OWASP LLM Top 10: From Web Roots to AI Frontiers
A 22-episode series on LLM application security, written from the infrastructure side: someone who has run red team engagements, written RBAC policies at scale, and debugged IAM privilege escalation — now applying that operational knowledge to a probabilistic application layer.
Who it’s for: Senior DevOps engineers, SREs, and security engineers who know Kubernetes, AWS/GCP/Azure IAM, and classic OWASP, but haven’t worked in LLM security yet.
Format: Foundation episodes (Part I) build the mental model. Vulnerability deep dives (Parts II–III) use Red/Detect/Defend structure — attack anatomy, what your SIEM catches and misses, and the defense-in-depth fix that actually holds.
This series is written thematically, not strictly in episode order — a high-relevance category (Excessive Agency, EP10) shipped ahead of ones still in progress. Each post stands alone; the breadcrumb tells you what it builds on.
Published Episodes
| EP | Title |
|---|---|
| EP01 | OWASP Top 10 History: How the List Evolved from 2003 to 2025 |
| EP10 | LLM Excessive Agency: When Your AI Agent Goes Off-Script |
Scheduled
| EP | Title | Publishes |
|---|---|---|
| EP02 | The Four OWASP Lists: Web App, API, Cloud-Native, and LLM Compared | 2026-07-09 |
| EP03 | Why Classic OWASP Breaks Down for LLMs: The New Attack Surface | 2026-07-13 |
| EP04 | OWASP LLM Top 10 2025: The Complete Map for DevSecOps | 2026-07-16 |
| EP05 | Prompt Injection Attacks: How LLM01 Becomes Full System Compromise | 2026-07-20 |
| EP06 | LLM Sensitive Information Disclosure: When the Model Becomes the Data Leak | 2026-07-23 |
Coming Up
Parts II–III (LLM03 Supply Chain through LLM10 Unbounded Consumption), Part IV (red team tools, runtime defense, compliance frameworks, audits, roles), and Part V (career path into AI security) — 15 more episodes planned.
Start with EP01: OWASP Top 10 History →
Get new episodes in your inbox → linuxcent.com/subscribe