Five OWASP AI Lists, One Practitioner Problem

Thu, 02 Apr 2026 15:30:00 +0700

I was in a meeting recently where someone asked a simple question: “Which OWASP list should we use for our AI security review?”

Nobody could answer it. Not because the people in the room were incompetent. The opposite, actually — they’d all read the lists, which is precisely why they couldn’t answer. There are five of them now. Five OWASP AI security lists. Each one a Top 10, except the one that’s a 200-page guide. They overlap, contradict, and occasionally talk past each other. When someone finally pulled up Matt Adams’ OWASP AI Top 10 Comparator — a tool that exists specifically because the proliferation problem is bad enough to need its own website — the room collectively sighed.

Llm-Security on Napat's Inverse Blog

Five OWASP AI Lists, One Practitioner Problem