Reference
OWASP LLM Top 10 Coverage
Every vulnerability from the OWASP Top 10 for LLMs 2025 is covered with dedicated payloads, severity levels, and judge criteria. Filter with --categories LLM01,LLM07.
LLM01
Prompt Injection
Instructions embedded in user input that override or subvert the system prompt.
11 payloads - default on
CWE-77, CWE-94
LLM02
Sensitive Information Disclosure
Leakage of PII, credentials, or confidential data through model responses.
9 payloads - default on
CWE-200
LLM03
Supply Chain
Risks from third-party models, datasets, plugins, or fine-tuning sources.
6 payloads - default on
CWE-1104, CWE-829
LLM04
Data & Model Poisoning
Compromised training data affecting model behaviour and output integrity.
6 payloads - default on
CWE-20, CWE-1039
LLM05
Improper Output Handling
Downstream injection attacks (XSS, SQLi) via unsanitised model output.
6 payloads - default on
CWE-79, CWE-116
LLM06
Excessive Agency
Model taking high-impact autonomous actions without explicit authorisation.
8 payloads - default on
CWE-269, CWE-863
LLM07
System Prompt Leakage
Extraction of confidential system-level instructions from the model context.
5 payloads - default on
CWE-200, CWE-522
LLM08
Vector & Embedding Weaknesses
Manipulation or poisoning of vector stores and RAG pipeline data.
5 payloads - default on
CWE-668
LLM09
Misinformation
Model generating false, misleading, or harmful content as factual output.
5 payloads - default on
CWE-345
LLM10
Unbounded Consumption
Resource exhaustion via oversized or recursive requests. Opt-in to protect targets.
6 payloads -
--include-dos-testsCWE-400, CWE-770