data and Model Poisoning upstream of the model, LLM06 Unbounded Consumption at the cost-and-capacity edge, LLM07 Misinformation inside the model box itself, and LLM08 Hidden Context Exposure across the context boundary. Ten names, one map. You do not memorise them, you locate them.
The tell you are orientedIf you can say which edge of the pipeline a name points at, this part has done its job. If you cannot yet, that is fine — each risk is taught in full, just in time, on its own path. Nothing here needs rote learning.
Two tracks over one map
You work through those ten risks on one of two tracks. They are two routes over the same map, not two different syllabuses.
You attack a live target until it does the thing it was told never to do — leak the code, call the tool, cross the line. You feel exactly how each risk breaks before you ever see why a fix works.
Defence-first. You build the control, harden it, and prove it holds — with no attack prerequisite. You do not need to have exploited a thing to start defending it.
It is the same ten risks either way, and you can cross between the tracks whenever you like. Attack a risk to understand it, then switch over and defend it; or start on the defensive side and never fire a payload. The track is the lane you take through the map, not a different map.
The one rule: scope
Orientation adds exactly one durable rule, and it is the only ethics stop on the whole tour — a scope line, not a lecture. It has two halves.
Test only systems you own or are explicitly authorised in writing to test. On this platform that is every target it hands you; they are all sanctioned, which is the entire point of a lab. In the wild it means nothing without named systems, agreed dates, and someone who can actually grant permission.
Keep everything you learn inside that scope. Findings are the owner's confidential information, and these techniques are tools for sanctioned assessment and defence — nowhere else.
This lands on you"I was only checking whether it was vulnerable" is not a defence, it is a description of unauthorised testing. A public chatbot you happen to find is out of scope: no named system, no dates, no permission behind it. The intent to probe is exactly what the scope line rules out.
Where you attack this for real
You now have the whole territory: a map, an address for every edge, two lanes across it, and one rule about what you are allowed to touch. Nothing left in Foundations is new mechanism — it is this, aimed one edge at a time.
So stop reading the map and walk it. LLM01 Prompt Injection is the root technique the rest of the series builds on, and it has a live target — ShopBot — waiting for you. Start there with the prompt-injection walkthrough, or open the full set of LLM risks and pick the edge you care about first.
You learned the map once. From here you only aim it — on the track you choose, against targets you are allowed to touch.
OWASP is a vendor-neutral nonprofit; the LLM Top-10 (LLM01-LLM10) is shared vocabulary for this platform, not a compliance checklist.
Two tracks, one map: the Offensive (Pentester) track attacks live targets, the Defensive (Developer and Defender) track builds and hardens - the same ten risks from two sides.
The Defensive track is defence-first with no attack prerequisite, and you can cross between the two tracks whenever you like.
Authorised targets only: test only what you own or are authorised in writing to test, stay in scope, and keep what you find confidential.
Is the OWASP LLM Top-10 the same as the classic OWASP Top 10 for web apps?
No — it is a separate list, produced by the same kind of vendor-neutral OWASP community effort but scoped to LLM-specific risks (LLM01 through LLM10). The web Top 10 still applies to the ordinary app around your model; the LLM Top-10 covers what breaks because a language model is now in the loop. You will use both.
Do I have to memorise all ten risk names before I start?
No. They are addresses on the attack-surface map, not a glossary to recite. If you can point at where on the pipeline a name lives — the retrieval channel, the output sink, the tools layer — you are oriented enough. Each risk is then taught in full, just in time, on its own path.
I am a pentester — is the Defensive track just watered-down content I can skip?
No, it is the same ten risks approached defence-first, and it needs no attack prerequisite. Plenty of practitioners run both: break a risk on the Offensive track to feel how it fails, then build and prove the control on the Defensive track. You can cross between them whenever you like, in either order.
The scope rule sounds obvious — why call it out for AI targets specifically?
Because LLM targets are unusually easy to probe on impulse: a public chatbot is right there, and typing 'ignore previous instructions' takes two seconds. That convenience is the trap. A system you found in the wild has no named scope, dates, or permission behind it, so probing it 'just to check' is unauthorised testing — every target this platform hands you is sanctioned, and nothing you stumble on outside it is.
© 2026 GenAI Security Lab. All rights reserved. You may read, quote, and link to this material with attribution. Copying, republishing, redistribution, resale, or use to train models or build competing products is prohibited without prior written permission.