llmaudit.eu

LLM security audit · European Union

Scope an audit

All guides

The annexes

Four working notes on LLM application security, written the way the audit is written: named risks, cited sources, and a clear statement of what was not covered.

  1. Annex 01 How to test an LLM application for prompt injection Map the inputs, map what the model can reach, then probe. The payload families that matter, the indirect channels most teams forget, and what a finding has to prove. Open annex
  2. Annex 02 OWASP Top 10 for LLM Applications 2025: what an auditor tests The ten risks, turned into a checklist: what is tested for each one, which ATLAS techniques it maps to, what evidence the report carries and what the durable fix is. Open annex
  3. Annex 03 EU AI Act for companies deploying chatbots, RAG and agents What actually binds a company that deploys an LLM: the amended dates, the Article 25 trap, Article 50 in practice, and which duties a security audit can produce evidence for. Open annex
  4. Annex 04 Securing AI agents and MCP: the OWASP Agentic Top 10 in practice What changes when the model can act: the ten agentic risks, the incidents that demonstrate each one, the MCP-specific tests, and the controls that survive a successful injection. Open annex