OWASP GenAI Security Project: Why AI Security Is Expanding Beyond the LLM Top 10

The OWASP Top 10 for Large Language Model Applications helped organizations understand risks such as prompt injection, insecure output handling and excessive agency. The project has since evolved into the broader OWASP GenAI Security Project, covering LLM applications, agentic systems and AI-driven products. This expansion is a useful signal for technology leaders: securing the model interface alone is not enough.

AI applications are connected systems

A production AI capability may use retrieval databases, APIs, plugins, code execution, cloud services and user identities. Each connection introduces permissions, data flows and failure modes. Security architecture should map the complete system and identify which components can influence a sensitive action.

Excessive agency is an operating risk

An agent with broad permissions can turn a flawed instruction into a business incident. Limits should exist at the identity, tool and transaction levels. The agent should not be able to approve its own high-risk actions. Human authorization, scoped credentials and independent validation reduce the effect of an incorrect or manipulated decision.

Testing must include adversarial behavior

Functional testing confirms that the system works under normal use. AI security testing should also examine prompt injection, indirect instructions, sensitive information disclosure, unsafe output, resource abuse and tool misuse. Tests should be repeated when models, prompts, tools or data sources change.

What leaders can do next

• Map every model, data source, tool and permission in the AI application.
• Separate trusted instructions from untrusted content.
• Validate model outputs before they reach code, queries or business actions.
• Test the system against current OWASP GenAI risk categories.

Closing perspective

AI security is becoming a full application and operational discipline. Organizations should secure the entire system, with special attention to authority, data movement and the actions a model can influence.