What is the OWASP LLM Top 10 and why does it matter for AI agents?

The OWASP LLM Top 10 is a list of the ten most critical security risks for Large Language Model (LLM) applications, serving as a core security posture assessment for these systems. It matters for AI agents because agentic systems are highly susceptible to persistent, logic-layer attacks, and these risks can lead to real-world harm, especially for customer-facing and tool-using agents.

The OWASP LLM Top 10 includes:

• LLM01 Prompt Injection: Attackers manipulate the model into unintended actions or disclosures through controlled input. Controls include input/instruction separation, trust boundaries on content, least-privilege tool access, and human-in-the-loop for high-impact actions.
• LLM02 Sensitive Information Disclosure: The LLM reveals sensitive data such as PII or secrets. Controls involve input/output scrubbing, data minimization, strict RAG-source scoping, and DLP on responses.
• LLM03 Supply Chain: Vulnerabilities or compromises in components like base models, fine-tunes, datasets, or third-party packages. Controls include model/dataset provenance, signed artifacts, SBOM for the AI stack, and vetting of plugins.
• LLM04 Data and Model Poisoning: Manipulation of training, fine-tuning, or RAG-corpus data to introduce backdoors, biases, or vulnerabilities. Controls include data-source vetting, integrity checks, anomaly detection on training data, and provenance tracking.
• LLM09 Misinformation: The system produces false or unsupported information that users over-rely on. Controls include grounding/citation requirements, refusing on weak evidence, human oversight for consequential decisions, and clear AI-disclaimers.
• LLM10 Unbounded Consumption: Resource exhaustion, denial-of-wallet, or model extraction and theft via unbounded querying. Controls include rate limits and quotas, token/spend caps, abuse detection, and access controls on model endpoints and weights.

For agentic, tool-using deployments, LLM01 (Prompt Injection), LLM02 (Sensitive Information Disclosure), LLM05 (Supply Chain), and LLM06 (Excessive Agency) are particularly critical and often result in high-severity findings. AgentReady, for example, addresses these by implementing schema-validated tools, least-privilege access, human gates on spend/sign-off, rate limits, grounded-or-refuse answering, and per-decision audit logging. The LAAF framework demonstrates that agentic LLM systems are highly susceptible to persistent, logic-layer attacks, underscoring the necessity for LPCI-specific security assessments before production deployment.