# OWASP AI Testing Guide: what it covers and how to use it to scope a test

Source: https://airedteamingservices.com/guides/owasp-ai-testing-guide/
Publisher: Excession Labs (airedteamingservices.com)
Last updated: 2026-11-09

OWASP AI Testing Guide v1 explained: 32 test cases in four layers, status, how it relates to the LLM Top 10 and ATLAS, and how to use it to scope a test.

> **Short answer:** The OWASP AI Testing Guide is an OWASP incubator project that gives a methodology and repeatable test cases for AI systems. Version 1 was published on 26 November 2025. Its framework chapter lists 32 tests in four layers: application (14), model (7), infrastructure (6) and data (5). Use it as a checklist when you scope a test. It does not replace testing.

The OWASP AI Testing Guide is an OWASP project that gives testers a methodology and a numbered set of test cases for AI systems. Version 1 was published on 26 November 2025. This page lists what the guide contains, how its tests relate to the OWASP LLM Top 10 and MITRE ATLAS, and how to use it to scope a test of an AI application.

## What is the OWASP AI Testing Guide?

The OWASP AI Testing Guide describes itself as a methodology for AI system assessment and a "practical standard for trustworthiness testing of AI systems". It offers repeatable test cases across four layers: the AI application, the AI model, the AI infrastructure and the AI data.

Its stated audience is wide: developers, architects, data analysts, researchers, auditors and risk officers. Its stated goal is wider than security. The project text says the industry is converging on the principle that security alone is not enough and that trustworthiness is the objective. That is why the test list includes bias, hallucination and explainability next to prompt injection.

For buyers, this means the guide is a menu. A security assessment of one LLM application will use part of it. The remaining tests need other owners, such as a data science team for bias or a privacy lead for consent.

## Who wrote it and what is its status?

The guide is an OWASP incubator project, and its project page lists Matteo Meucci and Marco Morana as leaders. The project accepts community contributions through its public GitHub repository.

Status as of 9 November 2026: the project page announces "26 November 2025: Version 1 Published". The repository offers a PDF of version 1 and a browsable table of contents. We did not find a later numbered version on the project page.

Incubator is the early OWASP project level, so the guide may change. Cite it with the version and the date you read it. It is not a standard from ISO, NIST or ETSI.

## What test areas does it list?

The framework chapter (chapter 3) lists 32 tests in four layers, each with an AITG ID. We counted them from the table of contents in the repository on 9 November 2026.

| Layer | ID range | Tests | What they cover |
|---|---|---|---|
| Application | AITG-APP-01 to 14 | 14 | Prompt injection, indirect prompt injection, sensitive data leak, input leakage, unsafe outputs, agentic behavior limits, prompt disclosure, embedding manipulation, model extraction, content bias, hallucinations, toxic output, over-reliance on AI, explainability |
| Model | AITG-MOD-01 to 07 | 7 | Evasion attacks, runtime model poisoning, poisoned training sets, membership inference, inversion attacks, resilience to new data, goal alignment |
| Infrastructure | AITG-INF-01 to 06 | 6 | Supply chain tampering, resource exhaustion, plugin boundary violations, capability misuse, fine-tuning poisoning, dev-time model theft |
| Data | AITG-DAT-01 to 05 | 5 | Training data exposure, runtime exfiltration, dataset diversity and coverage, harmful content in data, data minimization and consent |

Chapter 2 covers threat modeling for AI systems, with a mapping of OWASP AI threats to architectural components and a section on responsible AI threats. Chapter 4 holds appendices, including a rationale for using Google's Secure AI Framework (SAIF), a risk lifecycle, a threat-to-component enumeration, and a mapping of AI threats to CVEs and CWEs.

Read the individual test pages before you quote them. This page names the test titles only. Each test page in the repository states its own objective, method and expected result.

## How does it relate to the OWASP LLM Top 10 and ATLAS?

The three documents answer different questions. The OWASP Top 10 for LLM Applications 2026 ranks risks. MITRE ATLAS (release v2026.10) catalogs adversary techniques and case studies. The Testing Guide lists tests. A test plan can start from the risk list, name the attack with ATLAS, and run the test from the guide.

The table pairs common risks with a guide test and an ATLAS technique. The pairing is ours, built from the titles, and it is a starting point rather than an official mapping.

| OWASP LLM 2026 risk | Guide test | MITRE ATLAS technique |
|---|---|---|
| LLM01 Prompt Injection | AITG-APP-01 Prompt Injection; AITG-APP-02 Indirect Prompt Injection | AML.T0051 LLM Prompt Injection (.000 direct, .001 indirect) |
| LLM02 Sensitive Information Disclosure | AITG-APP-03 Sensitive Data Leak; AITG-APP-07 Prompt Disclosure; AITG-DAT-02 Runtime Exfiltration | AML.T0086 Exfiltration via AI Agent Tool Invocation; AML.T0136 Exfiltration via AI User Interface |
| LLM03 Excessive Agency | AITG-APP-06 Agentic Behavior Limits; AITG-INF-04 Capability Misuse | AML.T0053 AI Agent Tool Invocation |
| LLM04 Supply Chain | AITG-INF-01 Supply Chain Tampering | Not mapped here |
| LLM05 Data and Model Poisoning | AITG-MOD-02, AITG-MOD-03, AITG-INF-05 | AML.T0020 Training Data Poisoning; AML.T0070 RAG Poisoning |

The guide has tests with no row above, such as hallucinations and content bias. Those tests belong to the trustworthiness side of the guide. See our pages on the [OWASP Top 10 for LLM applications](/guides/owasp-top-10-for-llm-applications/) and [MITRE ATLAS](/guides/mitre-atlas/) for the other two documents.

