OWASP for LLMs and Agents: Understanding the New AI Attack Surface

When OWASP published its first Top 10 for Large Language Model Applications in August 2023, most LLM applications were chatbots. Eighteen months later, applications retrieve from enterprise data, call tools, keep memory and increasingly act as agents. The guidance has evolved to match.

• In November 2024, the OWASP GenAI Security Project released the 2025 edition of the LLM Top 10.
• In February 2025, it published Agentic AI: Threats and Mitigations, a threat taxonomy specifically for agentic systems.

Here is what security and engineering teams need to know.

#The 2025 LLM Top 10

Three themes stand out:

1. RAG is now central. Vector and embedding weaknesses get their own entry, recognising that retrieval is where many real leaks happen.
2. System prompts are not secret. Treat them as public: no credentials, no sensitive business logic that relies on staying hidden.
3. Cost is a security issue. Unbounded consumption covers attacks that drain budgets or overload services, not just ones that take them down.

#The agentic threat taxonomy

The agentic guide focuses on what changes when LLMs plan, remember, use tools and work with other agents. Its threats include:

• Memory poisoning: corrupting short- or long-term memory so the agent acts on false information or standing malicious instructions.
• Tool misuse: manipulating an agent into using legitimate tools in harmful ways.
• Privilege compromise: exploiting over-broad or inherited permissions.
• Resource overload: driving agents into expensive or endless work.
• Cascading hallucination attacks: errors that compound across steps or across agents.
• Intent breaking and goal manipulation: redirecting what the agent is trying to achieve.
• Misaligned and deceptive behaviours: agents taking harmful actions while appearing to comply.
• Repudiation and untraceability: actions that cannot be attributed or reconstructed.
• Identity spoofing and impersonation: attackers or agents posing as users or other agents.
• Overwhelming the human in the loop: flooding reviewers with approvals until oversight becomes rubber-stamping.
• Unexpected code execution: agents generating and running code with harmful effects.
• Agent communication poisoning and rogue agents in multi-agent systems.
• Human manipulation: agents being used to deceive the people who trust them.

flowchart TB
  subgraph LLM["LLM Top 10: the model-centred application"]
    PI[Prompt injection]
    OUT[Output handling]
    RAG[Vector & embedding]
    SPL[System prompt leakage]
  end
  subgraph AG["Agentic threats: what autonomy adds"]
    MEM[Memory poisoning]
    TOOL[Tool misuse & privilege]
    ID[Identity & repudiation]
    MA[Multi-agent & rogue agents]
    HITL[Overwhelmed human oversight]
  end
  LLM --> AG

#Using the lists well

For threat modelling. Walk through each entry for a specific application. Does it retrieve data? Can it call tools? Does it keep memory? Which entries apply, and what would the impact be here?

For test planning. Map each applicable entry to test cases, for example cross-user retrieval for LLM08, tool misuse scenarios for excessive agency, and memory poisoning attempts for agents.

For design reviews. Use the mitigations as a checklist of architectural questions: where is authorisation enforced, what can the agent do without approval, how are actions logged?

Not as a compliance checkbox. The lists describe categories of risk, not a complete set of requirements. An application can "address" every item and still be insecure if the design does not fit its context.

#Practical mitigations that cover many entries at once

• Least privilege for tools and data, enforced in code rather than prompts (excessive agency, privilege compromise, sensitive information disclosure).
• Permission-aware retrieval (vector and embedding weaknesses, disclosure).
• Human approval for high-impact actions, designed so approvals stay meaningful (excessive agency, overwhelming human oversight).
• Treating all model inputs and outputs as untrusted (prompt injection, output handling, memory poisoning).
• Budgets and rate limits (unbounded consumption, resource overload).
• Complete, attributable logging of prompts, tool calls and decisions (repudiation, incident response).
• Supply-chain controls for models, datasets and tools (supply chain, poisoning).

#The bottom line

OWASP's 2025 guidance reflects how quickly LLM applications have grown up: from chatbots to retrieval systems to agents with memory and tools. Use the LLM Top 10 and the agentic threat taxonomy together as a shared language across security and engineering teams, and as the backbone of threat models and test plans for every AI feature you build.

Our application security testing maps every AI engagement to the OWASP LLM Top 10 and agentic threat taxonomy, and our security training teaches development teams to apply them.