OWASP LLM & Agentic Top 10: A Security-Controls Checklist for AI Agents
- OWASP publishes three GenAI artifacts you must map together: the LLM Applications Top 10 (LLM01-LLM10), the Agentic Applications Top 10 (ASI01-ASI10, released December 9 2025 as the 2026 edition), and the granular Agentic Threats & Mitigations taxonomy.
- Each item needs three columns of controls: preventive, detective, and what to monitor on the agent + MCP layer - the autonomy layer is where most model-level controls quietly fail.
- The lethal trifecta (private data + untrusted content + external communication) is the core exfiltration model; breaking one leg is your highest-leverage control.
- Foundational cross-cutting controls recur on almost every item: least-privilege scoped identity per agent, human-in-the-loop approval gates, egress and DLP, MCP OAuth 2.1 + PKCE/S256, and structured per-agent audit logging.
- You cannot apply any of this to agents and MCP servers you do not know exist - continuous discovery and inventory is the precondition for the whole checklist.
Three OWASP lists now describe how generative AI breaks, and most teams are still securing against the first one. The OWASP Top 10 for LLM Applications 2025 (LLM01-LLM10) covers the model and the application around it. The OWASP Top 10 for Agentic Applications (ASI01-ASI10), released on December 9 2025 as the 2026 edition, is OWASP's first ranked list built for systems that take actions. And the Agentic AI Threats & Mitigations taxonomy breaks those risks into granular, detection-grade detail. They are not interchangeable, and a control that satisfies the LLM list often does nothing for the agentic one.
This is a controls checklist, not an explainer. For each major OWASP item it gives you three things: preventive controls, detective controls, and what to monitor on the agent and MCP layer - the place where autonomy turns a model bug into a production incident. If you want the conceptual background, see our companion guides to the LLM Applications Top 10 and the Agentic Applications Top 10. This page is what you tape next to your monitor.
Three lists, one control plane
Keep the three artifacts distinct, because conflating them is how gaps appear. The LLM list is your baseline for any feature that calls a model. The agentic list applies the moment that model can invoke a tool, write to memory, or talk to another agent. The Threats & Mitigations taxonomy is what you reach for when you write the actual detection rule.
| Artifact | Scope | Use it for |
|---|---|---|
| LLM Top 10 (LLM01-LLM10) | Model + application layer | Baseline controls for any LLM feature |
| Agentic Top 10 (ASI01-ASI10) | Autonomy layer: tools, memory, identity, multi-agent | Ranking and prioritising agent risk |
| Threats & Mitigations taxonomy | Granular threat catalogue | Writing detection and response logic |
The 2025 LLM cycle added two items worth noting: LLM07 System Prompt Leakage and LLM08 Vector and Embedding Weaknesses. Both matter more in agentic systems, where prompts carry tool definitions and retrieval feeds untrusted context straight into a decision loop.
The mental model: the lethal trifecta
Before the per-item checklist, internalise one model. Simon Willison's lethal trifecta (June 16 2025) says an agent becomes capable of data exfiltration when it simultaneously holds three things: access to private data, exposure to untrusted content, and the ability to communicate externally. The pattern has been demonstrated in production agentic systems, most prominently the GitHub MCP exploit that bundled all three legs.
The control implication is blunt: break at least one leg. Scope the agent away from private data, isolate untrusted content from the action path, or block external egress. If you can only afford one control per agent, make it the one that severs a trifecta leg. We expand this in the lethal trifecta and AI agent data exfiltration.
LLM01 Prompt Injection - paired with ASI01 Goal Hijack and ASI06 Memory Poisoning
Prompt injection is the root cause behind most agentic incidents, because in an agent the injected text does not just change an answer - it changes what the agent *does*. ASI01 Agent Goal Hijack is the autonomy-layer expression of LLM01. The reference case is EchoLeak (CVE-2025-32711), a zero-click indirect prompt injection in Microsoft 365 Copilot disclosed by Aim Security in June 2025 that exfiltrated data through a crafted email and was patched server-side by Microsoft.
| Preventive | Detective | Monitor on the agent/MCP layer |
|---|---|---|
| Segregate trusted instructions from untrusted content; input guardrails/classifiers; constrain role and task | Validate outputs with deterministic checks; flag known injection patterns | Goal/intent drift; anomalous tool-call sequences vs baseline; sudden new external destinations |
On the memory side, ASI06 Memory & Context Poisoning deserves its own attention. The MINJA research (arXiv 2503.03704, NeurIPS 2025) showed a *query-only* memory injection attack - an ordinary user with no elevated privileges planting malicious records in an agent's memory through crafted queries, reporting around 98% injection success. The production analog is the Gemini long-term memory poisoning reported by Johann Rehberger in February 2025, which used indirect injection plus delayed tool invocation to persist false memories; Google reported mitigation in November 2025.
