OWASP Top 10 for Large Language Model Applications (version 1.1)

OWASP Foundation. (2023). OWASP Top 10 for Large Language Model Applications (version 1.1). OWASP Foundation.

Type

Standard

Intellectual base

Reference work

Year

2023

Link

https://github.com/OWASP/www-project-top-10-for-large-language-model-applications/releases/tag/2023-v1.1 not authoritativefound

Cited by

2 citations across 2 artifacts.

Each citation links to the sentence it supports in the citing article.

Domain-specific

• Data Extraction Through Prompting
  • LLM red-teaming — training-data-extraction benchmarks (Nasr et al., the poem-poem-poem divergence attack) and the OWASP LLM Top-10 "Sensitive Information Disclosure" and "Prompt Injection" categories

    Supported in partVerified against the source

    Read by an automated reader; not a human review. How support was checked

• Prompt Injection
  • The defensive frame the failure establishes is structural channel separation: because in-model instruction/data separation is not reliably achievable with current language models, defence must be imposed at the application layer — through sandboxed execution environments, explicit markup that quarantines retrieved content, minimal-privilege tool grants, and out-of-band human confirmation for irreversible or sensitive actions

    This sourceOWASP's LLM01 entry grounds the defence in the same premise — the model treats operator instructions and external data alike, with no fool-proof in-model prevention — and prescribes the application-layer controls the sentence names: least-privilege backend and tool access, clear delineation of untrusted external content, and human approval for sensitive operations; sandboxed execution is not among LLM01's listed mitigations.

    Supported in partVerified against the source

    Read by an automated reader; not a human review. How support was checked

Verification

Does it exist? Not checked yet. This entry carries no identifier to resolve. It was extracted from the citation as written in the article, normalized, and deduplicated against the rest of the registry.

Does it back the claim? Read against the text for 2 of 2 citations: 2 supported in part. Each verdict is shown under its citation below, with what in the work backs the sentence.

Support is checked per citation rather than per work — the same source can be cited soundly in one article and wrongly in another. Per-citation recording began recently, so a citation with no recorded check is a gap in the record rather than evidence it went unchecked.

See how references were verified.

Registry ID ref:949996df6e0a · see in the full table