OWASP Top 10 for Large Language Models: Project Update

### Overview Steve Wilson (project lead and Exabeam employee) and Scott Clinton (co-lead) present a project update on the OWASP Top 10 for Large Language Models. Founded just over a year prior from a LinkedIn post that rapidly drew hundreds of participants, the initiative has grown into a widely adopted, foundational community standard. The speakers review the project's traction, discuss major threat trends such as indirect prompt injection and supply chain risks, detail related sub-projects and initiatives, and preview the forthcoming Version 2.0 (targeted for late 2024).

### Key Topics - **Project Adoption & Industry Impact**: The OWASP LLM Top 10 has achieved significant reach, with thousands of community members, over 100,000 estimated readers, and roughly 58% share of voice in articles discussing LLM security. It is actively referenced across commercial security tools, and the project team collaborates with standards groups including NIST (joining the NIST AI Safety group) and MITRE (influencing MITRE ATLAS). - **Evolution of AI Risks**: AI adoption has rapidly expanded from basic chatbots to co-pilots and autonomous AI agents. Major tech organizations have experienced vulnerabilities, particularly indirect prompt injection. Software supply chain security in AI is an escalating concern, exemplified by thousands of poisoned models on hubs like Hugging Face. Multi-modal models and deepfakes also present overlapping security challenges. - **Initiatives Beyond the Top 10 List**: The project has expanded beyond the initial list into specialized initiatives, including: - A CISO Checklist (initiated by Sandy Dunn). - An LLM Security Solutions Guide establishing an LLM Ops / SEC Ops framework to categorize commercial and open-source tooling (e.g., AI guardrails, WAF/RASP analogs). - First-party research led by Rachel James in collaboration with the University of Illinois. - An AI Security Center of Excellence initiative. - A recently launched red teaming initiative focused on AI systems. - A data verification and controls mapping initiative mapping the Top 10 to industry standards and CVEs. - **Version 2.0 Roadmap**: Expected around November 2024 (as the 2024 release), V2 incorporates voting from the expert community. Early ranking signals show supply chain issues moving up right behind prompt injection, with excessive agency also rising due to the industry surge in autonomous AI agents.

### Technical Details - **Indirect Prompt Injection**: The speakers emphasize indirect prompt injection as particularly insidious when systems parse untrusted external data without sufficient boundaries. - **AI Tooling Analogs**: Existing application security paradigms (SAST, DAST, WAF, RASP) are mapping into new AI-specific tooling, such as AI guardrails functioning similarly to next-generation WAFs or in-app RASP defenses. - **Secure AI Development**: The discussion touches upon responsible AI software engineering processes, AI secure development lifecycles (incorporating frameworks from Steve Wilson's book), and deepfake threats in enterprise settings, including live deepfakes detected during technical job interviews.

### Takeaways Application security professionals hold the foundational skills needed for AI red teaming and defense, but security teams are currently playing catchup with rapid AI deployment. Security practitioners and organizations are encouraged to engage with the OWASP LLM community via their website (genai.owasp.org), bi-weekly open meetings, dedicated Slack channels, and a newly launched corporate sponsorship program.