Research

The 2026 edition, released 4 Aug 2026: the full 2025→2026 change map, why Excessive Agency climbed to #3, and System Prompt Leakage → Hidden Context Exposure.

Why OWASP renamed System Prompt Leakage to LLM08 Hidden Context Exposure in 2026, why a system prompt is not a security control, how it differs from LLM02, and how to defend it.

When to use the OWASP LLM Top 10 vs the Agentic Top 10 (ASI): the model-as-component vs model-as-actor boundary, the LLM03 handoff, and a side-by-side map of LLM01-10 to ASI01-10.

How the OWASP LLM Top 10 2026 was ranked: a community vote weighted against 7,714 real incidents, the defense effect that keeps Prompt Injection at #1, and the Misinformation gap.

Trust boundary collapse in LLM systems, autonomous threat models, and semantic defense architectures. Trust boundary collapse, agentic exploitation, LLM kill chain, and identity-bound tool execution. epistemic security framework.

Semantic data leakage through external LLM usage, the blindness of legacy DLP systems, intelligence and dependency risks in cyber conflict scenarios; cognitive outsourcing and semantic sovereignty. A framework document from a data sovereignty perspective.

Legacy SOC monitors logs; AI SOC monitors language. LLM telemetry schema, detection pipeline (regex + ML + LLM-as-judge), 8 sample alerting rules, and a 30-minute incident response workflow.

Input/output filtering, policy layers (hard block / soft reject / sanitize), local baselines against Turkish morphological bypasses, and p95 < 50ms latency targets. Field practices from AltaySec Guardian's architecture.

LLM-Sigma rule anatomy, sample rule sets across 6 categories (PI-001 to AG-001), composite alert weights, AI threat hunting strategies, and a 5-level detection maturity model.

10 localized PII types (TCKN MERNİS, IBAN MOD-97, Luhn credit card, license plate, SGK), 5-layer masking pipeline, 6 masking strategies (redaction / tokenization / synthetic / DP), and KVKK + EU AI Act compliance matrix.

Adapting the PICERL cycle for LLM incidents: containment in the 1st hour, forensics in the first 24 hours, and 72-hour KVKK notification threshold. 8 LLM incident types, eradication, and lessons learned.

Why do traditional WAF systems fail to protect LLM integrations? Key criteria for selecting an AI Firewall, including millisecond-level latency, Turkish morphological analysis, and KVKK compliance.

4 risk classes, 7 obligations for high-risk systems (Articles 9-15), GPAI provisions, KVKK double compliance matrix, and the 2024-2027 timeline. A 13-item checklist for enterprises.

Threat model of agentic architectures, four key attack vectors (tool hijack, parameter manipulation, indirect injection, uncontrolled agent), and three-layer defense (allowlisting, validation, observability).

Five layers of RAG architecture, document poisoning, indirect injection, embedding space manipulation, retrieval bypass, and 4-layer monitoring via document lifecycle controls.

Three honeypot categories (low/medium/high interaction), 7 core architecture components, telemetry and intelligence design, decoy strategies, and KVKK/legal boundaries.

Differences from legacy CTI, 5 data source categories, threat sharing formats and schemas, lifecycle management, sharing frameworks, and enterprise integration touchpoints.

The shift to smishing/vishing, delivery SMS fraud, banking alerts, e-Government and KEP spoofing. 4 local blueprints, 3-layer corporate defense, and simulation program designs.

Using LLMs for fluent phishing emails, voice cloning for spoofed CEO calls, deepfake video meetings, and AI-enabled OSINT. Out-of-band verification and multi-signature approval chains.

Managing Shadow AI, individual vs enterprise licensing differences, Acceptable Use Policy (AUP), DLP + AI gateway integration, and employee training. The middle ground between blocking and absolute freedom.

8 frequently asked questions: explicit consent, automated decision-making (Article 11), cross-border transfer (Article 9), Article 6 data, fine-tuning risks, VERBIS registration, and vendor audits.

KVKK framework, National AI Strategy, sectoral guidelines (BDDK, TCMB, SPK, Ministry of Health), the AI Law proposal process, EU AI Act's local impact, and a 10-step enterprise prep checklist.

Why a committee is necessary, 7-member composition, 3 decision-making classes, monthly schedules, 5 core policy documents, and a 3-month setup roadmap.

6 GenAI use cases in banking/fintech, 4 sector-specific threat vectors (credit score manipulation, fraud bypass, assistant leakage, deepfake BEC), BDDK/TCMB frameworks, and 5-layer defense.

KVKK Article 6 special category data, medical device software regulations, clinical diagnostic support models, patient rights, 6 health threat vectors, and 5-layer hospital defenses.

The Presidency's Digital Transformation Office (DDO) framework, public sector AI procurement, citizen rights & appeal mechanisms, algorithmic transparency, and 5 public threat categories.

Marketplace ecosystem threats: recommendation engine manipulation, dynamic pricing abuse, fake review loops, account takeover, assistant bypass, and brand abuse.

