OWASP, the Open Worldwide Application Security Project, is the open-source community that produces the OWASP Top 10 series of vulnerability lists used as baseline security checklists across web, API, mobile, and now LLM applications. The Top 10 for LLM Applications names the ten most critical risks for generative AI systems.
- A nonprofit community whose Top 10 lists are the industry's default baselines
- The Top 10 for LLM Applications is the AI list security teams evaluate against
- Prompt injection has held first position across two consecutive editions
- Expect vendors to map coverage to all ten categories, not the convenient ones
Why is OWASP important?
OWASP matters to AI security work because its lists are what enterprise programs get measured against. When a security architect evaluates an AI platform, or an auditor asks what coverage exists, the OWASP Top 10 for LLM Applications is the reference they reach for. It is free, community-maintained, and vendor-neutral, which is how it became shared vocabulary rather than any single vendor's threat model.
The v2025 list covers prompt injection, sensitive information disclosure, supply chain, data and model poisoning, improper output handling, excessive agency, system prompt leakage, vector and embedding weaknesses, misinformation, and unbounded consumption. Read as a set, it describes a surface spanning the model, the data feeding it, and the actions it can take.
That is the point worth carrying into vendor conversations. A platform addressing prompt injection and output handling has covered two categories out of ten. Buyers should expect a mapping across all of them, with gaps named rather than omitted.
What is OWASP?
OWASP is a nonprofit foundation producing open-source security standards, tools, and risk frameworks maintained by contributors across the industry. Its outputs are free to use and widely treated as authoritative baselines for application security practice.
Its most referenced output is the OWASP Top 10 – a ranked list of the most critical vulnerabilities in a given domain, revised as attack patterns change. The original list covered web applications. Purpose-built lists now exist for APIs, mobile applications, large language model applications, and agentic applications, each maintained by its own working group.
Beyond the Top 10 series, OWASP publishes testing guides, a software assurance maturity model, and threat-modeling resources. For AI specifically, the GenAI Security Project maintains the LLM and agentic lists alongside guidance on securing model deployments.
OWASP is a community and a body of documents, not a certification. There is no OWASP compliance in a formal sense – an organization aligns to the lists, and vendors map coverage to them.
Types of OWASP Top 10 lists
Several Top 10 lists are in active use, and knowing which applies avoids the common error of evaluating an AI system against a web application checklist.
The Top 10 for LLM Applications is the AI-specific list, and it is the relevant baseline wherever a language model processes input or produces output that something else acts on. The Top 10 for Agentic Applications is the newer list, addressing what emerges when models plan and act autonomously – failure modes about authority and action rather than text.
The original Web Top 10 and the API Security Top 10 remain fully relevant to the applications an AI system is embedded in. An agent reached through a vulnerable API is an API problem before it is an AI problem.
Treat these as layered rather than alternative. An enterprise AI deployment sits inside a web and API surface, so the older lists still govern the infrastructure while the LLM and agentic lists govern model and agent behavior.
OWASP & Onyx
Onyx maps detection and policy coverage to the OWASP Top 10 for LLM Applications categories and reports against that mapping in the platform's compliance views, so the question of which categories are covered has a documented answer rather than an assertion.
That mapping runs across the platform. AI Security addresses the runtime categories, including prompt injection and improper output handling. AI Governance covers the policy-side categories, with excessive agency handled through agent permission scoping and action-level enforcement rather than output filtering alone. Supply chain and model poisoning risks surface through discovery and posture assessment across models, agents, and MCP servers.
