OWASP for LLM & Agentic AI
The Industry Benchmark for Securing LLM Applications and Autonomous Agents
What is OWASP for GenAI?
The OWASP GenAI Security Project maintains the de-facto standard for AI security risk: the OWASP Top 10 for LLM Applications (2025 edition) and, building on it, the OWASP Top 10 for Agentic Applications (released December 2025). Together they give builders a shared vocabulary to identify, prioritize and mitigate the threats unique to LLM-powered and autonomous-agent systems — from prompt injection to rogue agents.
"Agency is power. The more autonomy, tools and memory you give an agent, the larger its attack surface. OWASP frames these risks so you can defend them deliberately, not discover them in production."
Injection
Direct & indirect
Tool Abuse
Weaponized actions
Excess Privilege
Least-privilege
Data Leakage
Sensitive info
Key OWASP Risks for Agentic AI
OWASP identifies several risk categories specific to LLM- and agent-based systems. These are the ones that matter most when an agent can plan, call tools and act autonomously:
1 Prompt Injection
A user or external content manipulates the agent's behavior. Example: an email received by the agent contains hidden instructions to ignore its safety rules (indirect injection).
2 Tool Abuse
Misuse of the tools available to the agent. Example: an agent with Gmail access sends emails without proper authorization.
3 Excessive Permissions
The agent holds more privileges than it should — a violation of the principle of least privilege.
4 Data Leakage
Exposure of sensitive information. Internal data can be sent to external APIs or shown to the user.
5 RAG Poisoning
Manipulation of the knowledge base the agent relies on. Malicious documents influence answers and decisions.
6 Supply Chain Attacks
Compromised libraries, models or tools — especially relevant in LangChain, MCP and plugin ecosystems.
7 Agent Hijacking
The agent's decision flow is altered to execute unauthorized tasks (OWASP "Agent Goal Hijack").
OWASP Top 10 for LLM Applications (2025)
| Code | Risk | What It Covers |
|---|---|---|
| LLM01 | Prompt Injection | Direct & indirect inputs overriding intended behavior |
| LLM02 | Sensitive Information Disclosure | Leaking PII, secrets, proprietary data via outputs |
| LLM03 | Supply Chain | Compromised models, datasets, libraries, plugins |
| LLM04 | Data & Model Poisoning | Tampered training/fine-tuning data corrupting behavior |
| LLM05 | Improper Output Handling | Unvalidated output causing XSS, SSRF, RCE downstream |
| LLM06 | Excessive Agency | Too much autonomy, permissions or tool access |
| LLM07 | System Prompt Leakage | Exposure of hidden system instructions/secrets |
| LLM08 | Vector & Embedding Weaknesses | RAG/vector-DB attacks (incl. RAG poisoning) |
| LLM09 | Misinformation | Confidently wrong / hallucinated outputs |
| LLM10 | Unbounded Consumption | Resource exhaustion, denial-of-wallet, DoS |
OWASP Top 10 for Agentic Applications (2025)
The agentic list (codes ASI01–ASI10) covers new attack surfaces introduced by autonomy, tools, memory and multi-agent coordination.
| Code | Threat | Real-World Example |
|---|---|---|
| ASI01 | Agent Goal Hijack | Hidden prompts redirect the agent (EchoLeak) |
| ASI02 | Tool Misuse | Legitimate tools weaponized (Amazon Q) |
| ASI03 | Identity & Privilege Abuse | Leaked credentials expand operational scope |
| ASI04 | Agentic Supply Chain | Compromised runtime components (GitHub MCP exploit) |
| ASI05 | Unexpected Code Execution | Natural language → RCE (AutoGPT RCE) |
| ASI06 | Memory & Context Poisoning | Persisted data alters future behavior (Gemini memory attack) |
| ASI07 | Insecure Inter-Agent Communication | Spoofed messages misdirect coordination |
| ASI08 | Cascading Failures | False signals compound through automated workflows |
| ASI09 | Human-Agent Trust Exploitation | Polished explanations get harmful actions approved |
| ASI10 | Rogue Agents | Misaligned, self-directed behavior (Replit meltdown) |
Defense Playbook
Do This
- Apply least privilege to every tool & credential
- Treat all external content (email, web, docs) as untrusted
- Require human approval for high-impact actions (HITL)
- Validate & sanitize LLM output before it hits other systems
- Sign & pin models, plugins and MCP servers
- Log, trace and red-team continuously (e.g. Promptfoo)
Avoid This
- Giving agents broad, standing write access
- Trusting retrieved documents without provenance checks
- Installing unvetted plugins/MCP servers
- Letting agents auto-approve their own destructive actions
- Putting secrets in system prompts
- Shipping without rate/cost limits
Resources
OWASP Top 10 for LLMs
Official 2025 list, PDFs and mitigation guidance.
genai.owasp.org/llm-top-10 →Agentic AI Threats
Top 10 for Agentic Applications and the Threats & Mitigations taxonomy.
genai.owasp.org/agentic →