Dear CIO,

Welcome to this edition of Dear CIO, where we delve into the rapidly shifting security landscape of large language models (LLMs). As generative AI systems become cornerstones of enterprise operations and consumer experiences, understanding their vulnerabilities is more urgent than ever. Specifically, this newsletter will focus on the evolution of the OWASP Top 10 for LLMs, comparing the foundational 2023 framework with the recently updated 2024/2025 list. These updates reflect not only the growing complexity of adversarial threats but also the innovative measures needed to address them. Join me as we unpack the critical changes shaping the future of AI security and what they mean for CIOs at the forefront of safeguarding these transformative technologies.

Best Regards,
John, Your Enterprise AI Advisor

The AIE Network is a network of over 250,000 business professionals who are learning and thriving with Generative AI, our network extends beyond the AI CIO to Artificially Intelligence Enterprise for AI and business strategy, AI Tangle, for a twice a week update on AI news, The AI Marketing Advantage, and The AIOS for busy professionals who are looking to learn

Comparative Report: OWASP Top 10 for LLMs - 2023 vs. 2024/2025

What OWASP's Updated Top 10 Risks for LLMs Reveal About the Future of AI Security

The security landscape surrounding large language models (LLMs) has undergone significant transformation over the past year, reflecting the rapid advancements in generative AI (GenAI) technologies. Understanding and mitigating security risks has become increasingly critical as these systems integrate deeply into enterprise workflows and consumer applications. The commercial ecosystem has evolved swiftly since OWASP introduced its Top 10 Risks for Large Language Models in Spring 2023.

OWASP has updated its framework for 2024/2025 to address the fast-changing adversarial landscape, introducing substantial changes that reflect new vulnerabilities and provide a broader, more detailed perspective on existing risks. This evolution underscores the need for proactive security measures to keep pace with the increasing sophistication of attacks targeting GenAI systems.

The recently announced OWASP Top 10 for LLM Applications (2025) highlights the expanding adoption of LLMs and the evolving threats these technologies face. While OWASP's initial 2023 list provided an early, invaluable foundation for identifying emerging risks, it has been enhanced to address the complexity of new attack vectors and better align with the challenges posed by GenAI's integration across diverse industries. This analysis explores the key updates in the 2024/2025 list compared to the original, offering insights into what these changes reveal about the fast-evolving nature of AI security.

Critical Changes Between the 2023 and 2024/2025 Lists

Analysis of Key Updates

1. New Additions and Refinements

• System Prompt Leakage (LLM07): This new category addresses vulnerabilities related to assumptions about isolating system-level prompts. It emerged from real-world breaches in which prompts inadvertently disclosed sensitive operational instructions.

• Vector and Embedding Weaknesses (LLM08): Introduced to guide security in Retrieval-Augmented Generation (RAG) frameworks, a rapidly adopted technique in LLM applications.

• Unbounded Consumption (LLM10): A broader redefinition of denial-of-service vulnerabilities, incorporating unexpected financial costs and resource abuse.

2. Renamed and Expanded Categories

• Improper Output Handling (LLM05): Formerly "Insecure Output Handling," this category now emphasizes comprehensive response validation frameworks to prevent cross-site scripting (XSS), server-side request forgery (SSRF), and other injection attacks.

• Data and Model Poisoning (LLM04): Expanded to include risks from tampered pre-trained models and fine-tuning adapters, reflecting the complexities of modern LLM ecosystems.

3. Elevated Priority

• Sensitive Information Disclosure (LLM02): Moved higher in priority to reflect its recurring prominence in data breach incidents and its expanded coverage of user and proprietary data risks.

Reflections on the Evolving AI Security Landscape

What We've Learned

• Complexity Equals Vulnerability: As LLM systems incorporate multi-modal data and agentic architectures, their attack surface grows exponentially. Security measures must evolve alongside these advancements.

• Community-Led Evolution: The OWASP framework reflects the active feedback loop from global stakeholders, demonstrating the value of collaborative vulnerability reporting and mitigation strategy development.

• Proactive Security: The emphasis on system prompt isolation, embedding vulnerabilities, and LoRA risks highlights the necessity for forward-thinking security in a fast-moving field.

Why the Landscape Is Changing So Quickly

• Rapid Adoption and Experimentation: As LLMs integrate into more applications, unforeseen vulnerabilities naturally emerge, driving the need for fast updates.

• Adversarial Sophistication: Attackers have quickly adapted to exploit AI-specific weaknesses, prompting defensive innovations.

• Scale of Impact: LLMs' widespread and critical use amplifies the consequences of vulnerabilities, necessitating heightened vigilance.

Conclusion

The updates in the OWASP Top 10 for LLMs from 2023 to 2024/2025 underscore the dynamic nature of AI development and the corresponding shifts in security priorities. Developers, businesses, and security professionals must remain agile, adapting quickly to new risks and leveraging the latest guidance to safeguard their systems. The focus on collaboration and proactive mitigation will continue to be pivotal as the AI landscape evolves.

• Reese Rogers writes on how the US Patent and Trademark Office has restricted the use of generative AI due to security and reliability concerns.

• Assaf Morag looks at how Aqua Nautilus researchers uncovered a new attack vector where threat actors exploit misconfigured JupyterLab and Jupyter Notebook servers to hijack environments for illegal sports streaming.

• Steve Wilson covers OWASP GenAI Project updated 2025 Top 10 Risks for Large Language Models (LLMs), which highlights new and expanded threats like unbounded consumption, embeddings security, prompt leakage, and excessive agency.

• Marco Figueroa explores the surprising capabilities of OpenAI's containerized ChatGPT environment, revealing how users can interact with its underlying structure through prompt engineering, file management, and sandboxed scripting.

• A DoD Office of Inspector General report found delays in the Chief Digital and Artificial Intelligence Office's implementation plan and AI policy, and recommended publishing strategic measures to ensure effective AI adoption.

• Claudio Diniz explores the challenges and key considerations for scaling GenAI applications from MVP to production.

• Kyle Wiggers highlights the limitations of quantization in AI models, revealing that excessively low precision can degrade performance, particularly for large models, and suggesting a shift toward meticulous data curation and new architectures to balance efficiency and accuracy.

• Ravie Lakshmanan writes that cybersecurity researchers have uncovered two vulnerabilities in Google's Vertex AI platform that allowed privilege escalation and model exfiltration.

• This screenshot paints a picture of what CIOs are currently up against.