AI Security · Reference
The OWASP LLM Top 10, from the operator's side
Every other version of this table is written for the people building the application. This one is written for the people running the infrastructure underneath it: which MAESTRO layer each risk lands on, who owns it, and what you can enforce with what you already run.
How to read it
Three of the ten risks are not yours, and saying so is the point. A control you cannot enforce is not a control, and a vendor claiming otherwise is selling you something. Where a risk belongs to the tenant, the table says what you can still do to bound the damage, which is usually more useful than a mitigation you have no way to apply.
- 1Yours to enforceInfrastructure you already run can fix thisOperator
- 6Half yoursYou own one side of the boundary, the tenant owns the otherShared
- 3Not yoursListed for context, never claimedTenant
The table
| Risk | Layer | Owner | What it is | What you can do |
|---|---|---|---|---|
| LLM01:2026Prompt Injection | 1, 3 | Tenant | Untrusted content reaching the model is treated as instruction rather than data, whether typed by a user or pulled in from a page, a document or a tool result. | None directly. What you can do is bound the damage: run inference where a hijacked prompt reaches nothing valuable, and treat every tool the model can call as an untrusted caller.The model cannot reliably separate instruction from data, and that boundary lives inside the application, not in the infrastructure under it. |
| LLM02:2026Sensitive Information Disclosure | 2 | Shared | Confidential data, personal data or intellectual property leaving through model output, retrieval or memory. | Access control at the storage and retrieval layer, so the index a model can reach holds only what that tenant may see. Separate credentials per tenant for the vector store and the object store.Output filtering and prompt design stay with the application. The retrieval boundary is yours and matters more. |
| LLM03:2026Excessive Agency | 3, 4 | Shared | A model given more functionality, permission or autonomy than the task needs, so a wrong decision becomes a damaging action. | The permission half is entirely yours: scoped service accounts, read-only credentials by default, network egress allow-lists, and no ambient cloud role attached to the node an agent runs on.Which tools exist and when the agent invokes them is an application decision. What those tools can reach is yours. |
| LLM04:2026Supply Chain | 1, 2, 4 | Shared | Compromise arriving through model weights, datasets, adapters, packages or the registry that serves them. | Registry provenance: signed images, checksum verification on model pull, a pinned internal mirror rather than fetching from the public internet at run time, and an allow-list of sources.Choosing a model is the tenant's call. Proving the bytes are the ones they chose is yours. |
| LLM05:2026Data and Model Poisoning | 2 | Shared | Training data, fine-tuning data or a retrieval corpus manipulated so the model behaves as an attacker intends. | Integrity and immutability of the stores: write access restricted to the pipeline identity, versioned buckets, object-lock or snapshot retention so a poisoned corpus can be rolled back and diffed.Curation and evaluation of the data belong to whoever trains the model. |
| LLM06:2026Unbounded Consumption | 4, 5 | Operator | Resource exhaustion turned into a financial and availability problem — the request that costs far more to serve than to send. | This one is entirely yours. Per-identity rate limits, token and request budgets, input size caps, GPU scheduling quotas, timeouts on inference, and a burn-rate alert that fires before the invoice does. Agentic loops make it worse because one user action can become thousands of calls. |
| LLM07:2026Misinformation | 1, 3 | Tenant | Confident output that is wrong, and downstream systems or people acting on it. | None. Keep the audit trail that lets someone reconstruct what was produced and acted upon, which is the only infrastructure contribution to this.This is a model and product problem end to end. |
| LLM08:2026Hidden Context Exposure | 3 | Tenant | Everything the user cannot see but the model can — system instructions, tool descriptions, retrieval schemas, policy logic — becoming visible to an attacker. | Make sure secrets are not in that context in the first place: credentials injected from a secret store at call time, never templated into a prompt, and never printed into a log you keep.The contents of the context window are the application's design. |
| LLM09:2026Vector and Embedding Weaknesses | 2 | Shared | Attacks on the retrieval layer itself — embedding inversion, cross-tenant leakage through a shared index, or poisoned entries. | Tenant isolation in the vector store: separate namespaces or separate instances, never one shared index with a filter as the only boundary. Backups of the index, because it is data.Chunking, embedding choice and retrieval logic belong to the application. |
| LLM10:2026Improper Output Handling | 3, 4 | Shared | Model output passed to another system without validation, so generated text becomes a command, a query or markup somewhere downstream. | Sandbox anything that executes generated code or commands: no host mount, no network egress by default, an ephemeral workspace, and a non-privileged user. Assume the sandbox is what stands between a bad output and your infrastructure.Validating and escaping output is the application's job; containing what happens when it fails is yours. |
MAESTRO layers: 1 foundation models, 2 data operations, 3 agent frameworks, 4 deployment and infrastructure, 5 evaluation and observability, 6 security and compliance, 7 agent ecosystem. See the section hub for the full stack and who owns each layer.
Take the data
Published under CC BY 4.0, so you can put it in an internal wiki or a control matrix as long as you credit the source. If your GRC team needs to trace a row, the OWASP entry IDs are the join key.
- Operator controls (JSON)Full records with sources and the owner key.
- Operator controls (CSV)One row per risk, for a spreadsheet or a GRC import.
Sources
- OWASP Top 10 for LLM Applications 2026Published 2026-08-03. IDs and titles taken from the project's own source repository at https://github.com/GenAI-Security-Project/GenAI-LLM-Top10
- MAESTRO agentic AI threat modeling frameworkPublished 2025-02-06. Layer numbering follows the original CSA publication
Taxonomy IDs and titles are taken from the OWASP project's own source repository rather than from secondary coverage, and are recorded with their fetch date in the section's source register. The 2026 edition reordered several entries, so an article or table that names an ID without naming the edition is not safe to rely on.