This is the single navigation index across all three OWASP GenAI source lists. Read left to right: an LLM vulnerability → its agentic amplification → its data security dimension.
How to use: Find the risk you care about in any column, then follow the row to see how it surfaces in the other lists and which framework files cover it.
| LLM Top 10 2026 | Agentic Top 10 2026 | DSGAI 2026 | Primary frameworks |
|---|---|---|---|
| LLM01 Prompt Injection | ASI01 Agent Goal Hijack | DSGAI01 Sensitive Data Leakage | MITRE ATLAS · AIUC-1 B001/B005 · NIST AI RMF · ASVS |
| LLM01 Prompt Injection | ASI02 Tool Misuse | DSGAI12 Unsafe NL Data Gateways | MITRE ATLAS · AIUC-1 B006 · ISA 62443 · STRIDE |
| LLM02 Sensitive Information Disclosure | ASI03 Identity & Privilege Abuse | DSGAI01 Sensitive Data Leakage | ISO 27001 · AIUC-1 A · SOC 2 · PCIDSS |
| LLM02 Sensitive Information Disclosure | ASI03 Identity & Privilege Abuse | DSGAI02 Agent Identity & Credential Exposure | OWASP NHI · AIUC-1 B007 · NIST CSF 2.0 · ISO 27001 |
| LLM03 Excessive Agency | ASI01 Agent Goal Hijack | DSGAI06 Tool Plugin & Agent Data Exchange | AIUC-1 B006 · ISA 62443 · NIST AI RMF |
| LLM03 Excessive Agency | ASI10 Rogue Agents | DSGAI16 Endpoint & Browser Overreach | AIUC-1 C · MITRE ATLAS · STRIDE · EU AI Act |
| LLM04 Supply Chain | ASI04 Agentic Supply Chain | DSGAI04 Data Model & Artifact Poisoning | NIST SP 800-218A · SAMM |
| LLM05 Data and Model Poisoning | ASI06 Memory & Context Poisoning | DSGAI04 Data Model & Artifact Poisoning | MITRE ATLAS · AIUC-1 A · CIS Controls · AITG |
| LLM05 Data and Model Poisoning | ASI06 Memory & Context Poisoning | DSGAI21 Disinformation via Data Poisoning | STRIDE · ENISA · EU AI Act |
| LLM06 Unbounded Consumption | ASI08 Cascading Failures | DSGAI17 Data Availability & Resilience Failures | AIUC-1 D · ISA 62443 · NIST SP 800-82 · CIS Controls |
| LLM07 Misinformation | ASI09 Human-Agent Trust Exploitation | DSGAI21 Disinformation via Data Poisoning | AIUC-1 C/F · EU AI Act · ENISA · NIST AI RMF |
| LLM08 Hidden Context Exposure | ASI01 Agent Goal Hijack | DSGAI15 Over-Broad Context Windows | AIUC-1 B003/B009 · ISO 27001 · CIS Controls · ASVS |
| LLM09 Vector and Embedding Weaknesses | ASI06 Memory & Context Poisoning | DSGAI13 Vector Store Platform Security | MITRE ATLAS · AIUC-1 A · NIST AI RMF · CWE/CVE |
| LLM10 Improper Output Handling | ASI02 Tool Misuse | DSGAI05 Data Integrity & Validation Failures | ASVS · CIS Controls · NIST CSF 2.0 · AIUC-1 B009 |
| — | ASI05 Unexpected Code Execution | DSGAI12 Unsafe NL Data Gateways | AIUC-1 B006 · ASVS · CWE/CVE |
| — | ASI07 Insecure Inter-Agent Comms | DSGAI02 Agent Identity & Credential Exposure | OWASP NHI · AIUC-1 E · ISA 62443 · ISO 27001 |
| — | — | DSGAI03 Shadow AI & Unsanctioned Data Flows | ISO 27001 · ENISA · CIS Controls |
| — | — | DSGAI07 Data Governance & Lifecycle | ISO 42001 · EU AI Act · NIST AI RMF |
| — | — | DSGAI08 Non-Compliance & Regulatory Violations | EU AI Act · ISO 42001 · PCIDSS · SOC 2 |
| — | — | DSGAI09 Multimodal Cross-Channel Leakage | ISO 27001 · AIUC-1 A · CIS Controls · ENISA |
| — | — | DSGAI10 Synthetic Data & Anonymization Pitfalls | NIST AI RMF · EU AI Act · ENISA |
| — | — | DSGAI11 Cross-Context Conversation Bleed | ASVS · ISO 27001 · NIST CSF 2.0 · AIUC-1 A |
| — | — | DSGAI14 Excessive Telemetry & Monitoring Leakage | ISO 27001 · CIS Controls · SOC 2 · NIST CSF 2.0 |
| — | — | DSGAI18 Inference & Data Reconstruction | MITRE ATLAS · ENISA · AIUC-1 A |
| — | — | DSGAI19 Human-in-Loop & Labeler Overexposure | EU AI Act · NIST AI RMF |
| — | — | DSGAI20 Model Exfiltration & IP Replication | MITRE ATLAS · CWE/CVE · ISO 27001 · AIUC-1 B |
A fourth OWASP source list, registered here as AST01–AST10. It covers the
skill layer: the SKILL.md and manifest files telling an agent how to
orchestrate tools, as distinct from MCP, which defines what tools exist.
