OWASP/wstg
Proposal: Add a New Chapter for Testing LLM Applications
Aberta
#1.447 aberto em 26 de jul. de 2026
help wantednew
Métricas do repositório
- Stars
- (9.439 estrelas)
- Métricas de merge de PR
- (Mesclagem média 24d 19h) (22 fundiu PRs em 30d)
Description
I'd like to propose adding a new chapter to the WSTG, tentatively titled 4.13 Testing LLM Applications.
As Generative AI and Large Language Models (LLMs) are increasingly integrated into web applications, the WSTG currently lacks dedicated guidance for assessing these features from a web application penetration testing perspective.
This chapter would provide practical testing guidance aligned with the OWASP Top 10 for LLM Applications.
Proposed initial structure:
-
4.13.1 Testing for Prompt Injection (Direct and Indirect)
-
4.13.2 Testing for Sensitive Information Disclosure
-
4.13.3 Testing for Insecure Output Handling
-
4.13.4 Testing for Excessive Agency and Tool Abuse
-
Assign me, please!