## How do you use it to scope a test?

Use the guide as a checklist during scoping: mark each test as in scope, out of scope or not applicable, and write the reason. A scope that lists tests by ID gives the buyer and the tester the same list, and it shows what the engagement left out.

Follow these steps:

1. Draw the system: model, retrieval index, tools, data stores, users and roles. Chapter 2 of the guide shows the idea.
2. Walk the 32 tests. Mark not applicable where a component is absent, for example no fine-tuning, so no AITG-INF-05.
3. Mark the tests your testers can run with the access you will give them. Model-level tests such as membership inference need access you may not have on a hosted model.
4. Pick the tests that match your risk register, and write the access level, accounts and data for each.
5. Record what is out of scope and who covers it. Bias and consent tests often go to other teams.
6. Set the retest rule: which fixed findings the tester will run again.

The [scoping guide](/guides/how-to-scope-an-ai-red-team/) lists the questions to settle for each of these steps, and the [scoping request form](/scoping/) is where you send them.

> **Demonstration:** This is a demonstration. No real customer system was tested. It shows a scoping extract for "Harbor Notes", a fictional note-taking app with an AI assistant that searches notes and can create notes.
> 
> | Test | Decision | Reason |
> |---|---|---|
> | AITG-APP-01 Prompt Injection | In scope | User-facing chat |
> | AITG-APP-02 Indirect Prompt Injection | In scope | Assistant reads shared notes |
> | AITG-APP-06 Agentic Behavior Limits | In scope | Assistant can create notes |
> | AITG-APP-09 Model Extraction | In scope, rate-limit check only | Hosted model; no weights access |
> | AITG-APP-11 Hallucinations | Out of scope | Quality team owns it |
> | AITG-MOD-04 Membership Inference | Not applicable | No fine-tune on customer data |
> | AITG-INF-02 Resource Exhaustion | In scope, bounded | Cost cap agreed; test accounts only |
> | AITG-DAT-05 Data Minimization and Consent | Out of scope | Privacy lead owns it |
## What can a guide not do?

A guide lists what to test. It does not test, and it does not grade the system. Four limits matter.

First, the guide does not say how deep each test goes. Two testers can both claim AITG-APP-01 after very different amounts of work. Ask for the number of attempts, the conditions and the success rate. Model output varies between runs, so one attempt proves little.

Second, it cannot know your application. A list of 32 tests misses the design flaw in your tool permissions or your tenant isolation. That flaw sits in your code and your configuration, and a tester finds it by reading the architecture and trying the paths.

Third, tests that need human judgment stay manual. Goal alignment, over-reliance and data minimization need a reviewer who understands your use case.

Fourth, passing the tests proves little about the future. Results describe one version at one date. A new model, a new tool or a new data source can change them.

## How does our method map to it?

Our planned method has eight steps, from threat model to retest, described on the [methodology page](/methodology/). Each step maps to a part of the guide. The mapping is our reading of the guide, not an OWASP statement.

| Our step | Related part of the guide | What the buyer receives |
|---|---|---|
| 1. Threat model | Chapter 2, threat modeling for AI systems | A one-page system model that you confirm |
| 2. Test plan | Chapter 3, the AITG test list | Scope that names tests by ID |
| 3. Test conditions | Test pages for each AITG test | Account, role, data and model settings for each test |
| 4. Execution | Chapter 3 test methods | Attempt counts and success rates |
| 5. Evidence | Expected results in each test page | Transcripts, logs and proof markers |
| 6. Impact and 7. Fix guidance | Appendix E, threat-to-CVE and CWE mapping | Impact statement and fix steps |
| 8. Retest | Not defined by the guide | Retest results in the report |

We follow the principle that a finding needs proof of a real effect, such as a seeded marker that appears where it should not. We do not say that a system is secure after a test, and we do not claim that a framework mapping is a certification. See the [frameworks page](/frameworks/) for the other documents.

## Questions

### Is the OWASP AI Testing Guide a standard or a certification?

Neither. It is an OWASP incubator project with a methodology and test cases, and nobody certifies against it. Its own page calls it a practical standard for trustworthiness testing, but OWASP projects are community documents. Cite the version and date when you use it.

### Does the guide cover bias and hallucination as well as security?

Yes. The application layer includes tests for content bias, hallucinations, toxic output, over-reliance on AI, and explainability. The guide frames its goal as trustworthiness, which is wider than security. A security-only engagement covers a subset, so say in the scope which tests you include.

### How is it different from the OWASP Top 10 for LLM Applications?

The Top 10 ranks risks and describes fixes. The Testing Guide tells a tester what to try, with an ID for each test. Use the Top 10 to decide what matters, and the Testing Guide to build the test plan. Our mapping table shows how the two relate for common cases.

### Can an automated scanner run the whole guide?

We do not know of a scanner that covers all 32 tests, and we have not checked vendor claims. Several tests need judgment: goal alignment, over-reliance, data minimization and consent. A scanner can repeat many prompt-based cases, but a person reviews the evidence for each finding.

## Sources

- [OWASP AI Testing Guide project page (Version 1 published 26 November 2025)](https://owasp.org/projects/ai-testing-guide)
- [OWASP AI Testing Guide: table of contents (GitHub, Document/README.md)](https://github.com/OWASP/www-project-ai-testing-guide/blob/main/Document/README.md)
- [OWASP AI Testing Guide repository](https://github.com/OWASP/www-project-ai-testing-guide)
- [OWASP GenAI LLM Top 10, 2026 edition](https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/)
- [MITRE ATLAS data release v2026.10](https://github.com/mitre-atlas/atlas-data/releases/tag/v2026.10)