BestHub
Sign in
Tagged articles

OWASP

18 articles · Page 1 of 1
Data Bricklaying Diary
Data Bricklaying Diary
Oct 23, 2026 · Information Security

Why External Content Must Not Override Agent Permissions: Defending Against Indirect Prompt Injection

This article analyzes how AI agents can be manipulated via indirect prompt injection hidden in external materials, and proposes a layered defense: distinguish source from authority, validate every execution step, bind confirmations to specific actions, and test with adversarial scenarios to ensure boundaries hold without breaking legitimate tasks.

AI securityOWASPadversarial testing
0 likes · 10 min read
Why External Content Must Not Override Agent Permissions: Defending Against Indirect Prompt Injection
Frontline Investigation
Frontline Investigation
Oct 2, 2026 · Industry Insights

Why Citations Don't Make Knowledge Base Answers Trustworthy

The article explains that knowledge base assistants often provide citations that don't actually support their conclusions, creating a trust gap; it argues for verifying citations rather than just displaying them, highlighting three critical distances and suggesting systems should admit uncertainty more often.

Knowledge BaseNISTOWASP
0 likes · 8 min read
Why Citations Don't Make Knowledge Base Answers Trustworthy
Frontline Investigation
Frontline Investigation
Sep 28, 2026 · Artificial Intelligence

AI Memory Carryover Risks: Why Task Switching Triggers Errors

This article analyzes how AI assistants' long-term memory can misapply past preferences to new tasks, distinguishing stable preferences, task constraints, and factual judgments, and argues for memory systems that explain their sources and applicability, referencing NIST, OWASP, and China's data protection law.

AI assistantsMemory ManagementNIST AI RMF
0 likes · 9 min read
AI Memory Carryover Risks: Why Task Switching Triggers Errors
Frontline Investigation
Frontline Investigation
Sep 21, 2026 · Artificial Intelligence

AI Summaries Are Getting Better—But Which Exceptions Are Silently Dropped?

The article explores how AI-generated summaries tend to flatten uncertainties, conflicting judgments, unconventional actions, and evolving contexts—four types of exceptions that signal unresolved issues. It argues for preserving 'undecided positions' in summaries to maintain traceability, enable judgment relay, and prevent overconfidence in smoothed-over conclusions, citing NIST and OWASP risk frameworks.

AI summarizationAI trustworthinessException Handling
0 likes · 10 min read
AI Summaries Are Getting Better—But Which Exceptions Are Silently Dropped?
Frontline Investigation
Frontline Investigation
Sep 19, 2026 · Artificial Intelligence

When AI Agents Propose Next Steps, Who Really Decides?

The article examines how AI agents are shifting from answering questions to proposing workflow actions, blurring the line between suggestion and execution, and argues that organizations must preserve clear decision boundaries, provide adequate confirmation materials, and maintain traceable handoffs to ensure human accountability and sustainable collaboration.

AI agentsAgentic workflowsNIST AI RMF
0 likes · 8 min read
When AI Agents Propose Next Steps, Who Really Decides?
Frontline Investigation
Frontline Investigation
Aug 12, 2026 · Artificial Intelligence

AI Agents in Production: The Real Challenge Is Identity, Not Capability

The article argues that integrating AI agents into business systems shifts the core challenge from capability to accountability, proposing a four-layer identity framework (initiator, decision-maker, executor, affected) and a four-question checklist to govern agent actions, referencing OWASP and NIST frameworks.

AI agentsAccountabilityNIST AI RMF
0 likes · 13 min read
AI Agents in Production: The Real Challenge Is Identity, Not Capability
Black & White Path
Black & White Path
Jul 18, 2026 · Information Security

LLMVault: Offline AI Security Lab Covering OWASP LLM Top 10 with 25 Exercises

LLMVault, an open‑source offline sandbox released by GitHub user CyberSunil, offers 25 tiered labs that simulate all ten OWASP LLM Top 10 vulnerabilities, enabling security professionals and learners to practice prompt injection, data poisoning, model extraction, and other AI attacks without needing external API keys.

AI securityCTFDocker
0 likes · 8 min read
LLMVault: Offline AI Security Lab Covering OWASP LLM Top 10 with 25 Exercises
AI Step-by-Step
AI Step-by-Step
Apr 11, 2026 · Information Security

Beyond Prompt Guardrails: Full‑Stack Security Governance for AI Agents

The article explains how production‑grade AI agents require a full‑stack security framework—covering input sanitization, runtime policy enforcement, output verification, and audit—to mitigate ten OWASP attack surfaces such as prompt injection, tool misuse, memory poisoning, and cascading failures, with practical defense layers and red‑team testing guidance.

