{
  "dataset": "OWASP LLM Top 10 2026 mapped to infrastructure-operator controls",
  "description": "Each entry of the OWASP Top 10 for LLM Applications 2026 placed on the MAESTRO layer it lands on, with an owner and the control an infrastructure operator can actually enforce. Written from the operator's side of the shared-responsibility line rather than the application developer's.",
  "license": {
    "name": "CC BY 4.0",
    "url": "https://creativecommons.org/licenses/by/4.0/",
    "attribution": "Mr.PlanB — https://www.mrplanb.com/ai-security/operator-controls"
  },
  "sources": [
    {
      "name": "OWASP Top 10 for LLM Applications 2026",
      "url": "https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/",
      "published": "2026-08-03",
      "note": "IDs and titles taken from the project's own source repository at https://github.com/GenAI-Security-Project/GenAI-LLM-Top10"
    },
    {
      "name": "MAESTRO agentic AI threat modeling framework",
      "url": "https://cloudsecurityalliance.org/blog/2025/02/06/agentic-ai-threat-modeling-framework-maestro",
      "published": "2025-02-06",
      "note": "Layer numbering follows the original CSA publication"
    }
  ],
  "owner_key": {
    "operator": "You can enforce this with infrastructure you already run.",
    "shared": "You provide part of it; the tenant or application owner provides the rest.",
    "tenant": "Belongs to whoever builds the application or the model. Listed for context, not claimed."
  },
  "data_last_verified": "2026-09-09",
  "records": [
    {
      "id": "LLM01:2026",
      "title": "Prompt Injection",
      "maestro_layers": [
        1,
        3
      ],
      "owner": "tenant",
      "what_it_is": "Untrusted content reaching the model is treated as instruction rather than data, whether typed by a user or pulled in from a page, a document or a tool result.",
      "operator_control": "None directly. What you can do is bound the damage: run inference where a hijacked prompt reaches nothing valuable, and treat every tool the model can call as an untrusted caller.",
      "why_not_yours": "The model cannot reliably separate instruction from data, and that boundary lives inside the application, not in the infrastructure under it.",
      "verified": true
    },
    {
      "id": "LLM02:2026",
      "title": "Sensitive Information Disclosure",
      "maestro_layers": [
        2
      ],
      "owner": "shared",
      "what_it_is": "Confidential data, personal data or intellectual property leaving through model output, retrieval or memory.",
      "operator_control": "Access control at the storage and retrieval layer, so the index a model can reach holds only what that tenant may see. Separate credentials per tenant for the vector store and the object store.",
      "why_not_yours": "Output filtering and prompt design stay with the application. The retrieval boundary is yours and matters more.",
      "verified": true
    },
    {
      "id": "LLM03:2026",
      "title": "Excessive Agency",
      "maestro_layers": [
        3,
        4
      ],
      "owner": "shared",
      "what_it_is": "A model given more functionality, permission or autonomy than the task needs, so a wrong decision becomes a damaging action.",
      "operator_control": "The permission half is entirely yours: scoped service accounts, read-only credentials by default, network egress allow-lists, and no ambient cloud role attached to the node an agent runs on.",
      "why_not_yours": "Which tools exist and when the agent invokes them is an application decision. What those tools can reach is yours.",
      "verified": true
    },
    {
      "id": "LLM04:2026",
      "title": "Supply Chain",
      "maestro_layers": [
        1,
        2,
        4
      ],
      "owner": "shared",
      "what_it_is": "Compromise arriving through model weights, datasets, adapters, packages or the registry that serves them.",
      "operator_control": "Registry provenance: signed images, checksum verification on model pull, a pinned internal mirror rather than fetching from the public internet at run time, and an allow-list of sources.",
      "why_not_yours": "Choosing a model is the tenant's call. Proving the bytes are the ones they chose is yours.",
      "verified": true
    },
    {
      "id": "LLM05:2026",
      "title": "Data and Model Poisoning",
      "maestro_layers": [
        2
      ],
      "owner": "shared",
      "what_it_is": "Training data, fine-tuning data or a retrieval corpus manipulated so the model behaves as an attacker intends.",
      "operator_control": "Integrity and immutability of the stores: write access restricted to the pipeline identity, versioned buckets, object-lock or snapshot retention so a poisoned corpus can be rolled back and diffed.",
      "why_not_yours": "Curation and evaluation of the data belong to whoever trains the model.",
      "verified": true
    },
    {
      "id": "LLM06:2026",
      "title": "Unbounded Consumption",
      "maestro_layers": [
        4,
        5
      ],
      "owner": "operator",
      "what_it_is": "Resource exhaustion turned into a financial and availability problem — the request that costs far more to serve than to send.",
      "operator_control": "This one is entirely yours. Per-identity rate limits, token and request budgets, input size caps, GPU scheduling quotas, timeouts on inference, and a burn-rate alert that fires before the invoice does. Agentic loops make it worse because one user action can become thousands of calls.",
      "why_not_yours": null,
      "verified": true
    },
    {
      "id": "LLM07:2026",
      "title": "Misinformation",
      "maestro_layers": [
        1,
        3
      ],
      "owner": "tenant",
      "what_it_is": "Confident output that is wrong, and downstream systems or people acting on it.",
      "operator_control": "None. Keep the audit trail that lets someone reconstruct what was produced and acted upon, which is the only infrastructure contribution to this.",
      "why_not_yours": "This is a model and product problem end to end.",
      "verified": true
    },
    {
      "id": "LLM08:2026",
      "title": "Hidden Context Exposure",
      "maestro_layers": [
        3
      ],
      "owner": "tenant",
      "what_it_is": "Everything the user cannot see but the model can — system instructions, tool descriptions, retrieval schemas, policy logic — becoming visible to an attacker.",
      "operator_control": "Make sure secrets are not in that context in the first place: credentials injected from a secret store at call time, never templated into a prompt, and never printed into a log you keep.",
      "why_not_yours": "The contents of the context window are the application's design.",
      "verified": true
    },
    {
      "id": "LLM09:2026",
      "title": "Vector and Embedding Weaknesses",
      "maestro_layers": [
        2
      ],
      "owner": "shared",
      "what_it_is": "Attacks on the retrieval layer itself — embedding inversion, cross-tenant leakage through a shared index, or poisoned entries.",
      "operator_control": "Tenant isolation in the vector store: separate namespaces or separate instances, never one shared index with a filter as the only boundary. Backups of the index, because it is data.",
      "why_not_yours": "Chunking, embedding choice and retrieval logic belong to the application.",
      "verified": true
    },
    {
      "id": "LLM10:2026",
      "title": "Improper Output Handling",
      "maestro_layers": [
        3,
        4
      ],
      "owner": "shared",
      "what_it_is": "Model output passed to another system without validation, so generated text becomes a command, a query or markup somewhere downstream.",
      "operator_control": "Sandbox anything that executes generated code or commands: no host mount, no network egress by default, an ephemeral workspace, and a non-privileged user. Assume the sandbox is what stands between a bad output and your infrastructure.",
      "why_not_yours": "Validating and escaping output is the application's job; containing what happens when it fails is yours.",
      "verified": true
    }
  ],
  "record_count": 10
}