/**
 * Cyber-Assistant — Pack de référentiel : OWASP Top 10 des applications LLM — 2025 (v2.0) (2025 (v2.0))
 * GÉNÉRÉ depuis BROUILLON-PACKS-L4-2026-08-04.md (validation PO du 04/08 —
 * délégation de confiance). Données GÉNÉRIQUES, aucune donnée client.
 * Lecture seule — cf. modules/threat-catalog.js et l'étude §4.
 */
(function () {
  'use strict';
  window._csiThreatCatalogs = window._csiThreatCatalogs || {};
  window._csiThreatCatalogs["owasp-llm-2025"] =
  {
    "meta": {
      "id": "owasp-llm-2025",
      "name": "OWASP Top 10 des applications LLM — 2025 (v2.0)",
      "nameEn": "OWASP Top 10 for LLM Applications 2025 (v2.0)",
      "nameNl": "OWASP Top 10 voor LLM-toepassingen 2025 (v2.0)",
      "version": "2025 (v2.0)",
      "publishedAt": "2024-11",
      "sourceDocument": "OWASP Top 10 for LLM Applications 2025 (v2.0) — OWASP Gen AI Security Project",
      "organization": "OWASP Foundation — OWASP Gen AI Security Project",
      "kind": "vulnerability",
      "natureKind": "Classes de risques applicatifs IA/LLM",
      "natureKindEn": "AI/LLM application risk classes",
      "natureKindNl": "Klassen van AI/LLM-applicatierisico’s",
      "licence": "Creative Commons Attribution-ShareAlike 4.0 International (CC BY-SA 4.0)",
      "disclaimer": "Les intitulés des catégories sont ceux de l'OWASP Top 10 for LLM Applications 2025 (v2.0), © OWASP Foundation / OWASP Gen AI Security Project, sous licence CC BY-SA 4.0 (attribution requise, partage dans les mêmes conditions). Les scénarios, traductions et cotations par défaut sont rédigés par Cyber-Assistant et ne sont ni produits ni endossés par l'OWASP Foundation.",
      "disclaimerEn": "Category titles are those of the OWASP Top 10 for LLM Applications 2025 (v2.0), © OWASP Foundation / OWASP Gen AI Security Project, licensed under CC BY-SA 4.0 (attribution required, share-alike). Scenarios, translations and default ratings are authored by Cyber-Assistant and are neither produced nor endorsed by the OWASP Foundation."
    },
    "threats": [
      {
        "id": "LLM25_01_T",
        "ref": "LLM01:2025",
        "label": "Injection de prompt",
        "labelEn": "Prompt Injection",
        "labelNl": "Promptinjectie",
        "adversarial": true,
        "domainHints": [],
        "defaults": {
          "likelihood": 4,
          "impact": 3
        }
      },
      {
        "id": "LLM25_02_T",
        "ref": "LLM02:2025",
        "label": "Divulgation d'informations sensibles",
        "labelEn": "Sensitive Information Disclosure",
        "labelNl": "Openbaarmaking van gevoelige informatie",
        "adversarial": true,
        "domainHints": [
          "DATA",
          "IAM",
          "LOG"
        ],
        "defaults": {
          "likelihood": 3,
          "impact": 4
        }
      },
      {
        "id": "LLM25_03_T",
        "ref": "LLM03:2025",
        "label": "Chaîne d'approvisionnement",
        "labelEn": "Supply Chain",
        "labelNl": "Toeleveringsketen",
        "adversarial": true,
        "domainHints": [
          "SDLC",
          "VULN"
        ],
        "defaults": {
          "likelihood": 2,
          "impact": 4
        }
      },
      {
        "id": "LLM25_04_T",
        "ref": "LLM04:2025",
        "label": "Empoisonnement des données et du modèle",
        "labelEn": "Data and Model Poisoning",
        "labelNl": "Vergiftiging van data en model",
        "adversarial": true,
        "domainHints": [],
        "defaults": {
          "likelihood": 2,
          "impact": 4
        }
      },
      {
        "id": "LLM25_05_T",
        "ref": "LLM05:2025",
        "label": "Mauvais traitement des sorties",
        "labelEn": "Improper Output Handling",
        "labelNl": "Onjuiste verwerking van uitvoer",
        "adversarial": true,
        "domainHints": [
          "SDLC",
          "LOG"
        ],
