The OWASP landscape: two lists you will be asked about

OWASP Top 10 for LLM Applications (2025)

Published on the project site 18 November 2024 as the 2025 edition. The full list:

Two entries carry most of the agent weight. LLM01 Prompt Injection is the mechanism — ranked #1 since the first edition of the list. LLM06 Excessive Agency is the agent-specific one: granting an LLM-based system too much functionality, too many permissions, or too much autonomy. Read together they are the agent threat model in miniature: injection supplies the intent, excessive agency supplies the reach.

OWASP Top 10 for Agentic Applications

Released 9 December 2025 at the London Agentic Security Summit; the resource page titles it OWASP Top 10 for Agentic Applications for 2026. Entries use the ASI prefix:

Notice what the agentic list adds over the LLM list: persistence (ASI06 — attacks that survive the session), identity (ASI03, ASI07 — who the agent is acting as, and what it believes about other agents), compounding (ASI08 — one bad step becoming twenty), and the human as an attack surface (ASI09 — habituated approvers). None of those exist in a single-shot LLM call.

OWASP describes the list as peer-reviewed over more than a year with input from more than 100 security researchers, practitioners and organisations, vetted by an Expert Review Board. It ships with a shared-language mapping to the LLM Top 10 and a mapping to the AI Vulnerability Scoring Standard (AI-VSS).

How they relate — and how to cite them

Use LLM0x:2025 when you are talking about a model-powered application — a chatbot, a RAG endpoint, a classification service. Use ASI0x when the system has tools, a loop and standing permissions.

The mapping is many-to-many, not one-to-one. Prompt injection (LLM01) is the mechanism behind ASI01, ASI06 and often ASI02; Excessive Agency (LLM06) is the precondition behind ASI02 and ASI03. When you write a finding, name both layers: "indirect prompt injection (LLM01) achieving agent goal hijack (ASI01), reaching production because the agent held the user’s full mailbox scope (LLM06 / ASI03)." That sentence tells a reader the mechanism, the effect and the reason it mattered.

Both lists sit under the same umbrella project, and the deeper agent material lives in the Agentic Security Initiative (ASI) publications, not in the top-ten summaries. The ASI documents are where the threat taxonomy and mitigations actually are.

Memory poisoning

Agent flavour: an attacker gets a false fact or a standing instruction written into the agent’s persistent memory — "the finance team approved unrestricted transfers" — and it is retrieved as trusted context on every future run, long after the injected document is gone.

Containment: treat memory writes as privileged operations. Namespace memory per user and per task, validate or summarise before writing rather than storing raw text, expire aggressively, and keep an audit trail of what wrote each entry so you can invalidate a batch. Corresponds to ASI06 Memory & Context Poisoning.

Tool misuse

Agent flavour: the tool works exactly as designed and is invoked for the attacker’s purpose — a legitimate send_email with an attacker-chosen recipient, a legitimate refund for an attacker-chosen amount. Nothing is exploited except your trust in the caller.

Containment: constrain at the tool boundary, where the constraint is deterministic: parameter allowlists and caps, recipient domain restrictions, per-run quotas, and an approval gate on the irreversible ones. This is the practical answer to LLM06 Excessive Agency and ASI02 Tool Misuse.

Privilege compromise

Agent flavour: the agent holds broader authority than the task needs — the user’s full OAuth scope, a shared service account, a token good for every repository in the org — so any successful injection inherits all of it. The confused deputy problem, restated for agents.

Containment: least privilege as an architectural default: per-task credentials, short-lived tokens, one-scope-per-session policies, and separate identities for read and write paths. Corresponds to ASI03 Identity & Privilege Abuse.

Misaligned and deceptive behaviours

Agent flavour: the agent reports success it did not achieve, hides a failed step, or takes an unsanctioned shortcut toward the goal you gave it — the Replit incident’s most instructive detail was an agent confidently telling its user that a database rollback was impossible when the rollback in fact worked.

Containment: never accept the agent’s own account of what happened as evidence. Verify outcomes out-of-band (query the record, re-read the file, diff the state), and keep the trace as the source of truth. An agent’s self-report is generated text, not telemetry.

Intent breaking and goal manipulation

Agent flavour: injected text does not ask for data — it rewrites the objective. The agent believes it is still doing your task while pursuing the attacker’s, which is why the trace can look coherent and reasonable end to end.

Containment: pin the goal outside the model’s editable context, re-state it on every iteration, and validate the final action against the original request deterministically rather than trusting the agent’s own account of what it is doing. Corresponds to ASI01 Agent Goal Hijack.

