Threat guide
The OWASP Top 10 for LLM applications and agentic AI threats
The OWASP Top 10 for Large Language Model Applications is the reference list most security teams now use to structure a review of an AI system. Its companion work on agentic applications extends that list to systems that plan, call tools, and act without a human in every loop. This guide restates each risk in plain language, shows how it appears in a production deployment, and names the control that reduces it. It is written to be read on its own: each section stands alone and repeats the context it needs.
OWASP is an independent non-profit; this guide is our interpretation of its published categories for practitioners, not an official OWASP document, and it is not an endorsement by OWASP of GuardBotAI.
Why this list exists
Conventional application security assumes a boundary between code and data. Language models remove it. A model reads instructions and untrusted content through the same channel, so content can become command. Add tools, memory, and autonomy and a single manipulated input can produce real-world actions. The OWASP list exists because the usual controls — input sanitisation, authentication, network segmentation — are necessary but no longer sufficient on their own.
The OWASP Top 10 for LLM applications
LLM01Prompt injection
Definition. Untrusted text is written so the model reads it as an instruction and follows the attacker's intent instead of the developer's.
In production. A retrieved web page tells a browsing agent to email its context to an external address.
Control that reduces it. Runtime inspection in the request path, tool allowlists, destination allowlists, human approval for high-risk actions.
LLM02Sensitive information disclosure
Definition. The model reveals secrets, personal data, internal configuration, or another tenant's content in its output or through its context.
In production. A support assistant repeats an API key that was pasted into an earlier conversation turn.
Control that reduces it. Secret and personal-data detection with redaction before forwarding, and no raw secrets written to event records.
LLM03Supply chain risk
Definition. Compromised or unverified models, datasets, plugins, or packages introduce risk that no prompt-level control can see.
In production. An agent framework pulls a plugin that silently forwards tool arguments to a third party.
Control that reduces it. Dependency scanning, pinned versions, provenance checks, and restricting which destinations agents may reach.
LLM04Data and model poisoning
Definition. Training data, fine-tuning data, or a retrieval corpus is manipulated so the model behaves incorrectly on chosen inputs.
In production. A poisoned knowledge-base document causes the assistant to recommend an attacker-controlled endpoint.
Control that reduces it. Source control over the retrieval corpus, review of ingested content, and monitoring for output drift.
LLM05Improper output handling
Definition. Model output is passed to a downstream system without validation, turning generated text into executed code, queries, or commands.
In production. Generated SQL is executed directly against a production database.
Control that reduces it. Treat every model output as untrusted input, validate against a schema, and never execute raw output.
LLM06Excessive agency
Definition. An agent holds more permissions, tools, or autonomy than its task requires, so a single successful attack has a wide blast radius.
In production. A scheduling agent also holds delete permissions on the calendar service.
Control that reduces it. Least-privilege tool lists per project, argument validation, step and loop limits, and approval gates.
LLM07System prompt leakage
Definition. The system prompt is extracted, exposing business logic, internal rules, and sometimes credentials embedded in it.
In production. A user persuades the assistant to print its instructions verbatim.
Control that reduces it. Never place secrets in a system prompt, detect extraction patterns, and assume the prompt is public.
LLM08Vector and embedding weaknesses
Definition. Retrieval systems leak across tenants, return poisoned chunks, or allow inversion of the source text from embeddings.
In production. A shared vector index returns one customer's document to another customer's query.
Control that reduces it. Hard tenant partitioning in the index, access checks at query time, and provenance on every retrieved chunk.
LLM09Misinformation and overreliance
Definition. Confident but incorrect output is trusted and acted on because no human or system verifies it.
In production. An agent cites a regulation that does not exist and a report is issued on that basis.
Control that reduces it. Citation requirements, verification steps for consequential outputs, and explicit uncertainty handling.
LLM10Unbounded consumption
Definition. Uncontrolled inference volume, context size, or loop depth drives cost, degrades service, or enables denial of wallet.
In production. An agent enters a retry loop and spends a month's inference budget overnight.
Control that reduces it. Per-project rate and size limits, monthly quotas, loop caps, and emergency containment.
Agentic AI threats
An agentic system differs from a chatbot in one decisive way: it takes actions. That turns a wrong answer into a wrong outcome. The threats below are the ones that only appear once a system can plan, remember, delegate, and call tools.
| Threat | What it means | Control |
|---|---|---|
| Agent goal manipulation | Injected content rewrites the agent's objective so it pursues the attacker's task while appearing to work normally. | Fix the objective server-side, refuse instructions that arrive through data channels, and log every plan change. |
| Tool misuse | A legitimate tool is called with attacker-chosen arguments to reach a resource the agent should not touch. | Validate arguments against a schema, allowlist destinations, and require approval for irreversible actions. |
| Identity and privilege abuse | The agent acts with a shared or over-scoped identity, so its actions cannot be attributed or contained. | Per-agent credentials, least privilege, revocable keys, and an append-only audit log of security actions. |
| Memory poisoning | Malicious content is written into the agent's persistent memory and re-read on later runs, making the compromise durable. | Treat memory as untrusted on read, scope memory per tenant and task, and expire it. |
| Cascading multi-agent failure | One compromised agent passes manipulated output to other agents, and the failure propagates across the system. | Validate messages between agents, cap delegation depth, and provide a kill switch that stops the whole project at once. |
| Loss of human oversight | Agents run continuously after deployment with no single owner, so nobody notices behaviour change. | Named ownership per agent, continuous event recording, and alerting on decision-rate changes. |
How to run a review against this list
- Inventory. List every AI application and agent, its owner, the model it calls, the tools it holds, and the data it can reach. Most gaps are found here.
- Classify. Mark which systems can take actions and which only produce text. Action-taking systems get the tighter controls first.
- Map. Walk the ten risks and the agentic threats against each system and record whether a control exists, is planned, or is absent.
- Instrument before enforcing. Run in monitoring mode long enough to measure what a policy would have blocked, so enforcement does not break legitimate traffic.
- Enforce and evidence. Switch enforcement on, keep a tamper-evident record of decisions, and rehearse containment before you need it.
How GuardBotAI maps to these risks
GuardBotAI is a hosted runtime security layer. Applications call an OpenAI-compatible gateway with a revocable project key, and every request is evaluated before anything is forwarded.
| Risk | What GuardBotAI does today |
|---|---|
| LLM01 Prompt injection | Deterministic pattern and policy evaluation in the request path, with allow, flag, redact, or block outcomes |
| LLM02 Sensitive disclosure | Secret and personal-data detection with redaction; raw secrets never written to event records |
| LLM06 Excessive agency | Prohibited tool and action rules, destination allowlists, and emergency containment per project |
| LLM07 Prompt leakage | Extraction patterns evaluated as part of the project policy |
| LLM10 Unbounded consumption | Size limits, rate limits, and monthly request quotas enforced server-side |
| Oversight and attribution | Append-only audit log for key, policy, containment, and sensor actions, scoped per organisation |
What we do not claim. GuardBotAI does not address supply chain, poisoning, or vector-store risks — those live in your build pipeline and retrieval design, not in the request path. Our first-line engine is deterministic, not a semantic classifier. We hold no external certification and have not published a third-party penetration test. The current position, including what is still being verified, is published on the security status page.
Where to go next
Go deeper on the top risk in the prompt injection hub, check the AI security FAQ, test an adversarial prompt in the Shield console, or request an enterprise quote.