Securing AI Apps with the OWASP Top Ten for Large Language Models
summary
OWASP’s Top 10 for LLMs names real exploits and defenses: a volunteer expert group grew from ~200 to ~1,200 contributors, and examples include a Google Bard Google Drive exfil via Markdown image, fabricated legal citations that cost lawyers, an airline held liable for chatbot misinformation, LangChain enabling RCE, and malicious models on Hugging Face. Practical mitigations shown: OWASP Top 10 for LLMs, NeMo Guardrails, AI firewalls/DLP, strict trust boundaries, human‑in‑the‑loop, and testing tools like garak and issues around LangChain.
AI-written summary · about
chapters (11)
- 0:00OWASP Top Ten for LLM security
- 1:26Gen AI security risks matter
- 4:36Secure LLM apps and supply chain
- 9:12Attackers exploit LLM apps
- 18:03Excessive agency risks
- 24:03Insecure output handling
- 26:32Sensitive info disclosure
- 28:58Hallucinations and overreliance
- 34:22OWASP resources update
- 36:29Defending LLM apps
- 39:38Q&A on AI monitoring
related talks
28mSecuring LLMs: Insights into OWASP top 10
01h 01mSecure AI: Integrating OWASP Principles in Machine Learning Model Development
46mOWASP Top 10 for Large Language Models: Project Update
44mI Abuse Your LLM Live with 10 Security Vulnerabilities
44mSecuring LLM-Powered Apps: Overcoming Security and Privacy Challenges
40mFrom Text to Flaws: Application Vulnerabilities with Generative AI and LLMs
51mSecuring LLM-Powered Applications: Overcoming Security and Privacy Challenges
40mFrom Text to Exploits: Vulnerabilities of Apps Using Generative AI and LLMs