42 / 70 · 07 Security Testing for AI Apps · OWASP Top 10 Meets AI: How AI Features Amplify Traditional Vulnerabilities← prev⊞ allnext →☰ Read as one page
7.2The Amplification Matrix
| Classic OWASP Vulnerability | How AI Features Make It Worse |
|---|---|
| A01: Broken Access Control | LLM may bypass access checks by accessing data directly via tools/plugins. The model sees what the API allows, not what the user should see. |
| A02: Cryptographic Failures | Model APIs transmitting sensitive data may lack encryption. Prompts containing PII sent to external LLM providers over HTTP. |
| A03: Injection | LLM output used in SQL/OS commands creates new injection vectors. Traditional input validation only checks user input, not AI output. |
| A04: Insecure Design | AI features designed without threat model miss novel attack patterns. "Move fast" culture in AI development skips security architecture review. |
| A05: Security Misconfiguration | Model endpoints exposed without authentication. Debug/playground modes left enabled in production. Overly permissive CORS on AI endpoints. |
| A06: Vulnerable Components | ML libraries (PyTorch, TensorFlow, LangChain, Hugging Face) have their own CVEs. ML dependencies are updated less frequently than web dependencies. |
| A07: Authentication Failures | API keys for LLM providers hard-coded in application code, leaked in logs, or committed to git. Shared API keys across environments. |
| A08: Data Integrity Failures | Model weights downloaded without checksum verification. Fine-tuning data from untrusted sources. Model registry without access controls. |
| A09: Logging Failures | Prompts and responses not logged, creating a missing audit trail for AI decisions. PII in prompts logged without redaction. |
| A10: SSRF | LLM with web browsing or URL fetching tools can be tricked into accessing internal URLs via prompt injection. |