adam_ftt

I put together predictions for how the OWASP LLM Top 10 will evolve in 2026 based on current attack research and where the industry is heading.

Key predictions:

- Agent Hijacking enters at #3 — as agentic AI gets real-world permissions (file access, API calls, code execution), hijacking autonomous agents becomes a critical vector. We've already seen the first AI-orchestrated espionage campaign in 2024.

- Multi-Modal Injection debuts at #6 — prompt injection via images, audio, and documents. Text-based defenses don't catch hidden instructions in pixels or audio frequencies.

- Memory Persistence Attacks at #10 — exploiting ChatGPT-style memory features to plant instructions that survive across sessions.

Curious what the HN security community thinks — what am I missing? What threats do you expect to see rise?

Hey HN,

I’m building a security scanner focused specifically on applications that use LLMs — chatbots, support assistants, AI features inside SaaS products, etc.

It runs tests based on the OWASP Top 10 for LLMs (jailbreaks, prompt leakage, sensitive data exposure, unintended capabilities, injection attacks, misuse of tools/actions, and more). These are issues normal web scanners simply can’t detect.

I’m currently pre-launch and looking for 10–15 real apps to test the latest version on. In return, you’ll get: • A full LLM vulnerability report • Concrete how-to-fix steps for every issue • Completely free — this is for validation + building case studies before launch

To be transparent: I know “free” can sound suspicious, but this isn’t a sales funnel. I genuinely need real-world LLM implementations to validate the scanner and improve automation. You get a professional audit you’d normally pay for.

If you’re open to it, drop your email / DM me.

Many business owners often wonder if they need to get a full SOC 2 certification immediately to secure big contracts. The good news? You might not need to rush into full certification right away.

Many companies today use Vendor Risk Assessment questionnaires to evaluate their vendors. If your company is well-prepared for SOC 2, you can often pass these assessments without the official certification.

Many business owners often wonder if they need to get a full SOC 2 certification immediately to secure big contracts. The good news? You might not need to rush into full certification right away.

Many major companies today use Vendor Risk Assessment questionnaires to evaluate their vendors. If your company is well-prepared for SOC 2, you can often pass these assessments without the official certification.

For example, an US fintech startup, recently secured a significant contract by quickly passing a Vendor Risk Assessment after working with me & the SOC 2 Readiness Tool — without the full certification!

To help businesses like yours evaluate their SOC 2 readiness, I’ve developed a SOC 2 readiness assessment tool. This tool includes 30-50 questions based on SOC 2 criteria and industry best practices for vendor risk assessments. Here are a few example questions of what you'll find:

- “Does your organization provide access to systems based on roles (e.g., role-based access control (RBAC)), and is this process documented for all systems including the service?” - “Is the full restoration of backups tested at least once when initially implemented and each time major IT infrastructure changes occur, or at least annually? (e.g., technology stack changes, vendor changes, platform changes)”

These questions are designed to test specific SOC 2 criteria and provide a clear understanding of your current readiness. See more -->

During my career, I've faced the challenge of achieving SOC 2 and HIPAA compliance firsthand while running my telehealth startup. I still remember the stress, the anxiety, and the uncertainty of not knowing where to begin. Back then, a simple yet powerful resource like this SOC 2 Compliance Checklist would have been a lifesaver.

Later, in my role at a major tech company, I guided over 50 projects through SOC 2 and ISO 27001 compliance. Through these experiences, I discovered the most effective ways to prepare for these rigorous standards, focusing on the essential parts and how these frameworks can add real value to projects, not just headaches.

My goal is to help you see the real-world usefulness of these compliance frameworks without the stress and confusion.

That’s why I created this simple yet powerful SOC 2 Compliance Checklist and Dashboard — to help small and medium companies start their compliance journey quickly and efficiently.