Securing LLMs: Insights into OWASP top 10
summary
Claims include concrete exploits and tests: prompt injection works on chatbots (example: a customer bot revealing a previous user name), a PyTorch library vulnerability caused a real vendor breach, 250 malicious documents can poison a 13B model, and agents hooked to web APIs (ChaosGPT style) can act on malicious goals. Attack surface notes: vector database poisoning, overloads, dependency tampering. Practical response is hands‑on: checklisting against OWASP top 10, exploratory hours with developers, architects and testers, and programmatic output filtering.
AI-written summary · about
chapters (21)
- 0:00LLM security risks
- 1:29OWASP top 10 for LLMs
- 2:52Attack vectors on AI systems
- 4:01Prompt injection threat
- 5:27Third-party component risks
- 6:31Data poisoning risks
- 7:56AI agent autonomy concerns
- 10:08Vector database risks
- 11:14System overload risks
- 12:20Consequences of AI compromise
- 13:51Securing AI with critical thinking
- 15:21AI magic and proactive security
- 16:34Call to action for AI security
- 18:23Q&A
- 18:43Preventing input leakage
- 20:09Alternatives to OWASP
- 21:36Detecting poisoned images
- 22:18Exploratory testing for LLMs
- 23:44Product vs tool security
- 25:15Risks for non-technical users
- 27:05Closing remarks
related talks
59mSecuring the Digital Landscape: A Deep Dive into OWASP Top 10 for Applications, APIs, and LLMs
20mSecurity Threats in Modern LLM Applications
50mSecuring LLM-Powered Applications: Overcoming Security and Privacy Challenges
49mSecuring AI Apps with the OWASP Top Ten for Large Language Models
44mI Abuse Your LLM Live with 10 Security Vulnerabilities
01h 14mBreaking the Bot: GenAI Web App Attack Surface & Exploitation
20mUnderstanding and Mitigating Risks in LLM-Powered Web Apps
25mPreventing an OWASP Top 10 in the world of AI