AI Security Risk Mapper
Describe your AI system and see exactly which AI security risks apply to it. Toggle the characteristics your system has — RAG / vector DB, tool & function calling, an autonomous agent, PII, internet exposure, third-party models, memory, MCP plugins, fine-tuning — and the mapper lays out the matching OWASP Top 10 for LLM Applications (2025) risks and MITRE ATLAS tactics, each with a concrete example and prioritized mitigations. Everything runs in your browser; nothing is uploaded.
The mapping is a static rule table evaluated in your browser — no AI, no API call, and your system description is never sent anywhere. The output is an educational reference, not a scan: a risk not shown is one your current characteristics don't trigger, not a guarantee that you are safe.
What this tool is
- A free, in-browser reference that maps AI security risks to your specific system: toggle characteristics like RAG, tool/function calling, autonomous agent, PII handling, internet exposure, third-party models, memory, MCP plugins and fine-tuning.
- Every risk is drawn from the 2025 OWASP Top 10 for LLM Applications (LLM01 Prompt Injection through LLM10 Unbounded Consumption) and cross-referenced to MITRE ATLAS adversarial-ML tactics — no invented categories.
- Each mapped risk card explains what the risk is, why your particular setup is exposed, a concrete real-world example, and prioritized mitigations you can act on.
- Export the result as a Markdown checklist to drop into a threat model, a design review, or a ticket.
- Runs entirely client-side with a static rule table — no AI calls, no network requests, nothing about your architecture leaves the browser.
What are AI security risks?
"AI security risks" usually means the ways an application built on a large language model can be attacked, misused, or caused to fail in ways that harm its users or its owner. The industry-standard catalogue is the OWASP Top 10 for LLM Applications, whose 2025 edition names the ten categories below. Which of them apply to you depends entirely on how your system is built — a read-only chatbot and an autonomous agent with database access share almost none of the same exposure. That is what this mapper is for.
The OWASP LLM Top 10 (2025)
- LLM01 Prompt Injection. Attacker-controlled text overrides developer instructions, directly or hidden inside content the model ingests.
- LLM02 Sensitive Information Disclosure. The model reveals PII, credentials, proprietary data or other users' data through its output, retrieved context or memorized training data.
- LLM03 Supply Chain. Compromised base models, weights, datasets, libraries, plugins or MCP servers the application depends on.
- LLM04 Data and Model Poisoning. Tampered training, fine-tuning or retrieval data that creates backdoors, bias or degraded behavior.
- LLM05 Improper Output Handling. Downstream systems trust model output without validation, turning it into an XSS, SQLi, SSRF or command-execution vector.
- LLM06 Excessive Agency. Too much functionality, permission or autonomy, so a manipulated model can take damaging actions unchecked.
- LLM07 System Prompt Leakage. The system prompt is extracted, or wrongly relied on to hold secrets and the only security controls.
- LLM08 Vector and Embedding Weaknesses. Flaws in how embeddings and vector stores are generated, stored and retrieved — inversion, cross-tenant leakage, poisoned retrieval.
- LLM09 Misinformation. False or misleading output — hallucinated facts, citations or insecure code — that users trust and act on.
- LLM10 Unbounded Consumption. Uncontrolled inference enabling denial of service, denial-of-wallet cost exhaustion, or model theft by mass querying.
Where MITRE ATLAS fits
The OWASP list tells you what to fix. MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems) is the attacker's view: a knowledge base of real tactics and techniques used against machine-learning systems, modeled on MITRE ATT&CK. Techniques such as LLM Prompt Injection, Poison Training Data and exfiltration via a model inference API describe how these risks are actually carried out. Where a mapped risk has a clear ATLAS parallel, this tool names the relevant tactic so you can pivot from "what" to "how".
How to read the output: the mapper is a deterministic reference, not a scanner — it does not test your system, it tells you which documented risk categories your architecture exposes you to and why. Use it to seed a threat model, frame a design review, or decide where to spend a pentest. A risk not shown for your selection is one your current characteristics don't trigger, not a guarantee of safety.
Frequently asked questions
What are the main AI security risks?
The most widely used reference for AI application security risks is the OWASP Top 10 for LLM Applications. The 2025 list is: LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM03 Supply Chain, LLM04 Data and Model Poisoning, LLM05 Improper Output Handling, LLM06 Excessive Agency, LLM07 System Prompt Leakage, LLM08 Vector and Embedding Weaknesses, LLM09 Misinformation, and LLM10 Unbounded Consumption. Not every risk applies to every system — which ones matter depends on your architecture. A chatbot with no tools and no retrieval has a very different exposure than an autonomous agent with function calling and a vector database. This tool maps the list to the characteristics you actually have.
What are some examples of AI security vulnerabilities?
Concrete examples include: a support assistant that summarizes a web page containing hidden text telling it to exfiltrate the conversation (indirect prompt injection, LLM01); a RAG assistant that retrieves and quotes a document the current user should not be able to see because access control was only enforced in the UI, not at retrieval (LLM02 / LLM08); a model that returns HTML inserted into a page unescaped, executing attacker script (improper output handling, LLM05); a prompt-injected agent with a broadly scoped database tool running a destructive query (excessive agency, LLM06); and a coding assistant hallucinating a package name an attacker then registers with malware (misinformation, LLM09). This mapper surfaces the examples that fit your system.
What is the difference between this and the AI Threat Model tool?
This AI Security Risk Mapper is an educational reference: you toggle a few characteristics and it deterministically maps them to the relevant OWASP LLM Top 10 risks and MITRE ATLAS tactics, with examples and mitigations, entirely in your browser with no AI involved. It is the fastest way to learn which risks apply and why. The AI Threat Model generator is a separate, deeper tool that produces a structured, system-specific threat model for a described architecture. Use this mapper to understand and triage the landscape; use the threat-model generator when you need a full write-up.
Is MITRE ATLAS the same as the OWASP LLM Top 10?
No — they are complementary. The OWASP Top 10 for LLM Applications is a risk list for people building and securing LLM apps: it names the categories of weakness and how to mitigate them. MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems) is an attacker-centric knowledge base of real-world tactics and techniques used against machine-learning systems, modeled after MITRE ATT&CK — for example LLM Prompt Injection, Poison Training Data, and exfiltration via a model inference API. This tool references both: OWASP tells you what to fix, ATLAS tells you how the attack is actually carried out.
Does this tool send my system description anywhere?
No. The entire mapping is a static rule table embedded in the page and evaluated in your browser. There is no API call, no AI model, no logging of your selections and no network request of any kind when you map your risks. You can use it offline, and nothing about your architecture leaves your machine. That is deliberate: describing your AI system is itself sensitive, so the tool is built to need zero disclosure.