AI agentsLeast AgencyOWASP
0 likes · 14 min read
Beyond Prompt Guardrails: Full‑Stack Security Governance for AI Agents
Black & White Path
Black & White Path
Mar 30, 2026 · Information Security

OWASP Top 10 Risks for LLMs Every AI Security Beginner Must Know

The article outlines the OWASP Top 10 threats for large language model applications—including prompt injection, data leakage, supply‑chain attacks, model poisoning, improper output handling, excessive agency, system prompt leakage, vector embedding weaknesses, misinformation, and unbounded consumption—plus three essential mitigation rules for newcomers.

AI securityLLMOWASP
0 likes · 6 min read
OWASP Top 10 Risks for LLMs Every AI Security Beginner Must Know
Woodpecker Software Testing
Woodpecker Software Testing
Jan 21, 2026 · Information Security

The OWASP LLM Top 10: Key Security Risks and Mitigation Strategies

The OWASP LLM Top 10 outlines the most critical security and risk vulnerabilities in large language model applications, describing each threat—from prompt injection to model theft—its potential impact, and recommended defense principles such as secure development lifecycles, defense‑in‑depth, least‑privilege, human‑in‑the‑loop, and continuous monitoring.

AI safetyLLM securityOWASP
0 likes · 8 min read
The OWASP LLM Top 10: Key Security Risks and Mitigation Strategies
FunTester
FunTester
Jun 26, 2024 · Information Security

Mastering Web Application Penetration Testing: Methods, Types, and Best Practices

Web application penetration testing is a systematic security assessment that identifies vulnerabilities such as SQL injection, XSS, CSRF, insecure authentication, and file‑upload flaws, using methods ranging from black‑box to manual testing, and follows best practices like OWASP guidelines to protect data, privacy, and system integrity.

OWASPWeb Securityinformation security
0 likes · 11 min read
Mastering Web Application Penetration Testing: Methods, Types, and Best Practices
DevOps
DevOps
Jun 27, 2023 · Information Security

From DevOps to DevSecOps: Understanding Threats, Security Practices, and Using Microsoft Threat Modeling Tool

This article explains how DevSecOps extends DevOps by embedding security throughout the software lifecycle, discusses common threats such as SQL injection and broken access control, outlines the Security Development Lifecycle, and provides a step‑by‑step guide to using Microsoft Threat Modeling Tool for proactive risk mitigation.

DevSecOpsMicrosoftOWASP
0 likes · 20 min read
From DevOps to DevSecOps: Understanding Threats, Security Practices, and Using Microsoft Threat Modeling Tool
HomeTech
HomeTech
Dec 28, 2021 · Information Security

SQL Injection Vulnerability Analysis and Defense Strategies

This article provides a comprehensive analysis of SQL injection vulnerabilities, covering their principles, testing tools, repair methods, and defense strategies, with practical implementation guidance for secure web application development.

Database SecurityOWASPParameterized Queries
0 likes · 15 min read
SQL Injection Vulnerability Analysis and Defense Strategies
JavaScript
JavaScript
Oct 31, 2017 · Information Security

Understanding OWASP Top 10: Key Web Security Risks and Mitigation Strategies

The OWASP Top 10 project ranks the ten most critical web application security risks by analyzing threats, vulnerabilities, technical impact, and business consequences, offering developers, testers, and security teams actionable guidance to improve risk awareness and implement focused protection measures.

Application SecurityOWASPTop 10
0 likes · 2 min read
Understanding OWASP Top 10: Key Web Security Risks and Mitigation Strategies
Architects Research Society
Architects Research Society
Nov 24, 2015 · Information Security

Understanding Common Web Application Attacks and the OWASP Top 10

The article explains how modern web and cloud‑based applications are increasingly exposed to a range of application‑layer attacks—including injection, XSS, broken authentication, and insecure redirects—while highlighting OWASP’s Top 10 list, the importance of secure development practices, and IBM’s educational webinar series.

OWASPVulnerabilitiesWeb Security
0 likes · 10 min read
Understanding Common Web Application Attacks and the OWASP Top 10