OWASP LLM Top 10, against your agent
The OWASP LLM Top 10 is a security review checklist for applications built around language models, including agents that read untrusted text, call tools, store memory, and affect external systems. Against an agent, it becomes a way to trace where model interpretation can cross into privileged action.
Agents make the list necessary because they put untrusted input inside a decision loop. A chatbot may only answer, but an agent may read email, browse pages, query retrieval, call APIs, write files, or run code. Text from users, documents, tool results, and memory can all become instructions in the model’s next step. The real question is not whether the prompt is neat, but where untrusted text can steer behaviour with consequences.
To apply it, walk the agent category by category and map each risk onto the actual runtime. Mark the inputs, tools, credentials, permissions, memory stores, logs, plugins, deployment path, and downstream systems. For each item, ask what data crosses a trust boundary, what the model may do with it, and what happens if the model is wrong or manipulated. A web page can become an instruction, a retrieved document can poison context, and a tool response can shape the next call.
The trade-off is that this is not a magic test and not just a prompt-injection checklist. It forces slower engineering work: threat modelling, authorisation checks, output validation, sandboxing, least privilege, monitoring, and sometimes human approval. It also produces answers that depend on architecture. An agent with read-only tools has a different risk shape from one with write access, credentials, memory, and unattended execution.
Engineers meet the OWASP LLM Top 10 during design reviews, pre-release security checks, incident reviews, and agent hardening work. A useful output is a short note for each category: whether it applies, where it appears, the plausible abuse case, the current control, and the evidence that the control works. That evidence might be tests, policy enforcement, permission boundaries, audit logs, or a sandbox that prevents the harmful action.
Common questions
- Is the OWASP LLM Top 10 just about prompt injection?
- No. Prompt injection is a major concern, especially for agents that read untrusted text, but the list is wider. It also covers risks such as insecure handling of model output, excessive agency, sensitive data disclosure, supply-chain exposure, denial of service, and overreliance on model judgement. Better prompts help, but they are not a security boundary.
- How do I use it against my own agent?
- Start from the running architecture, not the model in isolation. List every place text, tool output, retrieved content, memory, or user input enters the loop. Then take each OWASP category and write where it applies, what an attacker could try, what prevents harm, and how you know the control works.
- What is commonly missed in agent reviews?
- Teams often review the system prompt and stop there. The more dangerous paths are usually around tools and trust boundaries: retrieved documents that become instructions, plugin results that influence later calls, generated output sent to another system, or broad credentials available to the agent. The model is only one part of the attack surface.
- Does passing this review mean the agent is safe?
- No. It means you have made the main classes of LLM application risk explicit and tied them to controls. The honest answer is always contextual: safety depends on permissions, data sensitivity, tool power, deployment environment, monitoring, and whether high-impact actions require validation or human approval.