OWASP LLM and ML Top 10 (2025) Mapping to AI Threat and Governance COASP Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company is deploying an LLM-powered code-generation tool for its developers. The tool suggests code snippets based on public repositories. The security team is concerned about the tool inadvertently suggesting code with known vulnerabilities. Which OWASP LLM Top 10 risk is most directly applicable, and what is a suitable governance control?

   • AExcessive Agency — disable the tool's ability to automatically commit code.
   • BSupply Chain Vulnerabilities — implement a software composition analysis (SCA) tool to scan generated code for vulnerable dependencies.
   • CSensitive Information Disclosure — restrict the model's access to internal code repositories.
   • DPrompt Injection — add a system prompt that tells the model to avoid insecure code.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A security team is assessing a machine learning model that predicts loan approvals. The model is hosted behind an API and the team has black-box access. They want to determine if the model is vulnerable to model inversion attacks. Which approach is most effective given the black-box constraint?

   • APerform a membership inference attack instead, which is the same as model inversion.
   • BUse the API to query the model with synthetic inputs and observe confidence scores to infer training data patterns.
   • CRequest the model's training data from the data science team.
   • DInspect the model's gradients by submitting specially crafted requests.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   An offensive AI team is planning a red-team exercise for a system that uses an LLM to moderate user-generated content and a separate ML model to detect spam. The team has a budget for only one type of attack simulation. Which attack would provide the most comprehensive coverage of OWASP LLM and ML Top 10 risks?

   • APrompt injection attacks against the LLM to bypass content moderation.
   • BData poisoning of the training data for both models.
   • CA combined attack that uses prompt injection to make the LLM produce content that evades the spam detector.
   • DAdversarial examples against the spam detector to test its robustness.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A company is deploying an LLM-powered virtual assistant that can access internal APIs to book meetings and send emails. The security team is concerned about the assistant performing unauthorized actions. Which OWASP LLM Top 10 risk is most directly relevant, and what governance control should be implemented?

   • AExcessive Agency; implement strict permission scopes and human approval for high-impact actions
   • BPrompt Injection; add a filter to block malicious prompts
   • CInsecure Output Handling; encode all API responses
   • DSupply Chain Vulnerability; audit all third-party libraries
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A company's LLM-based virtual assistant can access a customer database to answer queries. The assistant is integrated with a CRM system and can update customer records. A security researcher discovers that the assistant can be tricked into deleting customer records by crafting a prompt that says 'delete all records for user X'. Which OWASP LLM Top 10 risk is this, and what is the best control?

   • ASensitive Information Disclosure — restrict the assistant's access to customer data.
   • BInsecure Output Handling — sanitize the assistant's responses to remove any delete commands.
   • CPrompt Injection — add a system prompt that tells the assistant to never delete records.
   • DExcessive Agency — implement strict permission controls and require human approval for destructive actions.
   Reveal Solution Discussion Select an answer first