Skip to content

OWASP LLM and Agentic Risk Mapping

Level: Advanced · Time: ~25 min · Exam relevance: CCAR-P D5 (5.1, 5.2), CCAR-P D3 (3.1, 3.2)

This page maps two OWASP GenAI Security Project lists to the pages, labs and projects in this repository. Use it as a review checklist: for a given design, walk each row, decide whether the risk applies, and follow the links for controls and tests.

Attribution. The risk identifiers and names below (LLM01–LLM10, ASI01–ASI10) come from the OWASP GenAI Security Project, whose Top 10 for LLM Applications is published under CC BY-SA 4.0. Only the identifiers and names are reused; the descriptions, controls and mappings on this page are original to this repository. OWASP does not endorse this project.

Both lists were checked on 2026-10-24:

The descriptions below are short summaries in our own words. Read the OWASP documents for full definitions, examples and their own mitigation guidance.

OWASP Top 10 for LLM Applications 2025

ID Risk One-line summary Primary pages Labs and projects Key controls
LLM01:2025 Prompt Injection Input or content alters the model's behaviour against the developer's intent, directly or via third-party content Prompt injection, Indirect prompt injection Lab 14, Project 03 Untrusted content in tool results, screening, privilege separation, least-privilege tools
LLM02:2025 Sensitive Information Disclosure Model exposes personal, confidential or proprietary data Data exfiltration and disclosure, Secrets management Lab 15 Retrieval-time access control, output channel controls, data minimisation, log redaction
LLM03:2025 Supply Chain Compromised or vulnerable models, packages, plugins, servers or data sources Supply-chain risks, MCP server security Project 04 Intake review, pinning, SBOM, managed MCP allow-lists, Skill audits
LLM04:2025 Data and Model Poisoning Manipulated training, fine-tuning, retrieval or eval data changes behaviour Supply-chain risks, Indirect prompt injection Lab 16 Index write controls, ingestion provenance, protected eval sets
LLM05:2025 Improper Output Handling Model output passed to downstream components without validation or encoding Insecure output handling Project 04 Structured outputs, parameterised queries, encoding, sandboxing, stop_reason checks
LLM06:2025 Excessive Agency Too much functionality, permission or autonomy Tool misuse and excessive agency, Agent identity and permissions, Human oversight Lab 13, Lab 20, Project 05 Narrow tools, policy enforcement point, delegated tokens, risk-tiered approval
LLM07:2025 System Prompt Leakage System prompts reveal secrets or control logic Prompt injection, Data exfiltration and disclosure, Secrets management Lab 14 No secrets in prompts; enforcement outside the prompt
LLM08:2025 Vector and Embedding Weaknesses Weaknesses in how embeddings and vector stores are built, accessed and used, including leakage and poisoning Data exfiltration and disclosure, Indirect prompt injection Lab 11, Project 02 Per-tenant indexes, ACL filters at query time, ingestion review
LLM09:2025 Misinformation Confident but false or misleading output that people rely on Human oversight; hallucinations; grounding and citations Lab 04, Lab 16 Grounding with citations, evals for faithfulness, review for high-stakes outputs
LLM10:2025 Unbounded Consumption Uncontrolled resource use leading to denial of service, cost blow-out or model extraction Tool misuse and excessive agency; rate limits and capacity; cost optimisation Lab 17, Lab 18 Input size limits, iteration caps, task budgets, per-user quotas, spend limits

OWASP Top 10 for Agentic Applications for 2026

The entry names below are as listed on the OWASP GenAI Security Project's announcement of the list.

ID Risk One-line summary Primary pages Labs and projects
ASI01 Agent Goal Hijack Content the agent reads redirects its objective or decision path Indirect prompt injection, Prompt injection Lab 14
ASI02 Tool Misuse Legitimate tools used in unintended or unsafe ways Tool misuse and excessive agency Lab 20, Project 05
ASI03 Identity and Privilege Abuse Agents act with shared, inherited or excessive identities and privileges Agent identity and permissions, Secrets management Lab 20
ASI04 Agentic Supply Chain Vulnerabilities Compromised tools, MCP servers, Skills, plugins or agent components Supply-chain risks, MCP server security Lab 09
ASI05 Unexpected Code Execution Agents generate or run code that leads to unintended execution Insecure output handling, Tool misuse and excessive agency Lab 10
ASI06 Memory and Context Poisoning Persistent memory or context is seeded with malicious or false content Indirect prompt injection; memory and persistence Lab 05
ASI07 Insecure Inter-Agent Communication Messages between agents are spoofed, tampered with or trusted blindly LLM threat modelling, Agent identity and permissions; multi-agent architecture Lab 12
ASI08 Cascading Failures An error or compromise in one agent or step propagates through a system Logging and auditability; reliability engineering; agent reliability Lab 18
ASI09 Human-Agent Trust Exploitation Humans over-trust agents, or agents (or attackers via agents) exploit that trust Human oversight Lab 13
ASI10 Rogue Agents Agents that deviate from intended behaviour or operate outside authorised scope Tool misuse and excessive agency, Logging and auditability, Enterprise deployment controls Project 05

The one-line summaries are our paraphrases. On 2026-10-24 we checked those for ASI05 to ASI10 against the Description section of each entry in the OWASP Top 10 for Agentic Applications for 2026 document, where the full ASI05 title is "Unexpected Code Execution (RCE)". Quote the OWASP text, not these summaries, in formal work.

Cross-reference: STRIDE to OWASP

If you threat-model with STRIDE (page 1), this table helps you tag findings with OWASP IDs for reporting.

STRIDE Most relevant OWASP entries
Spoofing LLM01, ASI01, ASI03, ASI07
Tampering LLM03, LLM04, LLM08, ASI04, ASI06
Repudiation ASI08, ASI10 (both depend on audit trails)
Information disclosure LLM02, LLM07, LLM08
Denial of service LLM10, ASI08
Elevation of privilege LLM05, LLM06, ASI02, ASI03, ASI05

How to use this mapping in a review

  1. Draw the data-flow diagram and mark untrusted content flows (page 1).
  2. For each row above, answer: does this risk apply? If not, record why.
  3. For applicable risks, list the controls present and missing, using the linked pages.
  4. For each control, name the test that proves it: a lab-style harness test, an eval case (safety and red-team evals) or a log-based detection.
  5. Record residual risk and the owner who accepts it (AI governance).

Further reading