Skip to main content

The OWASP Top 10 for LLM Applications: What Agent Operators Need to Know

The OWASP Top 10 for LLM Applications is the closest thing the AI security community has to a shared threat model. Published in its second major revision in 2025, it catalogs the ten most critical vulnerabilities in systems built on large language models.

But here is the problem: the list was written for LLM applications — chatbots, summarizers, copilots. If you are operating autonomous agents that call tools, chain decisions, and act on external data without human approval, every risk on the list hits harder and in ways the original descriptions do not fully capture.

This guide maps each OWASP LLM risk to the realities of agent operations. What does each vulnerability actually look like when your LLM has a database connection, a payment API, and the ability to spawn sub-agents?

LLM01: Prompt Injection

The OWASP description: Manipulating an LLM through crafted inputs to cause unintended actions.

What it means for agents: This is not a chat problem — it is a control-flow problem. When an agent processes data from external sources (scraped webpages, emails, uploaded documents), any of those sources can embed instructions the agent will follow. The attacker never touches your API directly. They poison the data your agent reads.

A state-sponsored operation in September 2025 used prompt injection through Claude Code to compromise approximately 30 organizations across technology, finance, government, and manufacturing sectors. The AI carried out 80-90% of the operation autonomously.

What to do: Treat every external input as potentially hostile. Parse implements layered detection — 28 pattern-matching rules covering prompt injection, jailbreak, data exfiltration, privilege escalation, social engineering, and code execution categories, plus structural analysis for obfuscation techniques (base64 encoding, mixed scripts, padding attacks), plus LLM-based deep analysis for borderline cases that pattern matching misses.

LLM02: Sensitive Information Disclosure

The OWASP description: Inadvertent revelation of sensitive data through LLM responses.

What it means for agents: An agent's context window is effectively a credential store. System prompts contain operational logic, API endpoints, internal tool names, and sometimes literal API keys. Agents that access databases carry query results — including PII — in their working memory.

Data exfiltration can begin within 4 minutes of an agent being compromised. In the fastest documented case, attackers went from initial access to full exfiltration in 72 minutes. The Supabase Cursor Agent exploit demonstrated this directly: attackers embedded SQL in support ticket text, and a privileged agent processed it as commands, reading sensitive integration tokens and leaking them into public threads.

What to do: Parse checks for system prompt leakage by detecting when LLM output contains fragments of the system prompt (matching the first 50 characters). But detection alone is insufficient — architect your agents so that no single agent has access to both sensitive data and external communication channels simultaneously.

LLM03: Supply Chain Vulnerabilities

The OWASP description: Risks from third-party components, training data, and plugins.

What it means for agents: The agent supply chain is actively under attack. An audit of 2,890+ OpenClaw skills found that 41.7% contained serious security vulnerabilities — the largest confirmed supply chain attack on AI agent skill infrastructure. The Smithery registry compromise in October 2025 exposed API tokens across 3,000+ hosted applications. CVE-2025-6514 demonstrated that a malicious MCP server could achieve remote code execution on client machines through a command injection in the authorization flow.

Of 8,000+ MCP servers scanned in February 2026, 36.7% were vulnerable to SSRF attacks and 43% had command injection flaws. 492 servers were directly vulnerable to abuse.

What to do: Audit every skill, plugin, and MCP server your agents connect to. Pin versions. Validate MCP server authentication. Assume that community registries contain hostile code — because statistically, they do.

LLM04: Data Poisoning

The OWASP description: Manipulation of training data to introduce vulnerabilities.

What it means for agents: For agents, the more dangerous variant is memory poisoning — injecting false or malicious instructions into an agent's long-term storage. Unlike prompt injection that ends with the session, poisoned memory persists. The agent "learns" the malicious instruction and recalls it days or weeks later, making the attack invisible to session-level monitoring.

RAG-augmented agents face a related vector: vector/embedding poisoning (OWASP LLM08:2025), where attackers corrupt the vector database to surface malicious content during retrieval.

What to do: Version and audit agent memory writes. Treat persistent storage with the same security posture as a database — because for your agent, it is one.

LLM05: Improper Output Handling

The OWASP description: Insufficient validation of LLM outputs before passing to downstream components.

What it means for agents: Agent outputs go directly into tool calls, API requests, database queries, and decisions that trigger other agents. Parse's /v1/parse endpoint can run prompts in a sandboxed execution environment and then analyze the output for risks — checking whether the generated text itself contains injection patterns, system prompt leakage, or harmful content. This second-pass output analysis is critical because an injection that survives to the output of one agent becomes the input of the next.

What to do: Validate agent outputs at every boundary. Parse provides output risk scoring through its execute: true mode, which sandboxes the prompt, runs it, and scans the result before it reaches downstream systems.

