← Back to getcrawdad.dev

OWASP LLM Top 10 & CVE Coverage

Crawdad's coverage against the OWASP Top 10 for LLM Applications (2025) and known CVEs.

OWASP Top 10 for LLM Applications

OWASP IDStatusDetails
LLM01: Prompt InjectionMitigatedL1 pattern matching + L2 ML semantic classifier (DeBERTa-small ONNX FP16) + L3 indirect injection scanning + L4 session context. 99.8% detection and 0% false-positive rate on the open 497-attack / 1,172-negative benchmark; ~75% on continuous red team mutation engine.
LLM02: Insecure Output HandlingMitigatedL5 output guard + L6 PII & credential detector scan all outbound responses. Detects and redacts credentials, PII (15 categories), internal URLs.
LLM03: Training Data PoisoningAwarenessThreat intelligence feed tracks poisoning research. Crawdad operates at inference time, not training time.
LLM04: Model Denial of ServiceNot coveredRate limiting and resource management are upstream provider concerns.
LLM05: Supply Chain VulnerabilitiesPartialSkill attestation (SHA-256), SBOM generation, dependency tracking. Does not cover model weight supply chain.
LLM06: Sensitive Information DisclosureMitigatedL6 PII & credential detector: 15 PII categories, 10+ credential types including AWS, GitHub, Stripe, OpenAI, Anthropic API keys, JWT, SSH keys, database URLs. L2 ML classifier catches system prompt extraction attempts.
LLM07: Insecure Plugin DesignPartialPolicy engine evaluates tool calls against configurable rules. Action authorization endpoint checks agent permissions before execution.
LLM08: Excessive AgencyPartialPolicy engine with configurable rules. Trust levels restrict which actions agents can take. Audit log records all decisions.
LLM09: OverrelianceNot coveredHuman judgment about AI output quality is outside the scope of runtime security.
LLM10: Model TheftNot coveredModel access controls are the API provider's responsibility.

Known CVEs

ThreatStatusDetails
CVE-2026-25253 (OpenClaw RCE)MitigatedInbound firewall blocks malicious payloads. Proxy scans all traffic before it reaches the agent.
LiteLLM supply chain (March 2026)PartialOutbound scanning detects credential exfiltration. Does not prevent malicious package installation.
MCP prompt injectionMitigatedLayer 1+2 detection. Layer 3 indirect injection catches MCP-delivered payloads.
RAG index poisoningMitigatedLayer 3 indirect injection detector + memory integrity via Merkle chains.

MITRE ATLAS Coverage · NIST AI RMF · Threat Model