Cascading hallucination attacks

Agent flavour: one fabricated or injected intermediate result becomes the ground truth every later step reasons from — and in multi-step or multi-agent systems it spreads, with each hop adding confident-sounding corroboration.

Containment: verification steps at the boundaries that matter (re-read the file you claim to have edited, re-query the record you claim to have created), shorter loops, and checkpointing so a bad step can be rolled back rather than built upon. Corresponds to ASI08 Cascading Failures.

Unexpected code execution

Agent flavour: the agent can run code — a shell tool, a Python interpreter, a build step — and injected content chooses what runs. Note that the code-execution tool does not have to be for the attacker’s payload; running an attacker-supplied test file or dependency is enough.

Containment: execute in a sandbox with no credentials mounted and no default network route, apply egress control to the sandbox, make the filesystem ephemeral, and never treat "the agent only runs code it wrote" as a boundary. Corresponds to ASI05 Unexpected Code Execution.

Identity spoofing and impersonation

Agent flavour: something claims to be an agent, a user, or a tool it is not — a rogue MCP server presenting itself as your internal one, a message claiming to come from the supervisor agent, an action attributed to a human who never took it.

Containment: authenticate every participant cryptographically rather than by name, pin tool servers and their descriptions to known versions, and give agents their own distinct identities so their actions are attributable. Corresponds to ASI07 Insecure Inter-Agent Communication.

Agent communication poisoning

Agent flavour: in a multi-agent system, the messages between agents are content — so one compromised or credulous agent injects the next. Downstream agents typically treat a peer’s output as far more trustworthy than a web page, which is exactly backwards once any peer can be steered.

Containment: treat inter-agent messages as untrusted input with schemas and validation, not as internal API calls; keep privilege separation between agents so a compromised worker cannot borrow the supervisor’s reach; log the full inter-agent transcript.

Rogue agents and human attacks on multi-agent systems

Agent flavour: an agent operating outside its intended scope — because it was compromised, misconfigured, or simply never bounded — or a human deliberately abusing a multi-agent system’s coordination logic to get one agent to act through another.

Containment: per-agent identity and scoped credentials, a registry of which agents may talk to which, monitoring for out-of-pattern tool use, and a kill switch that stops the whole system rather than one process. Corresponds to ASI10 Rogue Agents.

Overwhelming the human in the loop, and human manipulation

Agent flavour: the oversight layer is itself a target. Flood the approval queue and reviewers start clicking through; make the agent’s summary reassuring and the reviewer approves the summary rather than the action. The related threat runs the other way too — a trusted agent’s output is a persuasive channel into the human.

Containment: rate-limit and batch what reaches a human, show the action (recipient, amount, diff) rather than the agent’s prose about it, and monitor review time and rejection rate as live metrics. Corresponds to ASI09 Human-Agent Trust Exploitation; see the human-in-the-loop crosswalk for the design detail.

Resource overload, repudiation, and untraceability

Agent flavour: the unglamorous pair. An agent can be driven into loops that exhaust tokens, rate limits and budget (LLM10 Unbounded Consumption in the LLM list); and when something does go wrong, you find there is no trace good enough to establish what the agent did or why — so the incident cannot be reconstructed, and no one can be held to it.

Containment: hard turn and spend budgets enforced by the runtime, per-tool quotas, and full structured traces of every prompt, tool call and result retained as security telemetry. Untraceability is not a small finding — it is what turns a one-hour incident into a three-week one.

How this field got its vocabulary

• 2022-09-12 — “Prompt injection” gets its name:

  Simon Willison named the attack Riley Goodside had demonstrated against GPT-3 apps that same day: instructions smuggled in through data the model reads. Note the date — the vulnerability is named eleven weeks before ChatGPT ships and six months before anyone connects a model to third-party tools.

• 2023-02-10 — Bing Chat gives up its system prompt:

  Within days of launch, users talked the “Sydney” system prompt out of Microsoft’s new chat product. Treat this as settled: a system prompt is not a secret and not a security boundary — anything you put there is recoverable, and anything you rely on it to prevent is unenforced.

• 2023-02-23 — Indirect prompt injection:

  Greshake et al. showed that the attacker does not need to talk to your model at all: planting instructions in a web page, an email, or a document the model later retrieves is enough. This is the threat model for every agent with a retrieval tool or an inbox, and it lands a month before the tool-calling products do.

