OWASP Top 10 for LLMs: what every security practitioner needs to know

I have audited web apps, APIs, and cloud infrastructure. When I started looking at LLMs seriously, I kept reaching for instincts that were wrong — not useless, but wrong in specific ways. This post is