Feedback

We welcome commentary and feedback from the public on our team's work. If you'd like to provide feedback and suggestions about the OWASP Top 10 for Large Language Model Applications there are several ways:

• Join the expert team's Slack Channel and engage in the discussion
  • Join our main channel #project-top10-for-llm for general project discussions on the LLM Top 10
  • Join our #team-llm-discuss channel to sharing relevant links & posts about LLM security (not necessarily Top-10 related)
  • Join the #team-llm-* channels for deeper discussions on individual Top-10 entries
• File an issue on the GitHub site. See the issue tracking section below for further details.
• If you're not comfortable with either option above, you can send an email

Issue Tracking

The LLM Top 10 project uses Github issues for formally tracking errata, updates and suggestions in a transparent way which encourages discussion by the community. Please ensure you tag your issue with one of the following labels when raising an item:

• bug: For factual inaccuracies, broken links, typos, etc
• enhancement: For a change or addition to the Top-10, such as clarifications/re-wordings, additional examples, links to external resources, etc
• extension: For something that extends the Top-10 but is not part of the core project; for example cheat-sheets, guides, intentionally-vulnerable apps, etc.

You can optionally add additional labels if your issue relates to specific Top 10 entries or assets:

• llm-01: Relates to LLM Top-10 entry #1
• llm-02: Relates to LLM Top-10 entry #2
• ...etc...
• llm-10: Relates to LLM Top-10 entry #10
• llm-other: Relates to a topic that is not (yet) covered by the Top-10
• pdf: Indicates an issue specific to the PDF document
• website: Indicates an issue specific to llmtop10.com

As issues are managed by the project team, additional labels may be applied:

• duplicate: Indicates this is a duplicate of an existing issue
• discuss: Indicates that this issue requires a deeper discussion
• wontfix: Indicates a deliberate decision has been made not to fix the issue

Issue Triage

Project contributors performing triage on newly-raised issues should:

• Add/adjust relevant tags/labels (see above).
• Perform a search to see if this is an obvious duplicate; if certain, label as duplicate, link to the original issue, and close the new issue.
• Otherwise, assign the issue to the appropriate lead based on the following:

Topic	Lead	GitHub ID
LLM-01 Prompt Injection	GTK	GTKlondike
LLM-02 Insecure Output Handling	GTK	GTKlondike
LLM-03 Training Data Poisoning	Ads	GangGreenTemperTatum
LLM-04 Model Denial of Service	Ken H	kenhuangus
LLM-05 Supply Chain Vulnerabilities	John S	jsotiro
LLM-06 Sensitive Information Disclosure	Ads	GangGreenTemperTatum
LLM-07 Insecure Plugin Design	John S	jsotiro
LLM-08 Excessive Agency	Andy S	rot169
LLM-09 Overreliance	Steve W	virtualsteve-star
LLM-10 Model Theft	Ads	GangGreenTemperTatum
PDF	Mike F	mkfnch
Website	Mike F	mkfnch