Subscriber assistants, network operations, SIM swap fraud, spoofed caller IDs, call center bot manipulation, BTK regulatory framework, and 5-layer enterprise defense.

Production/distribution optimization, load forecasting, SCADA integration, and the melting boundary between IT and OT; EPDK framework, 6 critical infrastructure threat vectors.

Motivations for hosting open weights on-premise, model landscape, licensing, architectural decisions, network isolation, access controls, and operational disciplines.

5 risk categories in open model registries (malicious serialization, hidden backdoors, spoofed repos, training data poisoning, metadata attacks), safetensors approach, and 7-step enterprise audit.

Signing and provenance concepts, Sigstore and in-toto adaptations for AI, 4 levels of the SLSA framework, Model Bill of Materials (Model BOM) approach, and 6-step verification workflow.

Reducing leak rates from 38% to 8% using the same model under different prompt hardening tactics. The 60-line hardened system prompt is published under CC-BY 4.0.

Single-word morphological chaining bypasses legacy guardrail regexes. 10 structural patterns and integration architecture with Zemberek-NLP.

TCKN, IBAN, and medical records in a single session. Prompt injection vectors targeting sensitive data leaks, including 10 sample exploit scripts.

Exploiting the model's RLHF helpfulness reflexes via confirmation framing. 10 sample payloads, 3-layer guardrail defenses, and validation logs.

From KVKK inspector personas to official decrees. Rich bureaucratic language styles serving as powerful injection surfaces. 10 vectors.

Using national symbols, historical quotes, or ethical dilemmas to bypass standard safety alignments. Structural vs content filters.

Securing vector retrieval pipelines and automated document summarizers against silent payload execution. 10 indirect vectors.

Combining languages in a single session to confuse monolingual filters. 10 examples and language-agnostic detection architectures.

Benign queries slowly nudged toward a safety violation over 5 turns. Cumulative resistance decay math and state machine guardrails.

OWASP LLM07 deep dive: file formats, YAML config, metadata leak, and chunked reconstruction. 10 exploit samples and mitigations.

DAN-style persona overrides, historical simulators, and twin-AI setups. 10 variants and structural sandbox rules.

Zero-width spaces, ROT13, hex, morse, braille, and zalgo text bypasses. 10 obfuscation techniques and decoding strategies.

Coercing the model to repeat confidential instructions by framing them as translation tasks. Mirrorglass Tandem study.

Banking assistant scenario, customer OTP secret leakage. Metadata leak using partial format confirmation. Turn-by-turn logs.

Analysis of defensive LLMs breaking when trying to explain why they cannot share a secret. The danger of conversational rejection leaks.

Two agents clashing directly. 8 turns of micro-manipulations, rapport-building, and counterfactual validation.

A hardened 8B parameter model holding off a GPT-4 attacker for 8 rounds. Role consistency and adaptive prompt safeguards.

Aggressive confirmation bypass leaking VIP client booking codes in only two turns. Lessons in validation prompt design.

Claude Opus 4.7 Red exploiting a defender's own compliance procedures to leak secure keys. Agent-only attack vectors.

An early-snapshot resilience table comparing Claude Opus 4.7, Gemini 2.5, Llama 3.3, and hardened Llama 3.1.

Comparing 252 Turkish and 45 English battles. Turkish authority prompts show 23% higher success; English roleplay shows 18% higher.

Analyzing marginal leaks and data exposures judged by our autonomous scoring model. Open-source judge prompt.

Definitions of 40 essential AI security terms including prompt injection, jailbreaking, RAG poisoning, MCP, and regulation frameworks.

Methodology, tagging schema, versioned dataset snapshots, license details, and BibTeX citation formatting.

AI security ecosystem map: AltaySec's positioning, traditional actors, defense industry capacity, and prominent researchers.

Real transcripts from the AltayDuel Arena: authority bomb, validation trap, translation exploit, roleplay override, and system prompt leakage.

100 autonomous agents deployed in a sandbox arena. Empirical proof of speech-action discrepancies in modern Large Language Models.

How to construct an LLM security arena where agents generate their own prompts. Judge architecture, 5 win conditions, and key lessons.

An 8-layer sandbox environment built with a Turkish neighborhood watchman persona. Defense mitigations, KVKK compliance, and battle analytics.

Why is it different from classic cyber security? Threat categories unique to LLMs, attack surfaces, and the importance of this field.

The first item of OWASP LLM Top 10. Direct vs Indirect injection, real attack scenarios, and defense tools.

From LLM01 to LLM10: Prompt Injection, Sensitive Data Leakage, Supply Chain Risks, and more. Illustrated with real-world defense models.

Security risks of RAG architectures: document poisoning, indirect prompt injection, embedding inversion attacks, and hardened RAG design.

AI agents browsing the web, running code, and placing API orders. MCP security flaws, tool poisoning, and Meta's Rule of Two.

7-stage learning path: from fundamentals to advanced tools, CTF platforms, bug bounty targets, and localized career opportunities.

A structured 9+ month learning timeline. Guidance for choosing your specialization as a researcher, pentester, or security engineer.