AI Security FoundationsPart 7 of 8 · Contents
Orientation: OWASP, the two tracks, and scope
This lesson puts the ten OWASP LLM risk names on the attack-surface map you already know. It also sets the one scope rule you follow on both learning tracks.
OWASP and the LLM Top-10
This orientation lesson teaches no new mechanism. It builds on two earlier Foundations lessons. The lesson "How LLMs work, just enough" showed how a model reads all of its input as one stream of tokens. The lesson "Anatomy of an LLM app" laid out the attack-surface map that every risk sits on.
That map follows a request through these stages:
- the user prompt
- your orchestration code, which assembles the full prompt
- the model
- the output
- the sink, where the output lands and takes effect
Two side-channels also feed the model: retrieval and tools.
OWASP is a nonprofit that publishes open, community-built security standards. It is vendor-neutral, which means no vendor is selling a product behind its standards. You may already know one of them, the OWASP Top 10 for web applications.
The OWASP LLM Top-10 is OWASP's list of the ten most important LLM risk categories. The categories are numbered LLM01 to LLM10. Everything on this platform is organised around this list. You do not work through it in numeric order.
Where each risk sits on the map
Each of the ten names is an agreed label for a place on the map you already know. When you meet a risk on any later learning path, you should be able to point at its place. You do not need to memorise the names or tick them off like a compliance list.
Five of the names have a clear example in ShopBot, the fictional store assistant:
- LLM01 Prompt Injection sits where the user prompt meets your orchestration code. ShopBot's standing rules and a shopper's message reach the model in the same stream of tokens. The model is trained to rank the rules higher than the message. That ranking can fail, because no permission check enforces it.
- LLM02 Sensitive Information Disclosure covers any secret in the model's context. For ShopBot, that includes the staff discount code written into its system prompt.
- LLM03 Excessive Agency sits in the tools channel. For ShopBot, that means the refund function it is allowed to call.
- LLM09 Vector and Embedding Weaknesses sits in the retrieval channel. For ShopBot, that means the product reviews it pulls in to answer a question.
- LLM10 Improper Output Handling sits where the output meets its sink. For ShopBot, that is wherever its reply lands, such as a browser, a query or a shell.
The other five sit on the same map:
- LLM04 Supply Chain sits upstream of the model.
- LLM05 Data and Model Poisoning also sits upstream of the model.
- LLM06 Unbounded Consumption sits at the system's cost and capacity limits.
- LLM07 Misinformation sits inside the model itself.
- LLM08 Hidden Context Exposure sits at the context boundary.
If you cannot place a name yetYou can still move on. Each risk is taught in full on its own learning path, at the point where you need it.
The two tracks
A track is your route through the ten risks. You choose one of two tracks. Both cover the same risks from different sides.
You attack a live target until it does something it was told never to do. It might leak a secret code, ignore one of its rules or call a tool it should not use. You see how each risk breaks before you learn why a fix works.
This track is defence-first. You build a control, harden it and prove that it holds. The track has no attack prerequisite. You can defend a risk you have never attacked.
You can switch between the tracks whenever you like. You might attack a risk to understand it, then defend it on the Defensive track. You can also start on the defensive side and never send an attack payload.
The one rule: scope
This lesson sets one lasting rule about scope. Scope means the systems you may test and the dates when you may test them. This rule is the only ethics topic in Foundations. It has two parts.
Test only systems you own or are explicitly authorised in writing to test. Every target this platform gives you is authorised. A lab exists to give you a system you are allowed to test. Outside the platform, an authorisation counts only if it includes all of these:
- named systems
- agreed dates
- a person with the authority to grant permission
Keep everything you learn inside that scope. Your findings are the system owner's confidential information. Use these techniques only for authorised assessment and defence.
The responsibility is yoursA public chatbot you happen to find is out of scope. Nobody has given you written permission to test it. The excuse "I was only checking whether it was vulnerable" describes the unauthorised testing that this rule forbids.
Where to start
The rest of Foundations teaches no new mechanism. From here on, you work through the map one part at a time.
LLM01 Prompt Injection is the root technique that the rest of the series builds on. Its live target is ShopBot. Start with the prompt-injection walkthrough. You can also open the full set of LLM risks and pick the risk you care about first.
OWASP is a vendor-neutral nonprofit. Its LLM Top-10 (LLM01 to LLM10) is this platform's shared vocabulary, not a compliance checklist.
The two tracks cover the same ten risks from two sides. The Offensive (Pentester) track attacks live targets. The Defensive (Developer and Defender) track builds and hardens controls.
The Defensive track is defence-first and has no attack prerequisite. You can switch between the two tracks whenever you like.
Test only what you own or are authorised in writing to test. Stay in scope. Keep what you find confidential.
Is the OWASP LLM Top-10 the same as the classic OWASP Top 10 for web apps?
No. It is a separate list, made by the same kind of vendor-neutral OWASP community effort. The web Top 10 still applies to the ordinary app around your model. The LLM Top-10 (LLM01 through LLM10) covers what breaks because a language model is now in the loop. You will use both.
Do I have to memorise all ten risk names before I start?
No. Each name marks a place on the attack-surface map, such as the retrieval channel, the output sink or the tools channel. If you can point at where a name sits, you are oriented enough. Each risk is then taught in full on its own learning path, when you need it.
I am a pentester. Is the Defensive track just watered-down content I can skip?
No. It covers the same ten risks, defence-first, with no attack prerequisite. Plenty of practitioners take both tracks. They attack a risk on the Offensive track to see how it fails, then build and prove the control on the Defensive track. You can switch between the tracks whenever you like, in either order.
The scope rule sounds obvious. Why call it out for AI targets specifically?
LLM targets are unusually easy to probe on impulse. Typing 'ignore previous instructions' into a public chatbot takes two seconds. But a system you find in the wild has no named scope, dates or permission behind it. Probing it 'just to check' is unauthorised testing. Every target this platform gives you is authorised, and nothing you happen to find outside it is.
© 2026 GenAI Security Lab. All rights reserved. You may read, quote, and link to this material with attribution. Copying, republishing, redistribution, resale, or use to train models or build competing products is prohibited without prior written permission.