LLM06: Excessive Agency

The OWASP description: Granting LLMs too much autonomy, functionality, or permissions.

What it means for agents: This is the single most common real-world agent incident type, with 520+ tracked cases. Agents are typically granted the union of all tool permissions but lack the judgment to self-restrict. An agent with read/write database access, email sending, and file system access has a blast radius that includes data destruction, exfiltration, and lateral movement — all from a single compromised prompt.

Parse's API key system implements scope-based access control with four defined scopes (analyze, evaluate, chat, admin), rate limiting per key, and timing-safe key comparison. The principle: no agent should have capabilities it does not need for its current task.

What to do: Implement least-privilege access per agent, per task. Rotate API keys. Define explicit scopes. Parse's scoped key model demonstrates the pattern: the demo key cannot access admin functions, and rate limits prevent runaway consumption even if a key is compromised.

LLM07: System Prompt Leakage

The OWASP description: Risk of revealing system prompts containing sensitive information.

What it means for agents: Agent system prompts are higher-value targets than chatbot prompts because they contain tool configurations, API routing logic, and operational parameters. Parse detects five distinct extraction patterns — direct reveal requests, instruction queries, full prompt extraction, repeat-back attacks, and output system prompt commands — each scored by severity.

What to do: Detect extraction attempts at the input layer. But more importantly, do not put secrets in system prompts. Use environment variables and secure configuration management for API keys and credentials, and treat the system prompt as a document that will eventually be read by an adversary.

LLM08: Vector and Embedding Weaknesses

The OWASP description: Vulnerabilities in RAG systems and vector databases.

What it means for agents: Agents that use RAG for context retrieval trust their vector database implicitly. If an attacker can insert or modify embeddings, they control what context the agent retrieves — and therefore what decisions it makes. This is a new entry in the OWASP 2025 revision, reflecting the rapid adoption of RAG in production agent architectures.

What to do: Validate the provenance of documents entering your vector store. Monitor for anomalous embedding insertions. Consider content integrity checks before retrieval results reach the agent's context window.

LLM09: Misinformation

The OWASP description: LLMs generating false or misleading content.

What it means for agents: In multi-agent systems, a hallucination does not stay contained — it propagates. One agent generates a false claim, the next agent treats it as fact and acts on it, and downstream agents inherit the error with compounding confidence. OWASP's Agentic Top 10 identifies this cascading failure pattern as ASI08.

Parse's multi-agent analysis pipeline addresses this with 10 specialized agents — including a deception detection agent, fallacy detection agent, evidence quality assessor, fact-checker, and bias analyst — each validating claims independently before synthesis. Layered multi-agent verification catches errors that single-model evaluation misses.

What to do: Build verification into your pipeline, not just at the end. Use structurally different evaluation methods at each stage. Parse's quality evaluator checks for repetition, relevance, and error patterns as independent heuristic signals.

LLM10: Unbounded Consumption

The OWASP description: Allowing excessive resource usage through uncontrolled LLM interactions.

What it means for agents: Autonomous agents can self-loop without human intervention. An attacker — or a simple bug — can trigger runaway API calls, infinite tool chains, or excessive token consumption. The financial damage from unbounded consumption is OWASP's "Denial of Wallet" scenario, and it is particularly acute for agents that operate on billing accounts with high or no spending limits.

Parse implements per-key rate limiting by tier (free keys default to 10 requests per minute) with X-RateLimit-Remaining headers for client-side awareness and Retry-After headers when limits are hit. Cost evaluation tracks per-request spend across model pricing tiers.

What to do: Set hard rate limits and budget caps per agent. Monitor cost per request. Parse's cost evaluator calculates exact per-request costs by model, giving operators real-time visibility into spending before it becomes a problem.

Beyond the LLM Top 10: The Agentic Top 10

The OWASP Top 10 for LLM Applications provides the foundation, but if you are operating autonomous agents, you also need the OWASP Top 10 for Agentic Applications, published in December 2025. Developed with 100+ industry experts and reviewed by NIST, the European Commission, and the Alan Turing Institute, it covers agent-specific risks that the LLM list does not:

NIST launched its own AI Agent Standards Initiative in February 2026, with research into agent authentication infrastructure and multi-agent interaction security. Federal guidance is coming. The question is whether your agents are ready.

The Compliance Minimum vs. Actual Security

The OWASP Top 10 is a floor, not a ceiling. Only 29% of organizations report readiness to secure agentic AI. 80% report risky agent behaviors, and only 21% have visibility into what permissions their agents actually use.

Compliance checklists will not protect your agents. Layered detection, scoped permissions, output validation, and continuous monitoring will. Parse provides the detection layer — pattern matching, structural analysis, LLM-based deep analysis, and sandboxed execution — so you can check every prompt before your agent acts on it.

Your agents are already running. The question is whether you know what they are doing.

References