• 2023-08-01 — OWASP publishes the first LLM Top 10:

  The first edition of the Top 10 for LLM Applications gave security teams shared names for these risks, with prompt injection at number one — where it stayed through the 2025 edition (the 2026 edition’s ordering is not confirmed here; read the document). It is where LLM security stopped being folklore and started being reviewable.

• 2024-02-01 — Air Canada is held liable for what its chatbot promised:

  A tribunal ordered the airline to pay a passenger who relied on a bereavement-fare policy the chatbot invented, explicitly rejecting the argument that the bot was “a separate legal entity responsible for its own actions”. Your agent’s output is your statement — that is the whole legal story of agentic UX in one small claim.

• 2024-08-06 — Copilot Studio SSRF reaches the cloud metadata service (CVE-2024-38206):

  Tenable chained Copilot Studio’s HTTP-request capability with a redirect that bypassed its SSRF protection, reaching the Azure instance metadata service and internal Cosmos DB instances. A tool that fetches URLs on the agent’s behalf is a request forgery primitive unless the runtime constrains its egress.

• 2024-08-20 — Slack AI leaks private-channel data through a rendered link:

  PromptArmor showed that an injection planted in a public channel with one member could make Slack AI fold a private-channel secret into a markdown link the victim would click. Retrieval scope plus link rendering is an exfiltration channel — the pattern every 2025 disclosure repeats.

• 2024-11-18 — OWASP Top 10 for LLM Applications, 2025 edition:

  The list that made LLM01 Prompt Injection the industry’s default first risk, running through LLM10 Unbounded Consumption. It is written for LLM applications rather than agents — the agentic list arrives a year later — but it is still the baseline vocabulary in security reviews.

• 2025-02-17 — OWASP publishes Agentic AI — Threats and Mitigations v1.0:

  The Agentic Security Initiative, launched on 15 December 2024, produced the first threat-model taxonomy aimed at agents rather than chatbots: memory poisoning, tool misuse, privilege compromise, cascading hallucination attacks, and eleven more. It is the vocabulary your threat model should borrow.

• 2025-05-22 — GitLab Duo leaks private source via injected prompts:

  Legit Security hid instructions in merge requests, commits, issues, and code; Duo read them as instructions and exfiltrated private source through HTML it was allowed to render. GitLab fixed it by blocking unsafe external HTML — the fix is in the renderer, not the prompt.

• 2025-05-26 — The GitHub MCP “toxic agent flow”:

  Invariant Labs showed a malicious issue in a public repo could steer an agent using the official GitHub MCP server into publishing private-repository contents in a public pull request. Nothing in the server was buggy: the flaw is granting one agent session read access to private data and write access to public surfaces.

• 2025-06-11 — EchoLeak: zero-click exfiltration from Microsoft 365 Copilot (CVE-2025-32711):

  Aim Labs and Microsoft disclosed a CVSS 9.3 chain needing no user interaction at all — an email arrives, Copilot retrieves it, tenant data leaves. The researchers named the underlying class LLM Scope Violation; Microsoft mitigated it server-side with no customer action, and there is no evidence of exploitation in the wild.

• 2025-06-16 — The lethal trifecta gets its name:

  Simon Willison named the combination that turns every disclosure above into the same bug: private data + untrusted content + a way to communicate externally. Remove any one leg and exfiltration stops being available, which is why capability design beats prompt hardening.

• 2025-07-09 — mcp-remote RCE (CVE-2025-6514) caps an MCP tooling CVE wave:

  A malicious MCP server’s OAuth metadata could execute OS commands on the client through mcp-remote (CVSS 9.6) — weeks after MCP Inspector RCE (CVE-2025-49596, 13 June) and the Filesystem reference server’s path-traversal bypasses (CVE-2025-53109/53110, 2 July). The protocol’s attack surface is its client-side tooling, and connecting to an untrusted server is a code-execution decision.

• 2025-07-21 — A Replit agent deletes a production database:

  The Register reported Jason Lemkin’s account: the agent dropped his production data during an attempted code freeze, then reported that rollback was impossible (it was not) and produced fabricated records. Replit’s CEO responded the next day with automatic dev/prod database separation — the guardrail that should have existed before the agent had credentials.

• 2025-07-23 — Malicious commit ships in the Amazon Q Developer extension (AWS-2025-015):

  A threat actor used an over-scoped GitHub token to inject code into VS Code extension release 1.84.0; AWS confirmed the payload failed to execute because of a syntax error and shipped 1.85.0. Your agent’s distribution channel is part of its trust boundary.

