AI/ML (OWASP LLM/GenAI Top 10)

An in-app AI assistant demonstrating the OWASP Top 10 for LLM/GenAI, adapted to a mobile client: prompt injection (direct + indirect), insecure output handling, excessive agency, system-prompt leakage, hardcoded API keys, insecure on-device model storage, unverified model supply chain, and unbounded resource consumption.

13 vulnerabilities. OWASP Mobile: M4

VulnerabilityIDPlatformDifficultyOWASPMASVSMASWEMASTG (v2)CWE
Hardcoded LLM API Keyshardcoded_llm_api_keysAndroidiOSEASYM1MASVS-STORAGE-1MASVS-CRYPTO-1MASWE-0004MASTG-TEST-0212MASTG-TEST-0214CWE-798
Direct Prompt Injectionprompt_injection_directAndroidiOSEASYM4MASVS-CODE-4MASWE-0050-CWE-77CWE-20
System Prompt Leakagesystem_prompt_leakageAndroidiOSEASYM4MASVS-STORAGE-2MASWE-0002-CWE-200
Unbounded AI Resource Consumptionunbounded_ai_resource_consumptionAndroidiOSEASYM4MASVS-CODE-4MASWE-0050-CWE-770CWE-400
Excessive Agent Agencyexcessive_agent_agencyAndroidiOSMEDIUMM4MASVS-CODE-4MASWE-0050-CWE-862CWE-306
Hidden Context Exposurehidden_context_exposureAndroidiOSMEDIUMM4MASVS-STORAGE-2MASWE-0002-CWE-200CWE-668
Insecure On-Device Model Storageinsecure_ondevice_model_storageAndroidiOSMEDIUMM9MASVS-STORAGE-1MASVS-RESILIENCE-3MASWE-0001MASTG-TEST-0302MASTG-TEST-0300CWE-312CWE-353
Insecure Output Handlinginsecure_output_handlingAndroidiOSMEDIUMM4MASVS-PLATFORM-2MASVS-CODE-4MASWE-0050-CWE-79CWE-89
On-Device Model Extraction / Theftondevice_model_extractionAndroidiOSMEDIUMM9MASVS-STORAGE-1MASVS-RESILIENCE-3MASWE-0001MASTG-TEST-0302MASTG-TEST-0300CWE-312CWE-200
Indirect Prompt Injection (scanned QR/image/file)prompt_injection_indirectAndroidiOSMEDIUMM4MASVS-CODE-4MASWE-0050-CWE-77CWE-20
Invisible / Unicode Prompt Injectionunicode_invisible_prompt_injectionAndroidiOSMEDIUMM4MASVS-CODE-4MASWE-0050-CWE-77CWE-176
Unverified Model Supply Chainunverified_model_supply_chainAndroidiOSMEDIUMM2MASVS-NETWORK-1MASVS-CODE-3MASWE-0048MASTG-TEST-0233MASTG-TEST-0338CWE-494CWE-345
RAG Vector Store Poisoningrag_vector_store_poisoningAndroidiOSHARDM4MASVS-CODE-4MASVS-STORAGE-1MASWE-0050-CWE-349CWE-345