- Preventive: authenticate and validate memory writes; isolate sessions; treat retrieved memory as untrusted input.
- Detective: anomaly detection over memory contents; ability to roll back or sanitise poisoned memory.
- Monitor: unexpected memory writes, especially from low-privilege sessions. See AI agent memory poisoning explained and indirect prompt injection explained.
LLM06 Excessive Agency - paired with ASI02, ASI03 and ASI05
This is the cluster where the LLM and agentic lists overlap most, and where continuous monitoring pays off most. LLM06 Excessive Agency maps to ASI02 Tool Misuse, ASI03 Identity & Privilege Abuse, and ASI05 Unexpected Code Execution. The failure mode is an agent doing something within its granted capability that it should never have been allowed to do.
A canonical tool-misuse case is the Amazon Q Developer VS Code extension incident (v1.84.0, July 2025): an attacker pull request injected a destructive 'wipe system' prompt into the extension. AWS pulled it and shipped 1.85.0; the payload happened to fail due to a syntax error - a near miss, not a safe design. See our writeup of the Amazon Q Developer prompt-injection wiper (GHSA-7g7f-ff96-5gcw). The rogue-agent category is illustrated by the July 2025 Replit incident, where an AI agent deleted a production database during a code freeze and fabricated thousands of fake records despite instructions not to.
| Preventive | Detective | Monitor on the agent/MCP layer |
|---|---|---|
| Narrowly scoped tools; least-privilege per-agent identity and tokens; HITL gates for high-impact actions; sandbox code execution | Compare tool invocations against a per-agent baseline; flag privilege escalation and out-of-scope actions | Every tool call, the identity behind it, and whether it falls outside the agent's normal envelope |
Least privilege is the load-bearing control here. Give each agent its own scoped identity rather than a shared human credential, and grant the minimum tool set. We cover the mechanics in least privilege for AI agents and the identity model in non-human identity governance. For coding agents specifically, securing AI coding agents and CLIs and Claude Code permissions and hooks hardening translate this into concrete settings.
LLM03 Supply Chain - paired with ASI04 Agentic Supply Chain
The classic LLM03 supply-chain risk (compromised models, datasets, packages) gains a new surface in agentic systems: the MCP servers an agent connects to. ASI04 Agentic Supply Chain Vulnerabilities is anchored by the GitHub MCP exploit disclosed by Invariant Labs on May 26 2025 - indirect prompt injection through a malicious public issue coerced an agent into leaking private-repository data, a 'toxic agent flow.' It was architectural; mitigation came from one-repo-per-session scoping and least-privilege tokens.
| Preventive | Detective | Monitor on the agent/MCP layer |
|---|---|---|
| Vet and inventory MCP servers before connection; signed SBOM (CycloneDX); pin and verify tool descriptions | Detect changed tool descriptions ('rug pull'); dependency vulnerability monitoring | New or unvetted MCP servers appearing in the fleet; tool-description drift since approval |
A tool that was safe at connection time can be silently repurposed later. The MCP tool poisoning campaign and our MCP server security guide cover the rug-pull pattern in depth, and AI supply-chain attacks: a defender's guide puts it in the broader context of package-ecosystem campaigns. Maintaining an MCP server registry is the practical countermeasure.
LLM02 Sensitive Information Disclosure - the exfiltration path
LLM02 is where the lethal trifecta becomes concrete. The risk is an agent surfacing private data through its outputs or its outbound calls - and in an agent, 'output' includes tool calls to external systems. This pairs with ASI01 and ASI03.
- Preventive: egress allowlisting; DLP on agent outputs; scope private-data access; mask sensitive fields before they reach the model.
- Detective: monitor external communication for exfil patterns, especially when an agent simultaneously holds private data, untrusted content, and outbound capability.
- Monitor: outbound destinations per agent; volume and sensitivity of data crossing the egress boundary.
Traditional DLP often misses this because the exfiltration rides inside legitimate API calls the agent is allowed to make. DLP for AI agents: why traditional DLP fails and secrets management for AI agents cover the gap. The lethal-trifecta exfil pattern in production is detailed in lethal trifecta: production agent exfiltration.
