OWASP
OWASP (Open Worldwide Application Security Project) is an international nonprofit open community organization focused on improving software security. Its mission is to provide security tools, documentation, guidelines, and standards free of charge through open collaboration, helping developers, organizations, and security researchers build more secure web applications. OWASP's most widely recognized outputs include the Web Application Security Top 10 risk list, testing guides, and secure development best-practice frameworks, which are broadly adopted across the global security industry and compliance assessment domains.
Core Facts
OWASP has listed prompt injection as the top security risk for large language model applications.
The PTES (Penetration Testing Execution Standard) divides the penetration testing process into phases including intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and report writing.
OWASP已将Prompt注入列为LLM应用十大安全风险之首
Timeline (last 90 days)
agent-ops-check's checks are mapped to 112 items across 10 frameworks, including OWASP Top 10 for LLM Applications 2025, OWASP Agentic 2026, NIST AI RMF, ISO/IEC 42001, MITRE ATLAS, CSA AICM and the EU AI Act.
OWASP's excessive agency guidance proposes three engineering principles: least privilege, approval required for high-impact actions, and authorization for every downstream request.
OWASP classifies prompt injection into two types: direct injection (user input manipulates the model) and indirect injection (the attack payload is hidden in external content read by the model).
OWASP lists prompt injection as the top risk in the LLM Top 10 (LLM01).
Prompt Injection ranks first on the OWASP Top 10 risks for AI applications.
Agent security measures should include prompt injection prevention, least privilege, human-in-the-loop gates for write operations, key isolation, and spending limits, all of which align with OWASP intuitions.
OWASP has listed prompt injection as the top security risk for large language model applications (number one in the LLM Top 10).
OWASP ranks prompt injection as the top risk among the ten major risks for large model applications.
CVSS is maintained by the FIRST organization and provides a severity score of 0–10 for vulnerabilities; OWASP maintains the Top 10 vulnerability classification list.
The Secure by Default principle has since been widely adopted by mainstream security frameworks such as OWASP and NIST.
5 more timeline events
All Facts (20)
OWASP has listed prompt injection as the top security risk for large language model applications.
90%VerifiedThe PTES (Penetration Testing Execution Standard) divides the penetration testing process into phases including intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and report writing.
80%VerifiedOWASP已将Prompt注入列为LLM应用十大安全风险之首
80%VerifiedVulnerabilities such as SQL injection, XSS, and SSRF have long occupied the OWASP Top 10 security risk list.
75%VerifiedThe OWASP Top 10 vulnerability list's 2021 version added Insecure Design as a new category.
70%VerifiedOWASP has listed "insecure AI-generated code" as one of the key risks to focus on in 2025.
65%VerifiedSQL injection can fundamentally isolate data from instructions through parameterized queries, whereas there is currently no equivalent "parameterized" solution for the LLM inference process.
65%VerifiedOWASP lists User Enumeration Attacks as a common security risk.
65%UnverifiedThe OWASP Top 10 threat list specifically targeting LLMs was officially published in 2023.
70%Partially VerifiedOWASP lists prompt injection as the top risk in the LLM Top 10 (LLM01).
65%UnverifiedThe Secure by Default principle has since been widely adopted by mainstream security frameworks such as OWASP and NIST.
60%UnverifiedThe OWASP Top 10 for LLM Applications list was updated in 2025.
60%UnverifiedThere are currently two mainstream format standards for SBOM: SPDX, led by the Linux Foundation, and CycloneDX, promoted by OWASP.
60%UnverifiedClaude Code's /security review command covers vulnerability checks for SQL injection, XSS, key leakage, and privilege escalation.
60%Unverifiedagent-ops-check's checks are mapped to 112 items across 10 frameworks, including OWASP Top 10 for LLM Applications 2025, OWASP Agentic 2026, NIST AI RMF, ISO/IEC 42001, MITRE ATLAS, CSA AICM and the EU AI Act.
50%UnverifiedOWASP's excessive agency guidance proposes three engineering principles: least privilege, approval required for high-impact actions, and authorization for every downstream request.
50%UnverifiedOWASP classifies prompt injection into two types: direct injection (user input manipulates the model) and indirect injection (the attack payload is hidden in external content read by the model).
50%UnverifiedPrompt Injection ranks first on the OWASP Top 10 risks for AI applications.
50%UnverifiedAgent security measures should include prompt injection prevention, least privilege, human-in-the-loop gates for write operations, key isolation, and spending limits, all of which align with OWASP intuitions.
50%UnverifiedOWASP has listed prompt injection as the top security risk for large language model applications (number one in the LLM Top 10).
50%