AIUC-1 × OWASP Top 10 for LLM Applications - AIUC-1

The OWASP Top 10 for LLM Applications is a curated list of the most critical security threats to LLM and generative AI systems.

AIUC-1 integrates OWASP’s Top 10 for LLM and Generative AI. Certification against AIUC-1:

Addresses Top Ten threats in requirements and controls
Strengthens robustness against the threats identified with concrete requirements and controls
Goes beyond OWASP’s focus on security alone

OWASP Top 10 crosswalks by threat

OWASP threat	OWASP description	Relevant AIUC-1 requirements
LLM01:25 - Prompt Injection	This manipulates a large language model (LLM) through crafty inputs, causing unintended actions by the LLM. Direct injections overwrite system prompts, while indirect ones manipulate inputs from external sources.	B001: Third-party testing of adversarial robustness B002: Detect adversarial input B005: Implement real-time input filtering
LLM02:25 - Sensitive Information Disclosure	Sensitive info in LLMs includes PII, financial, health, business, security, and legal data. Proprietary models face risks with unique training methods and source code, critical in closed or foundation models.	B003: Manage public release of technical details B004: Prevent AI endpoint scraping B007: Enforce user access privileges to AI systems A005: Prevent cross-customer data exposure A006: Prevent PII leakage B009: Limit output over-exposure
LLM03:25 - Supply Chain	LLM supply chains face risks in training data, models, and platforms, causing bias, breaches, or failures. Unlike traditional software, ML risks include third-party pre-trained models and data vulnerabilities.	A007: Prevent IP violations A004: Protect IP & trade secrets E006: Conduct vendor due diligence E005: Document data storage security E009: Monitor third-party access
LLM04:25 - Data and Model Poisoning	Data poisoning manipulates pre-training, fine-tuning, or embedding data, causing vulnerabilities, biases, or backdoors. Risks include degraded performance, harmful outputs, toxic content, and compromised downstream systems.	B001: Third-party testing of adversarial robustness B005: Implement real-time input filtering
LLM05:25 - Improper Output Handling	Improper Output Handling involves inadequate validation of LLM outputs before downstream use. Exploits include XSS, CSRF, SSRF, privilege escalation, or remote code execution, which differs from Overreliance.	E009: Monitor third-party access A004: Protect IP & trade secrets A005: Prevent cross-customer data exposure A006: Prevent PII leakage A007: Prevent IP violations D001: Prevent hallucinated outputs C003: Prevent harmful outputs C004: Prevent out-of-scope outputs C005: Prevent agent-specific high risk outputs C006: Prevent output vulnerabilities B001: Third-party testing of adversarial robustness B009: Limit output over-exposure B004: Prevent AI endpoint scraping
LLM06:25 - Excessive Agency	LLM systems gain agency via extensions, tools, or plugins to act on prompts. Agents dynamically choose extensions and make repeated LLM calls, using prior outputs to guide subsequent actions for dynamic task execution.	E009: Monitor third-party access D003: Restrict unsafe tool calls D004: Third-party testing of tool calls B007: Enforce user access privileges to AI systems A003: Limit AI agent data access
LLM07:25 - System Prompt Leakage	System prompt leakage occurs when sensitive info in LLM prompts is unintentionally exposed, enabling attackers to exploit secrets. These prompts guide model behavior but can unintentionally reveal critical data.	B003: Manage public release of technical details B008: Protect AI system deployment environment
LLM08:25 - Vector and Embedding Weaknesses	Vectors and embeddings vulnerabilities in RAG with LLMs allow exploits via weak generation, storage, or retrieval. These can inject harmful content, manipulate outputs, or expose sensitive data, posing significant security risks.	A003: Limit AI agent data access A004: Protect IP & trade secrets A005: Prevent cross-customer data exposure A006: Prevent PII leakage D003: Restrict unsafe tool calls B001: Third-party testing of adversarial robustness B002: Detect adversarial input B004: Prevent AI endpoint scraping B006: Prevent unauthorized AI agent actions B009: Limit output over-exposure
LLM09:25 - Misinformation	LLM misinformation occurs when false and credible outputs mislead users, risking security breaches, reputational harm, and legal liability, making it a critical vulnerability for reliant applications.	C003: Prevent harmful outputs D002: Third-party testing for hallucinations D001: Prevent hallucinated outputs B009: Limit output over-exposure
LLM10:25 - Unbounded Consumption	Unbounded Consumption occurs when LLMs generate outputs from inputs, relying on inference to apply learned patterns and knowledge for relevant responses or predictions, making it a key function of LLMs.	E010: Establish AI acceptable use policy E009: Monitor third-party access B005: Implement real-time input filtering B002: Detect adversarial input B004: Prevent AI endpoint scraping D003: Restrict unsafe tool calls E015: Log AI system activity A003: Limit AI agent data access B006: Prevent unauthorized AI agent actions B007: Enforce user access privileges to AI systems

Last updated July 22, 2025.