Proposal: Add a New Chapter for Testing LLM Applications

I'd like to propose adding a new chapter to the WSTG, tentatively titled 4.13 Testing LLM Applications.

As Generative AI and Large Language Models (LLMs) are increasingly integrated into web applications, the WSTG currently lacks dedicated guidance for assessing these features from a web application penetration testing perspective.

This chapter would provide practical testing guidance aligned with the OWASP Top 10 for LLM Applications.

Proposed initial structure:

• 4.13.1 Testing for Prompt Injection (Direct and Indirect)

• 4.13.2 Testing for Sensitive Information Disclosure

• 4.13.3 Testing for Insecure Output Handling

• 4.13.4 Testing for Excessive Agency and Tool Abuse

• Assign me, please!