OWASP GenAI Security Project
Community security guidance, risk taxonomies and implementation resources. Use the stated edition when comparing framework entries.
AN INDEPENDENT MAP OF AI SECURITY
Find your next
good source.●
Original research, practical guides, and trusted starting points. A smaller, more useful way into AI security.
— sources— selected readings08 topics
A question, a topic, or the source you already know.
Curated links. Original publishers.
EXPLORE THE INDEX
A little direction goes a long way.
The directory could not refresh. Your previous results are still here.
OWASP Top 10 for LLM Applications 2026
The published 2026 edition and its canonical source links. Use the edition label when mapping risks or comparing earlier assessments.
The lethal trifecta for AI agents: private data, untrusted content, and external communication
A concise practitioner framework for recognizing agent data-exfiltration risk. Useful for deciding which capabilities should be separated.
Jumping the line: How MCP servers can attack you before you ever use them
Trail of Bits demonstrates how malicious tool descriptions can influence an agent before invocation. A useful threat-modeling case study.
MCP Security Testing Guide
Tool-vendor recipes for testing MCP integrations, including tool poisoning and data-exfiltration scenarios. Adapt the examples to your deployment.
Prompt injection is not SQL injection (it may be worse)
Explains why conventional injection analogies can mislead defenders, then discusses constraining agent capabilities and managing residual risk.
Promptfoo red teaming documentation
Practical testing recipes and open-source tooling documentation from the tool vendor, useful for constructing repeatable application evaluations.
Mitigating the risk of prompt injections in browser use
Anthropic describes browser-agent defenses and its own evaluations. Useful for understanding layered controls and remaining risks, with vendor-reported results.
Anthropic Research
Model-provider research on agent behavior, evaluations and defenses. Read reported results as vendor experiments with stated conditions.
Not what you’ve signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection
An early original paper demonstrating indirect prompt injection through retrieved content. Read the experimental setup and later revisions before generalizing.
Simon Willison’s Weblog
Independent practitioner explanations and experiments on prompt injection and agent design; distinguish demonstrations from general guarantees.
GenAI and Agentic AI Exploit Roundup Q3 2026
An OWASP-hosted editorial roundup linking reported incidents and research. The page states it is neither exhaustive nor an official OWASP publication.
arXiv Cryptography and Security
Find recent security preprints and original papers. A posting is not peer-review approval; inspect methods, revisions and linked artifacts.
A path we haven't mapped yet.
Try a broader topic or clear a filter.
“Newest” uses the original publication date. Undated guides remain available in curated order.
Directory revised
A USEFUL TOOL IN YOUR AGENT'S TOOLBOX
Let your agent start
with better references.
The same selected sources, with original links and clear dates.