        "defaults": {
          "likelihood": 3,
          "impact": 4
        }
      },
      {
        "id": "LLM25_06_T",
        "ref": "LLM06:2025",
        "label": "Autonomie excessive",
        "labelEn": "Excessive Agency",
        "labelNl": "Overmatige autonomie",
        "adversarial": true,
        "domainHints": [],
        "defaults": {
          "likelihood": 3,
          "impact": 4
        }
      },
      {
        "id": "LLM25_07_T",
        "ref": "LLM07:2025",
        "label": "Fuite du prompt système",
        "labelEn": "System Prompt Leakage",
        "labelNl": "Lekken van de systeemprompt",
        "adversarial": true,
        "domainHints": [
          "SDLC"
        ],
        "defaults": {
          "likelihood": 3,
          "impact": 2
        }
      },
      {
        "id": "LLM25_08_T",
        "ref": "LLM08:2025",
        "label": "Faiblesses des vecteurs et des embeddings",
        "labelEn": "Vector and Embedding Weaknesses",
        "labelNl": "Zwakheden in vectoren en embeddings",
        "adversarial": true,
        "domainHints": [
          "IAM",
          "DATA"
        ],
        "defaults": {
          "likelihood": 2,
          "impact": 3
        }
      },
      {
        "id": "LLM25_09_T",
        "ref": "LLM09:2025",
        "label": "Désinformation",
        "labelEn": "Misinformation",
        "labelNl": "Desinformatie",
        "adversarial": false,
        "domainHints": [],
        "defaults": {
          "likelihood": 4,
          "impact": 2
        }
      },
      {
        "id": "LLM25_10_T",
        "ref": "LLM10:2025",
        "label": "Consommation non bornée",
        "labelEn": "Unbounded Consumption",
        "labelNl": "Onbegrensd verbruik",
        "adversarial": true,
        "domainHints": [
          "NETCRYPTO",
          "INFRA",
          "LOG"
        ],
        "defaults": {
          "likelihood": 3,
          "impact": 3
        }
      }
    ],
    "scenarios": [
      {
        "id": "LLM25_01",
        "threatId": "LLM25_01_T",
        "ref": "LLM01:2025",
        "label": "Des instructions cachées dans un contenu traité détournent l'assistant IA de ses consignes",
        "labelEn": "Hidden instructions in processed content divert the AI assistant from its rules",
        "labelNl": "Verborgen instructies in verwerkte inhoud leiden de AI-assistent af van zijn richtlijnen",
        "domainHints": [],
        "defaults": {
          "likelihood": 4,
          "impact": 3
        }
      },
      {
        "id": "LLM25_02",
        "threatId": "LLM25_02_T",
        "ref": "LLM02:2025",
        "label": "L'assistant restitue des données confidentielles issues de son contexte ou de son entraînement",
        "labelEn": "The assistant returns confidential data drawn from its context or its training",
        "labelNl": "De assistent geeft vertrouwelijke gegevens vrij uit zijn context of zijn training",
        "domainHints": [
          "DATA",
          "IAM",
          "LOG"
        ],
        "defaults": {
          "likelihood": 3,
          "impact": 4
        }
      },
      {
        "id": "LLM25_03",
        "threatId": "LLM25_03_T",
        "ref": "LLM03:2025",
        "label": "Modèle pré-entraîné, adaptateur ou dépendance IA compromis introduisant un comportement malveillant",
        "labelEn": "Compromised pre-trained model, adapter or AI dependency introducing malicious behavior",
        "labelNl": "Gecompromitteerd voorgetraind model, adapter of AI-afhankelijkheid introduceert kwaadaardig gedrag",
        "domainHints": [
          "SDLC",
          "VULN"
        ],
        "defaults": {
          "likelihood": 2,
          "impact": 4
        }
      },
      {
        "id": "LLM25_04",
        "threatId": "LLM25_04_T",
        "ref": "LLM04:2025",
