[Track A] Feedback: Weaponized LLM Abuse

[rocklambros]

Sprint 2 Feedback — Weaponized LLM Abuse

This issue collects qualitative feedback on the Weaponized LLM Abuse new candidate entry. Submit your Importance, Clarity, and Distinctness scores via the Sprint 2 Google Form (single ballot covering both tracks).

• Vote: https://docs.google.com/forms/d/e/1FAIpQLSebmFQyJPOMuw1IorHCJ2FdW98ZT2oLNBuVgYqpPoayW9v6ww/viewform — page through to the Track A section, then to Weaponized LLM Abuse
• Read the draft: https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/new_entry_candidates/weaponized-llm-abuse.md
• Voting closes: May 18, 2026 at 23:59 UTC
• Code of Conduct: https://owasp.org/www-policy/operational/code-of-conduct

Scoring rubric

• Importance (1–5): How critical is this risk to LLM application security in 2026?
• Clarity (1–5): How clearly does the candidate describe the risk and mitigations?
• Distinctness (1–5): Is this materially different from existing entries (LLM01–LLM10), or could it be merged into one of them?

Why Distinctness matters

Sprint 3 cuts 8 candidates down to 5. A high-Importance candidate that overlaps heavily with an existing entry is a merge target, not a standalone winner. Distinctness scores let the working group make defensible cut, keep, or merge calls.

How to comment

Reply to this issue with feedback specific to Weaponized LLM Abuse. Use one comment per topic so the working group can triage cleanly. Format we like:

Section: <which section of the candidate>
Issue: <what is wrong, missing, unclear, or duplicative>
Proposed change: <your suggested fix, addition, or merge target>
Overlaps with: <existing entry LLM01–LLM10 if applicable>
Evidence: <CVE, paper, incident, or research note ID if applicable>

Out of scope here

• Cross-cutting comments → use Discussions
• Comments on existing entries (LLM01–LLM10) → comment on the relevant Track B issue
• Process or governance questions → comment in Discussions

Triage

Working group entry leads classify each comment within 48 hours as:

• actionable — feeds Sprint 3 revision or merge decision
• clarification — requires reply, not action
• out-of-scope — closed with redirect

Sprint 3 begins May 18 with this issue's triage as input.

[nagasatish007]

Section: Scope and Distinctness

Issue: This entry sits at the boundary of what the Top 10 for LLM Applications
should cover. The risk is real and growing, but it describes how attackers use
LLMs offensively against third-party targets — not a vulnerability in LLM
applications themselves. The mitigations are primarily provider-side (output abuse
classifiers, semantic rate limiting, credential lifecycle management) rather than
application-developer-actionable.

Proposed change: Consider reframing as a sub-section of LLM10 (Unbounded
Consumption) — specifically the "LLMjacking" and "functional model replication"
aspects already covered there. The credential-theft-as-attack-infrastructure
pattern is a consumption/abuse problem. Alternatively, scope this entry to focus
specifically on what application developers can do: output monitoring, anomaly
detection on their own API usage, and cost-attribution controls — which would
make it more actionable for the Top 10's primary audience.

Overlaps with: LLM10 (Unbounded Consumption) — particularly §5 (Model Extraction),
§7 (Side-Channel Attacks), and the LLMjacking pattern. Also adjacent to LLM03
(Supply Chain) for the stolen-credential vector.

Evidence: The Sysdig 2024 LLMjacking report is already cited in both entries.
The overlap in mitigations (rate limiting, credential rotation, monitoring)
further suggests these are the same risk viewed from different angles.