OWASP LLM Top 10 — field notes from building a red-team harness

Notes from turning the OWASP LLM Top 10 into 200+ executable test cases for RedForge.

Lessons

• Indirect / stored injection is the sleeper — payloads arrive via retrieved docs, not the user.
• Mutations matter: the same payload in base64, homoglyphs or zero-width characters often slips past filters that block the plain version. Always keep an un-mutated baseline as control.
• Excessive agency is an architecture problem — scope tools by role before the model sees them.
• Judge calibration: an LLM-as-judge needs its own golden set, or you're measuring the judge.