OWASP Top 10
Also called OWASP Top Ten, OWASP Top 10 for LLM Applications, OWASP Top 10 for Agentic Applications, OWASP agentic risks
A widely used list of the 10 most critical security risks for web applications, with sister lists for AI applications and for AI agents.
OWASP is a non-profit project that publishes free security guidance. Its best-known work is the Top 10: the 10 most critical security risks for web applications, agreed by people who build and test them. Its value is the shared vocabulary. A finding with a Top 10 name means the same thing in every team.
AI got lists of its own. One covers applications built on language models, such as a chatbot or a search assistant. A second covers AI agents, where the model can plan, call tools, remember and act.
Use them at 2 moments. Before a review, pick the entries that apply to the thing in front of you. Afterwards, put the list's name on each finding, so it can be compared with other findings and tracked to a fix.
For example
A review says "ASI03, identity and privilege abuse: the agent runs on a developer's token". Another team can look that name up and knows what was found.
Put it to use
Where you'll meet OWASP Top 10 in ChatGPT, Gemini and Claude, how to use it there, and the mix-up most people make.
Daily Bytes Plus is in the Android app.