Attribution. The Agentic Skills Top 10 is a sibling OWASP project with its own leads and contributors. It is credited to that project exactly as the LLM Top 10 and the Agentic Top 10 are, and appears here as an external source list. Canonical spec: https://owasp.org/www-project-agentic-skills-top-10/
Names, severities and MAESTRO layers are transcribed from that page (verified 2026-08-28). Framework mappings are not yet authored — that is expert work, tracked as T-A10-03. These rows are an index, not a mapping.
| ID | Risk | Severity | MAESTRO layers |
|---|---|---|---|
| AST01 | Malicious Skills | Critical | 7, 3, 6, 4, 5 |
| AST02 | Supply Chain Compromise | Critical | 7, 3, 6, 4 |
| AST03 | Over-Privileged Skills | High | 6, 4, 3, 7 |
| AST04 | Insecure Metadata | High | 7, 3, 4, 6 |
| AST05 | Untrusted External Instructions | High | 3, 2, 7, 6 |
| AST06 | Weak Isolation | High | 4, 6, 3 |
| AST07 | Update Drift | Medium | 4, 6, 7 |
| AST08 | Poor Scanning | Medium | 5, 6, 3 |
| AST09 | No Governance | Medium | 6, 7, 5 |
| AST10 | Cross-Platform Reuse | Medium | 7, 3, 6 |
These frameworks are relevant to the risks above and are not part of this crosswalk. They were previously listed in the navigation column, which implied a mapping file that does not exist. They are recorded here instead so the omission is visible rather than silent:
| Framework | Why it is relevant | Status |
|---|---|---|
| MITRE ATT&CK | Enterprise adversary techniques that AI attacks chain into | Not mapped |
| ISO/IEC 27701 | Privacy information management, extending ISO 27001 | Not mapped |
| CycloneDX ML-BOM | Machine-readable model and dataset inventory | Not mapped |
| BSIMM | Software security maturity measurement | Not mapped |
| COBIT | IT governance and management objectives | Not mapped |
Adding any of them is a maintainer decision about scope, not an oversight — see roadmap issue #19.
For OT environments, these entries carry the highest blast radius:
| Risk | Why it matters in OT | Primary OT frameworks |
|---|---|---|
| LLM01 / ASI01 | NL-to-SCADA interfaces make prompt injection a process disruption risk | ISA/IEC 62443 · NIST SP 800-82 |
| LLM06 / ASI08 | Cascading failures in OT can affect physical safety systems | ISA/IEC 62443 SR 7.1 · NIST SP 800-82 |
| ASI02 Tool Misuse | AI agents with OT tool access can trigger physical actions | ISA/IEC 62443 · NIST SP 800-82 |
| DSGAI12 | LLM-to-SQL/historian gateways in OT expose process data | ISA/IEC 62443 · NIST SP 800-82 |
| DSGAI17 | RAG failures in OT AI affect real-time operational decisions | ISA/IEC 62443 SR 7.6 · NIST SP 800-82 |
Jump directly to any framework mapping folder:
LLM Top 10 mappings → /llm-top10/
Agentic Top 10 mappings → /agentic-top10/
DSGAI 2026 mappings → /dsgai-2026/
Shared resources → /shared/
Machine-readable data → /data/
Last updated: 2026-Q1 | Maintained by the OWASP GenAI Data Security Initiative