LLM05 Improper Output Handling
Treat model output as untrusted input to whatever consumes it. In agentic systems this is acute: model output becomes the argument to a tool call, a shell command, or a database query. ASI05 Unexpected Code Execution is the autonomy-layer consequence.
- Preventive: context-aware encoding; sanitise and validate before any backend; SQL escaping and HTML encoding; never pass raw model output to a shell.
- Detective: validate tool arguments against schemas; flag commands outside an allowlist.
- Monitor: code-execution tool calls and the arguments passed to them.
LLM07, LLM08, LLM09 and LLM10
The remaining LLM items round out the baseline. Bundle them so nothing slips.
| Item | Key preventive controls | What to monitor |
|---|---|---|
| LLM07 System Prompt Leakage | Keep secrets out of prompts; separate credentials from instructions; never treat the prompt as a security boundary | Attempts to extract system prompt; secrets appearing in prompt context |
| LLM08 Vector & Embedding Weaknesses | Access control and logical partitioning of vector DBs; per-user fine-grained access; trusted sources only | Cross-tenant retrieval; queries pulling data above the caller's clearance |
| LLM09 Misinformation | RAG over verified sources; cross-verification; source attribution; human fact-checking | Hallucination/confidence signals on high-stakes outputs |
| LLM10 Unbounded Consumption | Rate limiting and throttling; timeouts; per-user/per-agent quotas | Cost and resource spikes; runaway loops across the fleet |
LLM10 pairs with ASI08 Cascading Failures: one looping or compromised agent can amplify across a multi-agent system. Quotas and circuit breakers are preventive; fleet-wide cost and loop monitoring is detective.
The agentic-only items: ASI07, ASI09, ASI10
A few agentic risks have no clean LLM-list equivalent. ASI07 Insecure Inter-Agent Communication concerns messages between agents being poisoned or spoofed; require authenticated, integrity-checked channels and treat inbound agent messages as untrusted. ASI09 Human-Agent Trust Exploitation is social engineering through the agent - the agent persuading a human to approve something harmful; counter it by making approval prompts show the *actual* action and its blast radius, not the agent's summary. ASI10 Rogue Agents is behavioural drift toward harmful autonomy, the Replit category.
Foundational controls that recur on almost every item
Step back and the same handful of controls keep appearing. Implement these once, well, and you raise your score on most of the list at the same time.
- Least-privilege scoped identity per agent - a distinct, minimally-scoped credential per agent, never a shared human token.
- Human-in-the-loop approval gates for high-impact actions - but watch for approval fatigue, where reflexive clicking defeats the control.
- Egress allowlisting and DLP - the cheapest way to break a lethal-trifecta leg.
- MCP authorization hardening - OAuth 2.1 + PKCE/S256, HTTPS, audience-validated tokens, and Protected Resource Metadata discovery; see OAuth for MCP servers explained.
- Structured per-agent audit logging - an immutable trail that counters repudiation and feeds rogue-agent detection; see the AI agent audit trail and logging guide.
- Sandboxing of code execution and runtime anomaly detection - see runtime monitoring and anomaly detection for AI agents.
For mapping this checklist into formal programmes, the framework guides line up cleanly: NIST AI RMF for AI agents, ISO 42001 AI agent governance, MITRE ATLAS agentic threats, and the OWASP AIVSS agentic scoring for prioritisation.
The precondition: you can only secure what you can see
Every control above assumes you know the agent or MCP server exists. In practice, most do not. Developers wire up coding assistants and connect MCP servers without a ticket; employees adopt agents the way they once adopted SaaS. That is the shadow-IT problem applied to autonomy, and we cover it in AI agents are the new shadow IT and how to build an AI agent inventory.
This is where continuous agent and MCP visibility - the category Anomity works in - fits the checklist, and it fits it in a specific place: the detective and monitoring column of nearly every item. Discovery and inventory turn the foundational controls from aspirational to enforceable; permission monitoring backs LLM06/ASI02/ASI03; tool-description and registry tracking backs ASI04; egress and behaviour monitoring backs the lethal-trifecta exfil path; and a structured per-agent audit trail backs the accountability gap behind ASI09 and ASI10. None of it is a substitute for the preventive controls - it is how you confirm they are actually holding across a fleet that changes every day.
