OWASP LLM Top 10 → NIST 800-53: Your Controls Already Cover This

The OWASP LLM Top 10 functions as a vocabulary translation exercise rather than a novel framework. When practitioners encounter "Prompt Injection," they should recognise it as an input validation failure. "Excessive Agency" translates to a least privilege violation. Organisations should extend existing controls rather than establishing separate AI security programmes.

LLM01: Prompt Injection

Prompt injection inserts attacker-controlled text to override model instructions. Two variants exist: direct (attacker interacts with model) and indirect (attacker embeds malicious instructions in retrievable content). The model cannot distinguish between developer instructions and retrieved text without architectural enforcement.

LLM02: Insecure Output Handling

LLM output is untrusted data by default. When passed downstream without sanitisation—into browser renderers, shell executors, SQL queries, or API calls—it becomes an injection vector. The model itself isn’t vulnerable; the application’s treatment of model output as trusted is.

LLM03: Training Data Poisoning

Training data poisoning introduces malicious, biased, or misleading data into training or fine-tuning datasets. Results include models that behave subtly incorrectly in specific contexts, produce biased outputs, or contain backdoors triggered by specific inputs.

LLM04: Model Denial of Service

Model DoS exploits computational cost of LLM inference. Attackers submit crafted inputs designed to maximise token consumption, context length, or processing complexity. Unlike traditional DoS, costs often fall on API consumers rather than providers.

LLM05: Supply Chain Vulnerabilities

LLM supply chain risk encompasses the full dependency graph: base models, fine-tuning pipelines, training data, inference infrastructure, AI SDKs, plugin ecosystems, and third-party services. This mirrors historical risks like Log4Shell or SolarWinds, with AI stacks having shorter institutional memory.

LLM06: Sensitive Information Disclosure

LLM systems disclose sensitive information through multiple paths: models memorise training data; applications include credentials or PII in prompts; models surface confidential information through retrieval access. Most data classification policies predate "context window" as a meaningful concept.

LLM07: Insecure Plugin Design

Poorly designed integrations—overly permissive, insufficiently validated, inadequately authenticated—become mechanisms where prompt injection and excessive agency become exploitable. The principle parallels OAuth scope creep.

LLM08: Excessive Agency

Excessive agency grants LLM agents more capability, permission, or autonomy than tasks require. An agent reading files, sending emails, modifying records, and calling external APIs without per-action approval becomes a single compromised prompt away from executing all those functions for attackers.

LLM09: Overreliance

Overreliance occurs when users or systems trust LLM outputs without appropriate verification. When AI outputs drive production decisions without human review, the model’s error rate becomes organisational error rate.

LLM10: Model Theft

Model theft encompasses attacks extracting, reproducing, or cloning proprietary AI models—either through stealing weights directly or querying deployed models sufficiently to reconstruct behaviour.

CISO Cheat Sheet