← Security

Frameworks

No single framework is the whole field. Use them as shared vocabulary and as coverage checklists for threat models and red-team plans.

OWASP Top 10 for LLM Applications

Organization
OWASP GenAI Security Project
Version / date
2026 edition (announced 1 to 2 September 2026); 2025 edition still listed on the project page
Verified
Verified on 2026-10-17
Scope
The ten most critical risks for applications that use LLMs as components.
In LatentLens
Prompt injection, direct and indirect, Sensitive information disclosure and privacy attacks, Agentic AI security (OWASP Agentic Top 10), AI supply chain, Data poisoning, model poisoning and backdoors, Unbounded consumption and denial of wallet, RAG security: poisoned, leaked and cross-tenant retrieval, Improper output handling

The 2025 list was read from OWASP's own page. The 2026 order below comes from OWASP's announcement plus the Cloud Security Alliance research note, because the 2026 list page was not retrievable at check time.

Official source

OWASP Top 10 for Agentic Applications

Organization
OWASP GenAI Security Project
Version / date
2026 edition, published 9 December 2025
Verified
Verified on 2026-10-17
Scope
Risks specific to autonomous and tool-using agents (ASI01 to ASI10).
In LatentLens
Agentic AI security (OWASP Agentic Top 10), Memory and context poisoning, MCP security, AI supply chain, Improper output handling

Release date read from OWASP's page; entry names consistent across several independent guides. One source mentions a later 2.01 revision; unconfirmed.

Official source

NIST AI 100-2e2025: Adversarial Machine Learning taxonomy

Organization
NIST
Version / date
March 2025 (no newer edition found)
Verified
Verified on 2026-10-17
Scope
Taxonomy and terminology of attacks and mitigations for predictive and generative AI: evasion, poisoning, privacy attacks, supply chain, direct prompting, indirect prompt injection, agent security. Attacker objectives: availability breakdown, integrity violation, privacy compromise, misuse enablement.
In LatentLens
Prompt injection, direct and indirect, Jailbreaks, adversarial inputs and guardrails, Data poisoning, model poisoning and backdoors, Sensitive information disclosure and privacy attacks, Model extraction and model theft, AI supply chain
Official source

Model Context Protocol specification

Organization
MCP project
Version / date
2026-07-28
Verified
Verified on 2026-10-17
Scope
Hosts, clients, servers; resources, prompts, tools; security principles (consent, privacy, tool safety) that implementers must enforce.
In LatentLens
MCP: the Model Context Protocol, MCP security
Official source

OWASP LLM Top 10, 2025 edition

  1. LLM01 Prompt Injection
  2. LLM02 Sensitive Information Disclosure
  3. LLM03 Supply Chain
  4. LLM04 Data and Model Poisoning
  5. LLM05 Improper Output Handling
  6. LLM06 Excessive Agency
  7. LLM07 System Prompt Leakage
  8. LLM08 Vector and Embedding Weaknesses
  9. LLM09 Misinformation
  10. LLM10 Unbounded Consumption

OWASP LLM Top 10, 2026 edition

  1. LLM01 Prompt Injection
  2. LLM02 Sensitive Information Disclosure
  3. LLM03 Excessive Agency
  4. LLM04 Supply Chain
  5. LLM05 Data and Model Poisoning
  6. LLM06 Unbounded Consumption
  7. LLM07 Misinformation
  8. LLM08 Hidden Context Exposure
  9. LLM09 Vector and Embedding Weaknesses
  10. LLM10 Improper Output Handling

OWASP Agentic Top 10, 2026 edition

  1. ASI01 Agent Goal Hijack
  2. ASI02 Tool Misuse and Exploitation
  3. ASI03 Identity and Privilege Abuse
  4. ASI04 Agentic Supply Chain Vulnerabilities
  5. ASI05 Unexpected Code Execution
  6. ASI06 Memory & Context Poisoning
  7. ASI07 Insecure Inter-Agent Communication
  8. ASI08 Cascading Failures
  9. ASI09 Human-Agent Trust Exploitation
  10. ASI10 Rogue Agents

Names and editions verified on 2026-10-17 against the organizations' pages where reachable (see each card's note). Frameworks evolve: check the official source before relying on an edition. Lists are names only; read the official documents for definitions.