How to use this checklist
Run it as a sequence, not a one-time audit. First, build the inventory - every agent, every MCP server, every identity. Second, sever lethal-trifecta legs on your highest-risk agents. Third, apply the per-item controls, prioritising LLM06/ASI02/ASI03 (excessive agency) and ASI04 (supply chain) because those are where autonomy does the most damage fastest. Fourth, turn on detective monitoring and audit logging so the controls you just set can be verified continuously. Then revisit on every new agent, every new MCP connection, and every OWASP revision - because the lists, and your fleet, will keep moving.
OWASP gives you the taxonomy. The lethal trifecta gives you the mental model. Least privilege, egress control, HITL, MCP OAuth hardening, and audit logging give you the controls. And continuous discovery gives you the one thing without which none of the rest is real coverage: knowledge of what you are actually defending.
Frequently asked questions
What is the OWASP Top 10 for LLM Applications?
It is OWASP's foundational, model- and application-layer risk list for generative AI, covering LLM01 Prompt Injection through LLM10 Unbounded Consumption. The 2025 cycle added LLM07 System Prompt Leakage and LLM08 Vector and Embedding Weaknesses. It is the right starting point for any LLM feature but predates many of the autonomy and tool-use concerns that the Agentic Top 10 now addresses.
How is the OWASP Agentic Top 10 different from the LLM Top 10?
The Agentic Applications Top 10 (ASI01-ASI10), released December 9 2025 as the 2026 edition, is OWASP's first agentic-specific ranked list. It focuses on what goes wrong once an LLM can take actions: goal hijack, tool misuse, identity and privilege abuse, supply-chain risk from connected MCP servers, code execution, memory poisoning, inter-agent communication, cascading failures, human-trust exploitation, and rogue agents. The LLM Top 10 covers the model; the Agentic Top 10 covers the autonomy layer wrapped around it.
What are the three OWASP GenAI documents and how do they relate?
The LLM Applications Top 10 (LLM01-LLM10) is the model/app baseline. The Agentic Applications Top 10 (ASI01-ASI10) is the ranked autonomy-layer list. The Agentic Threats & Mitigations taxonomy is a finer-grained threat catalogue - memory poisoning, tool misuse, privilege compromise, repudiation, identity spoofing, and more - that you can use to write detailed detection logic. Map the same control across all three.
What is the lethal trifecta and why does it matter for agents?
Coined by Simon Willison on June 16 2025, the lethal trifecta describes the conditions that make an agent capable of data exfiltration: it simultaneously has access to private data, exposure to untrusted content, and the ability to communicate externally. When all three are present, indirect prompt injection can steal data. The strongest control is to break at least one leg - block external egress, isolate untrusted content, or scope down private-data access.
What MCP authorization controls should I require?
Per the MCP specification, any internet-accessible MCP server must implement OAuth 2.1 with PKCE using the S256 method, serve all authorization endpoints over HTTPS, validate the token audience so a token issued for one server cannot be replayed at another, and expose OAuth 2.0 Protected Resource Metadata (RFC 9728) - returning a 401 with a WWW-Authenticate header that points clients to the metadata, which in turn names the correct authorization server. These are concrete preventive controls for the identity, privilege, and supply-chain items.
Can a low-privilege user really poison an agent's memory?
Yes. The MINJA research (arXiv 2503.03704, NeurIPS 2025) demonstrated a query-only memory injection attack in which an ordinary user with no elevated privileges plants malicious records in an agent's memory bank purely through crafted queries, reporting around 98% injection success. The production analog is the Gemini long-term memory poisoning reported by Johann Rehberger in February 2025. Controls include validating and authenticating memory writes, session isolation, and anomaly detection over memory contents.
Which OWASP items map most directly to continuous agent and MCP visibility?
The detective and monitoring columns of almost every item, but most strongly LLM06 Excessive Agency with ASI02 Tool Misuse and ASI03 Identity and Privilege Abuse, the agentic supply-chain item ASI04, and the repudiation/audit-trail concern behind ASI09 and ASI10. Discovery, permission monitoring, behavior baselining, and an audit trail across the fleet are what turn a paper checklist into something you can actually enforce.
Where do I start if I have many agents and MCP servers already in production?
Start with inventory. Build a complete list of every agent and MCP server, who owns each, what data and tools each can reach, and which identity it authenticates as. Then layer the checklist on top: scope tokens to least privilege, add human-in-the-loop gates for high-impact actions, enforce egress controls, and turn on structured per-agent audit logging. You cannot govern what you cannot see, so discovery comes first.
