Title: Discussion 2 — Why New Categories in 2025?
Course: AIINFRA 302: AI Security, Guardrails & Governance > Section: Week 02 — OWASP LLM Top 10 (2025) Deep Dive

💬 Discussion 2 — Why New Categories in 2025? (20 pts)

Prompt: The 2025 OWASP LLM Top 10 introduced Vector and Embedding Weaknesses (LLM08) and System Prompt Leakage (LLM07) as entirely new categories rather than folding them into existing ones like Sensitive Information Disclosure or Supply Chain. Why do you think the OWASP GenAI Security Project working group decided these risks were distinct enough to deserve their own category? What does that decision tell you about how LLM applications are actually being built and deployed today (think about RAG pipelines and agentic systems specifically)? Use at least one specific example or scenario from this week's lecture or lab to support your answer. Post your initial response, then respond to at least two classmates — ideally engaging with a perspective different from your own or pushing on a specific example they gave.