        "label": "Données d'entraînement ou de réglage empoisonnées biaisant durablement les réponses du modèle",
        "labelEn": "Poisoned training or fine-tuning data durably biasing the model's answers",
        "labelNl": "Vergiftigde trainings- of afstemmingsdata vertekenen de antwoorden van het model blijvend",
        "domainHints": [],
        "defaults": {
          "likelihood": 2,
          "impact": 4
        }
      },
      {
        "id": "LLM25_05",
        "threatId": "LLM25_05_T",
        "ref": "LLM05:2025",
        "label": "Une sortie du modèle est exécutée ou affichée sans validation, provoquant injection ou XSS",
        "labelEn": "Model output executed or rendered without validation, causing injection or XSS downstream",
        "labelNl": "Modeluitvoer wordt zonder validatie uitgevoerd of getoond en veroorzaakt injectie of XSS",
        "domainHints": [
          "SDLC",
          "LOG"
        ],
        "defaults": {
          "likelihood": 3,
          "impact": 4
        }
      },
      {
        "id": "LLM25_06",
        "threatId": "LLM25_06_T",
        "ref": "LLM06:2025",
        "label": "Un agent IA doté de droits trop larges exécute des actions irréversibles non voulues",
        "labelEn": "An AI agent granted overly broad permissions performs unwanted irreversible actions",
        "labelNl": "Een AI-agent met te ruime rechten voert ongewenste onomkeerbare acties uit",
        "domainHints": [],
        "defaults": {
          "likelihood": 3,
          "impact": 4
        }
      },
      {
        "id": "LLM25_07",
        "threatId": "LLM25_07_T",
        "ref": "LLM07:2025",
        "label": "Le prompt système extrait révèle secrets, logique interne et consignes de sécurité contournables",
        "labelEn": "The extracted system prompt reveals secrets, internal logic and bypassable safety rules",
        "labelNl": "De ontfutselde systeemprompt onthult geheimen, interne logica en omzeilbare veiligheidsinstructies",
        "domainHints": [
          "SDLC"
        ],
        "defaults": {
          "likelihood": 3,
          "impact": 2
        }
      },
      {
        "id": "LLM25_08",
        "threatId": "LLM25_08_T",
        "ref": "LLM08:2025",
        "label": "Contenu malveillant injecté dans la base vectorielle RAG manipule les réponses servies aux utilisateurs",
        "labelEn": "Malicious content injected into the RAG vector store manipulates answers served to users",
        "labelNl": "Kwaadaardige inhoud in de RAG-vectordatabank manipuleert de antwoorden aan gebruikers",
        "domainHints": [
          "IAM",
          "DATA"
        ],
        "defaults": {
          "likelihood": 2,
          "impact": 3
        }
      },
      {
        "id": "LLM25_09",
        "threatId": "LLM25_09_T",
        "ref": "LLM09:2025",
        "label": "Réponses inventées mais plausibles prises pour vraies et intégrées dans des décisions métier",
        "labelEn": "Invented yet plausible answers taken as true and fed into business decisions",
        "labelNl": "Verzonnen maar plausibele antwoorden worden voor waar aangenomen en sturen bedrijfsbeslissingen",
        "domainHints": [],
        "defaults": {
          "likelihood": 4,
          "impact": 2
        }
      },
      {
        "id": "LLM25_10",
        "threatId": "LLM25_10_T",
        "ref": "LLM10:2025",
        "label": "Requêtes massives ou coûteuses épuisant quotas et budget d'inférence jusqu'à l'indisponibilité",
        "labelEn": "Massive or expensive requests exhausting inference quotas and budget until unavailability",
        "labelNl": "Massale of dure aanvragen putten inferentiequota en budget uit tot onbeschikbaarheid",
        "domainHints": [
          "NETCRYPTO",
          "INFRA",
          "LOG"
        ],
        "defaults": {
          "likelihood": 3,
          "impact": 3
        }
      }
    ]
  };
})();