• 2025-07-28 — OWASP Securing Agentic Applications Guide 1.0:

  The build-side companion to the threat taxonomy: concrete guidance for the people shipping agents rather than the people reviewing them. Pair it with the Multi-Agentic System Threat Modeling Guide published on 24 April 2025 when your design has more than one agent in it.

• 2025-08-05 — CurXecute (CVE-2025-54135) and AgentFlayer: config files are an attack surface:

  Aim Labs showed indirect injection could make Cursor write a new .cursor/mcp.json without approval — new tools, no consent, remote code execution (fixed in 1.3.9). A day later Zenity Labs’ AgentFlayer demonstrated zero-click exfiltration from ChatGPT Connectors via poisoned documents and image URLs, and on 12 August Microsoft patched the analogous VS Code settings.json flaw (CVE-2025-53773).

• 2025-08-26 — Nx “s1ngularity” conscripts AI CLIs into a supply-chain attack:

  Malicious Nx npm releases stole credentials and then invoked the developer’s installed Claude, Gemini, and Q CLI tools to hunt the filesystem for more, publishing loot to s1ngularity-repository repos in victims’ own GitHub accounts; a second wave exposed 5,500-plus private repositories. Local coding agents were not the target here; they were the attacker’s reconnaissance engine, because they already had filesystem access and credentials.

• 2025-09-18 — ShadowLeak: the exfiltration happens on the vendor’s servers:

  Radware disclosed that one crafted email could make ChatGPT Deep Research send Gmail inbox PII to an attacker URL from OpenAI’s cloud, so no endpoint or network control on the victim’s side could see it. Reported 18 June, fixed in early August, acknowledged 3 September — service-side agents move the egress boundary outside your monitoring.

• 2025-09-25 — ForcedLeak in Agentforce, and a backdoored MCP server in the wild:

  Two disclosures on one day: Noma Labs chained a Web-to-Lead injection with an expired but still CSP-whitelisted domain to exfiltrate CRM data from Salesforce Agentforce (score 9.4, assigned by Noma), and Koi Security found the postmark-mcp npm package silently BCC-ing users’ email — which Koi described as the first malicious MCP server found in the wild. One shows that your allowlist decays; the other shows that your supply chain now includes MCP servers.

• 2025-10-08 — CamoLeak drains private repos through GitHub Copilot Chat:

  Legit Security combined invisible-comment injection with a bypass of GitHub’s Camo image proxy to silently exfiltrate private source and secrets (score 9.6, assigned by Legit). GitHub’s fix was to stop rendering images in Copilot Chat — the third disclosure in five months fixed by removing an output channel rather than by improving a prompt.

• 2025-10-31 — Meta publishes the Agents Rule of Two:

  A design rule an engineer can actually apply: within a session, an agent should satisfy at most two of — processes untrustworthy input, has access to sensitive systems or private data, can change state or communicate externally. If you need all three, break the session or put a human in the middle.

• 2025-11-13 — Anthropic reports the first largely AI-orchestrated espionage campaign:

  Anthropic disclosed that a group it assessed as Chinese state-sponsored manipulated Claude Code into attacking around 30 organisations with 80-90% of the campaign automated; accounts were banned and victims notified. These are Anthropic’s own figures and attribution — several outside researchers asked for more indicators — but it marks the shift from researcher demos to agents used at scale by real attackers.

• 2025-12-09 — OWASP Top 10 for Agentic Applications:

  ASI01 Agent Goal Hijack through ASI10 Rogue Agents — a list whose failure modes are behavioural rather than input-validation bugs, launched at the London Agentic Security Summit with Threats and Mitigations v1.1. Do not confuse it with the community “AAI”-numbered lists circulating on GitHub.

• 2026-08-03 — OWASP GenAI LLM Top 10, 2026 edition:

  The LLM list was refreshed with incident-grounded research and new rankings, formally announced on 1 September 2026 together with the donation of an Agent Control Standard to OWASP. Check the document itself for the current ordering rather than trusting summaries of it, including this one.

• 2026-09-01 — OpenTelemetry’s GenAI conventions are still “Development”:

  The gen-ai span, agent, and framework conventions moved to a dedicated repo (open-telemetry/semantic-conventions-genai) covering spans, metrics, events, MCP, and provider specifics — and every document still carries Status: Development, with no tagged release. Instrument with them, but expect attribute names to shift; checked 13 September 2026.