GenAI Security Inside Track

Agents share credentials, erase their trails, and touch data no one has inventoried.

Scott Clinton talks with Emmanuel Guilherme Jr., leader of the AI Data Security Initiative, about 21 data security risks, the upcoming Best Practices v2 series, the GenAI Security Crosswalk, and an open source scanner that checks your apps against the risks.

Hosted by Scott Clinton.

Produced by the Gen AI Security Project with help from RumRunner Media.

AI threat intelligence has gone from overblown headlines to real incidents. Scott Clinton talks with Rachel James and Dr. Bryan Nakayama about how to cut through the noise: what threat actors are actually doing with AI, malicious instructions hiding in plain language, why attribution is getting harder, and who is liable when agents go rogue.

Produced by the Gen AI Security Project with help from RumRunner Media

"Can I get an AI to say something bad?" That's brand risk, not real security risk. Scott Clinton talks with Jason Ross (Salesforce) and Sonu Kumar, co-leads of the Gen AI Security Project's Red Teaming Initiative, about what real AI security testing looks like now that agents can send emails, update records, and execute code on their own.

We cover why human-in-the-loop is a weaker control than most people assume, why following the full permission chain from user to agent to tool matters more than finding a single jailbreak, and why non-deterministic AI behaviour is breaking traditional pen-testing assumptions.

Key insight: Treat your AI with an assumed-breach posture. Stop trying to prevent prompt injection—design deterministic controls so it doesn't matter when it happens.

Hosted by Scott Clinton

Produced by the Gen AI Security Project with help from RumRunner Media

The OWASP Top 10 for LLM Applications started as a scrappy ChatGPT-era exercise in 2023. Three years later, it's the industry's most trusted reference for building secure AI systems—and it just got a major update.

In this episode, Scott Clinton sits down with GenAI Security Project Co-Founder, Steve Wilson and Rock Lambros, co-lead of the Top 10 to break

down what changed in 2026:

• Excessive Agency Jumped Several Spots — As LLMs evolve from chatbots into agents with tools, memory, and real-world consequences, giving them too much autonomy is now one of the industry's biggest risks.

• Guardrails Built as Prompts Are Fundamentally Insecure

• Prompt Injection Is Now Treated as Inevitable — The list's #1 risk isn't ranked there to tell you to eliminate it—it's there because you need to design your entire system assuming it will happen.

• Built on Real Incident Data for the First Time — And the data was messier than expected, requiring a 75/25 blend of expert judgment and hard numbers.

The Bottom Line: Whether you're a security pro or just getting started with agentic tools, understanding where LLM risk ends and agent risk begins is now essential.

Hosted by Scott Clinton | Featuring Steve Wilson & Rock Lambros

Produced by the Gen AI Security Project with help from RumRunner Media

The OWASP Gen AI Security Project started as a simple top-ten list in 2023. Today it's the world-leading authority on generative AI security, with 30,000+ members and guidance used by practitioners across the globe.

In this inaugural episode, Scott Clinton—co-founder and co-chair—shares the origin story: how frustration with slow-moving standards bodies sparked a community-driven approach to keeping up with AI's breakneck pace.

We dive into the project's 10 working initiatives, the partnership between practitioners and research institutions (NIST, Turing Institute, Stanford, Oxford), and what's coming next.: Red Teaming Guide v2, Agent Security breakthroughs, and a new Council for Agent Security.

Key insight: When AI moves this fast, you can't rely on any single company or committee. You need all of us working together—that's the only way security keeps pace.

Hosted by Scott Clinton

Produced by The Gen AI Security Project with help from RumRunner Media