OWASP Top 10 for LLMs

The OWASP Top 10 for LLMs is the security community's list of the biggest risks in AI applications. This set reimagines those ten risks as friendly visual cards, a kid-friendly way to start serious conversations about AI security with students, developers, and non-specialists. For awareness and discussion, not a replacement for the official OWASP guidance.

Difficulty: IntermediatePosters: 10Audience: Intermediate

⇩ Download all posters (ZIP)

Advanced visual cards for older learners & grown-ups

Unlike the rest of the library, these are poster cards rather than full lessons, a friendly visual interpretation of the OWASP Top 10 for LLM applications, for awareness and discussion. They're best for older learners and grown-ups, and are not a replacement for the official OWASP guidance.

New here? Start with: What is OWASP? 🎮 Play the Defender Game

#1

Prompt Injection

When sneaky instructions try to trick the robot into breaking its rules.

View poster →

#2

Sensitive Information Disclosure

When the robot accidentally spills a secret it should have kept.

View poster →

#3

Supply Chain Vulnerabilities

Sometimes bad ingredients sneak into the robot's toolbox.

View poster →

#4

Data and Model Poisoning

When the robot learns from bad examples and picks up wrong ideas.

View poster →

#5

Improper Output Handling

When an app trusts the robot's answer without double-checking it.

View poster →

#6

Excessive Agency

When the robot is allowed to do more than it really should.

View poster →

#7

System Prompt Leakage

When the robot's secret instructions slip out for everyone to see.

View poster →

#8

Vector and Embedding Weaknesses

When the robot's memory lookup gets confused or tricked.

View poster →

#9

Misinformation

When the robot says something wrong but sounds very sure.

View poster →

#10

Unbounded Consumption

When the robot uses way too much and slows everything down.

View poster →