OWASP Top 10 for LLM Applications

Understanding LLM application vulnerabilities

• Architecture of an LLM-powered application
• How prompts work
• Prompt Injection
• Sensitive information leakage
• Risks related to models and third-party components
• Compromised data or document sources
• Poor handling of AI-generated responses

Demonstrations and practical cases

• Highlighting vulnerabilities through realistic scenarios
• Analysis of Prompt Injection attacks
• Identifying data leakage points
• Experience sharing and discussion of real cases

Securing AI applications and agents

• Securing AI agents
• Least privilege principle
• Protecting vector databases and RAG systems
• Input and output controls
• Access management
• Request and cost limiting

Threat modeling and remediation

• Threat modeling of an AI application
• Building a remediation plan

Skills acquired

• By the end of the training, participants will be able to:
• identify the main vulnerabilities of an LLM application
• detect Prompt Injection risks
• secure a RAG architecture
• limit the privileges of an AI agent
• define appropriate protection measures