09.03 · Concept
The OWASP LLM Top 10, against your agent
Walk your own agent against the list and say where it stands on each.
The OWASP LLM Top 10 becomes useful for agents when each risk is mapped to the runtime: prompts, retrieval, tools, memory, credentials, logs and deployment. The real review asks where untrusted text or model output can steer consequential actions, and what controls prove that influence is bounded.
What this lesson answers
- how to assess an agent against OWASP LLM risks
- where prompt injection affects tool using agents
- what controls reduce excessive agency in LLM systems
Notes
The OWASP LLM Top 10 is a checklist of failure modes for systems that use language models, not just for the model itself. For an agent, the important move is to map each category onto your actual runtime: user prompts, retrieved documents, tool calls, plugins, memory, logs, permissions, deployment pipeline, and downstream systems. The question is not “is my prompt safe?” but “where can untrusted text or model output influence an action with consequences?”
A useful mental model is to treat the agent as a junior employee with an email inbox, web browser, terminal, credentials, memory, and…
Common questions
- Is the OWASP LLM Top 10 only about prompt injection?
- No. Prompt injection is a major category, but the list is wider than malicious instructions in prompts. It also covers unsafe handling of model output, too much autonomy, data leakage, weak dependencies, denial of service, misplaced trust in generated results and other system-level risks around language model applications.
- How should I apply the list to an agent architecture?
- Trace every place where text or model output can affect behaviour: user input, retrieved content, tool responses, memory, logs, plugins, permissions and downstream systems. For each risk, record where it appears, how it could be abused, what control limits it and what evidence shows the control works.
- Why are agents more exposed than a simple chatbot?
- An agent can read from multiple untrusted sources and then act through tools, APIs or credentials. That creates more boundaries where data can become instruction. A web page, document or tool result can shape later actions, so validation, sandboxing, least privilege and approval gates matter as much as prompt wording.
Short definition: what is OWASP LLM Top 10, against your agent?