OWASP Top 10 for Large Language Model Applications (version 1.1)

OWASP Foundation. (2023). OWASP Top 10 for Large Language Model Applications (version 1.1).

Type

Standard

Intellectual base

Reference work

Year

2023

Link

no authoritative link yet

Cited by

2 citations across 2 artifacts.

Each citation links to the sentence it supports in the citing article.

Domain-specific

• Data Extraction Through Prompting
  • LLM red-teaming — training-data-extraction benchmarks (Nasr et al., the poem-poem-poem divergence attack) and the OWASP LLM Top-10 "Sensitive Information Disclosure" and "Prompt Injection" categories
• Prompt Injection
  • The defensive frame the failure establishes is structural channel separation: because in-model instruction/data separation is not reliably achievable with current language models, defence must be imposed at the application layer — through sandboxed execution environments, explicit markup that quarantines retrieved content, minimal-privilege tool grants, and out-of-band human confirmation for irreversible or sensitive actions

    This sourceOWASP's LLM01 entry grounds the defence in the same premise — the model treats operator instructions and external data alike, with no fool-proof in-model prevention — and prescribes the application-layer controls the sentence names: least-privilege backend and tool access, clear delineation of untrusted external content, and human approval for sensitive operations; sandboxed execution is not among LLM01's listed mitigations.

Verification

This reference passed the adversarial substantiation pipeline: it was checked to exist and to support the claim it is attached to. See how references were verified.

Registry ID ref:949996df6e0a · see in the full table