The OWASP AI Exchange is an open, community maintained guide to the security and privacy of AI systems. It sets out threats and controls for generative, agentic and conventional machine learning, and gives a risk analysis method, so teams can threat model an AI system and choose controls.
What does it contain?
The site is organized as a reference you read in order or jump into. Its navigation shows an overview with threats, controls and risk analysis, then deeper sections: general controls (governance, data limitation, limiting unwanted behavior), input threats and controls with prompt injection protection as a highlight, development time threats, runtime conventional security threats, AI security testing, and AI privacy. Highlights include a threat matrix, an agentic AI overview and a section on RAG systems.
The project describes itself as contributing to international standards, including ISO/IEC work and the EU AI Act, through standards partnerships. Judge that claim yourself by checking the project's own pages; for a practitioner the practical value is that it is free and specific.
How is it different from the OWASP LLM Top 10?
The OWASP Top 10 for LLM applications is a ranked list of ten risk categories, including prompt injection, sensitive information disclosure, supply chain, data and model poisoning, improper output handling, excessive agency, system prompt leakage, vector and embedding weaknesses, misinformation and unbounded consumption. It is short and good for awareness. The AI Exchange is wider and deeper: it covers more kinds of AI than language models and pairs threats with named controls. Use the Top 10 to brief a team, and the Exchange to design a system.
How do you use it on a real system?
Walk the system through the Exchange in three passes.
Scope. Decide what kind of AI you have. A classifier, a chatbot with retrieval and an autonomous agent with tools face different threats, and the Exchange treats them separately.
Threats. Use the threat matrix to list which threats apply at each stage: training data, the model, the inputs at runtime, and the surrounding conventional software.
Controls. For each threat that matters, choose a control and an owner. The Exchange notes that controls against prompt injection have limits, so it stresses blast radius: limit what the system can do if the control fails.
A constructed example
A team builds a document assistant with retrieval over shared files. In the scoping pass they classify it as generative AI with retrieval. The threat pass flags untrusted documents carrying instructions. The control pass gives them input segregation, output checks before any action, and least privilege so the assistant can read only the folders the asking user can already read. The residual risk, that an instruction slips through, is accepted because the assistant cannot send email or write files.
Because the content is open and edited through a public repository, you can also contribute. The project invites readers to propose changes through a pull request, which is a practical way to add a threat or control you hit in production. Keep an internal copy of the controls you chose and link each to the page version you read, so reviewers can see why a decision was made.
What it will not do
It is guidance, not a scanner and not a certification. It does not tell you your system is safe. It also moves with the field, so record the date you last used it and the version of any control you adopted.
How to check or apply this
- Classify each AI system you run: predictive, generative, retrieval, agentic.
- Read the overview and threat matrix for that class.
- List threats by lifecycle stage and rate them for your context.
- Pick controls and assign owners.
- Plan blast radius controls for the threats you cannot block fully.
- Add AI specific tests to your release checklist.
- Revisit when the system gains a new tool or data source.
Quick check
Is the AI Exchange a standard I can be audited against?
No. It is open guidance. It can feed your own risk analysis and map to standards, but it is not itself a certification scheme.
Where do I start if I only have an afternoon?
Read the overview and the threat matrix for your type of system, then write down the three threats most likely to apply and who owns each control.
Sources
Last reviewed: 18 October 2026.
