AI & Cybersecurity

Currently Playing: OWASP LLM Top 10: Sensitive Data & Excessive Agency

This video is the second part of a series covering the OWASP Top 10 for LLMs (2025 Version). While the first part focused on attacking the model itself, this installment explores how a Large Language Model can be turned into a weapon to cause operational, financial, and data-related damage. We break down four critical vulnerabilities where the LLM acts as the attack vector, providing real-world examples—from leaking sensitive corporate payroll data to triggering SQL injections and "denial of wallet" attacks. Key Topics Covered: Sensitive Information Disclosure (LLM02): How models can accidentally reveal training data, system prompts, or private files within a RAG (Retrieval-Augmented Generation) store. Improper Output Handling (LLM05): The risks of using unfiltered LLM outputs, which can lead to XSS (Cross-Site Scripting) or malicious database queries. Excessive Agency (LLM06): The dangers of granting AI agents too much power to write to disks, send emails, or modify production databases without human oversight. Unbounded Consumption (LLM10): How recursive queries and massive computations can lead to a denial of service or exhausted budgets through excessive token usage. Defense & Mitigation: Learn essential security strategies like data isolation, the principle of least privilege, and why LLM output must always be treated as untrusted. Understand the trust boundaries necessary to secure your AI applications and prevent your LLM from becoming a security liability. #LLM #CyberSecurity #OWASP #AI #GenAI #AppSec #InformationSecurity #DataPrivacy #TechSafety