Analysis
AI/LLM Application Security Testing and Red Teaming - OWASP DevSecOps Guideline
Publication date unknown · Discovered owasp.github.io
Page published
Publication date unknown · First observed: 12 Oct 2026
Coverage timeline
Single-source analysis — one report is available.
Why it matters
OWASP's guideline gives defenders a structured checklist and methodology for red-teaming LLM and agentic applications against failures that traditional SAST/DAST/SCA tooling cannot find.
OWASP's DevSecOps Guideline page on AI/LLM Application Security Testing and Red Teaming lays out how to test LLM-based systems — model, prompts, retrieval, tools, and permissions — as an attack surface, mapping test cases to the OWASP Top 10 for LLM Applications (prompt injection, sensitive info disclosure, excessive agency, vector/embedding weaknesses, etc.) and referencing the OWASP GenAI Red Teaming Guide and MITRE ATLAS. It also covers testing agents, tools, and MCP, framing prompt injection in agentic systems as an authorization/blast-radius problem.