OWASP now publishes two top 10 lists for AI systems, and teams waste effort when they pick one, test against it, and assume the other is covered. The OWASP Top 10 for LLM Applications 2025 describes risks in applications built on a language model. The OWASP Top 10 for Agentic Applications for 2026 (published December 2025) describes risks that appear when that model plans, calls tools, keeps memory and works with other agents. This guide maps the two lists entry by entry using OWASP's own cross-references, shows what each one leaves out, and explains how to use both in threat modelling and testing. It is for application security leads, AI platform owners and assessors scoping reviews of LLM and agent systems. For each list on its own, see the OWASP Top 10 for LLM Applications Guide and the OWASP Top 10 for Agentic Applications Guide; for the programme-level shift, see Agentic AI Security vs LLM App Security.
Key takeaways
- The lists are layered, not competing. OWASP states that the agentic entries reference the LLM Top 10 because agentic applications are built as part of LLM applications. Every ASI entry cites at least one LLM entry.
- Use the LLM list for any system with a model in it, and add the agentic list as soon as the model can call tools, act across steps, keep memory or talk to other agents.
- Two LLM entries have no agentic counterpart. LLM07 System Prompt Leakage and LLM10 Unbounded Consumption are not cited anywhere in the agentic document, so an agent review that uses only the ASI list misses them.
- Some agentic risks go well beyond their LLM references. ASI07 Insecure Inter-Agent Communication, ASI08 Cascading Failures and ASI10 Rogue Agents cite LLM entries but describe multi-agent behaviour that the LLM list, built around one application, does not model.
- Test at two levels. Model-level tests (injection, output handling, disclosure) stay necessary; agent-level tests add goal persistence, tool misuse within granted rights, delegated identity, memory and multi-agent propagation.
The short answer
If the system generates text or structured output that a person or downstream code consumes, and the model cannot take actions, the LLM Top 10 is the right primary list. If the model selects and calls tools, executes multi-step plans, persists memory, or exchanges messages with other agents, use the agentic list as the primary frame and keep the LLM list as the baseline beneath it. The agentic document itself treats LLM06:2025 Excessive Agency as the bridge: it introduces "Least-Agency" as an extension of LLM06's least privilege and excessive agency concepts, advising organisations not to deploy autonomy where it adds no value.
What each list is
| Aspect | OWASP Top 10 for LLM Applications | OWASP Top 10 for Agentic Applications |
|---|---|---|
| Current edition | 2025 (successor to the 2023-24 list) | Version 2026, published December 2025 |
| Identifier format | LLM01:2025 to LLM10:2025 | ASI01 to ASI10 |
| Unit of analysis | One application built on a model: prompts, retrieval, output, extensions | An agent or system of agents: goals, plans, tools, identity, memory, peers, people |
| Harm it centres on | Manipulated, leaked or unsafe output, and resource exhaustion | Unsafe actions, persistence across sessions and propagation across agents |
| Agency | One entry (LLM06 Excessive Agency) | The organising theme of all ten entries |
| Cross-references | Stands alone | Appendix A maps to the LLM Top 10, the Agentic AI Threats and Mitigations T-codes and AIVSS core risks; Appendix C maps to the NHI Top 10 2025 |
| Incident evidence | Scenarios in each entry | Appendix D tracker of exploits and incidents from February to October 2025 |
Item-by-item mapping: agentic entries to LLM entries
The mapping below follows the LLM Top 10 references cited in each ASI entry and in Appendix A of the agentic document. The final column explains what the agentic entry adds that the cited LLM entries do not cover on their own.
| Agentic entry | LLM entries cited | What the agentic entry adds |
|---|---|---|
| ASI01 Agent Goal Hijack | LLM01, LLM06 | LLM01 concerns manipulating a single response; ASI01 covers redirecting the agent's goals, planning and multi-step behaviour |
| ASI02 Tool Misuse and Exploitation | LLM06 | Legitimate tools used unsafely within granted privileges; builds on the LLM06 mitigations and adds loop amplification and costly over-invocation |
| ASI03 Identity and Privilege Abuse | LLM01, LLM02, LLM06 | Dynamic trust, delegation and cached credentials used to reach beyond intended access |
| ASI04 Agentic Supply Chain Vulnerabilities | LLM03 | Tools, agents, plugins and registries entering the execution chain at run time, not only models and datasets at build time |
| ASI05 Unexpected Code Execution (RCE) | LLM01, LLM05 | Text turned into code that runs on hosts or containers through the agent's own tools |
| ASI06 Memory and Context Poisoning | LLM01, LLM04, LLM08 | Corruption of stored memory, summaries, embeddings or retrieval stores that biases future sessions |
| ASI07 Insecure Inter-Agent Communication | LLM02, LLM06 (Appendix A only) | Authentication, integrity and validation of agent-to-agent messages |
| ASI08 Cascading Failures | LLM01, LLM04, LLM06 | One fault compounding across agents, tools and workflows into system-wide harm |
| ASI09 Human-Agent Trust Exploitation | LLM01, LLM05, LLM06, LLM09 | People over-trusting a fluent agent and approving harmful actions |
| ASI10 Rogue Agents | LLM02, LLM09 | Malicious, compromised or drifting agents acting outside scope while each action looks legitimate |
Reverse mapping: where each LLM entry lands in the agentic list
Read the other way, the mapping shows which LLM risks multiply in agent systems and which disappear from view.
| LLM entry | ASI entries that cite it | Practical reading |
|---|---|---|
| LLM01:2025 Prompt Injection | ASI01, ASI03, ASI05, ASI06, ASI08, ASI09 | The most common initiator of agentic harm; still the first thing to test |
| LLM02:2025 Sensitive Information Disclosure | ASI03, ASI07, ASI10 | Disclosure through credentials, peer messages and rogue behaviour, not only responses |
| LLM03:2025 Supply Chain | ASI04 | Extends from models and datasets to tools, MCP servers and agent registries |
| LLM04:2025 Data and Model Poisoning | ASI06, ASI08 | Poisoned memory becomes persistent and can propagate |
| LLM05:2025 Improper Output Handling | ASI05, ASI09 | Output becomes code execution or a persuasive recommendation to a human |
| LLM06:2025 Excessive Agency | ASI01, ASI02, ASI03, ASI07, ASI08, ASI09 | The conceptual root of the agentic list; Least-Agency extends it |
| LLM07:2025 System Prompt Leakage | None | Keep in scope for agents: system prompts and agent configuration still leak, and LLM07 warns that controls such as authorisation must not be delegated to the prompt |
| LLM08:2025 Vector and Embedding Weaknesses | ASI06 | Retrieval stores become long-term agent memory |
| LLM09:2025 Misinformation | ASI09, ASI10 | Hallucination turns into a wrong action or a misled approver |
| LLM10:2025 Unbounded Consumption | None | Keep in scope for agents: loops and repeated tool calls drive cost and denial of wallet; ASI02 discusses over-invocation but does not cite LLM10 |
Per-entry depth is in the individual guides, for example the OWASP LLM Top 10 LLM07 System Prompt Leakage Guide and the OWASP LLM Top 10 LLM10 Unbounded Consumption Guide.
The LLM Top 10 in depth
Threat model and architecture
The LLM list assumes an application in which untrusted input (user prompts, retrieved documents, uploaded files) reaches a model, and the model's output reaches a user, a renderer or downstream code. Extensions exist but are treated as one risk area. The attacker's goals are to make the model say or reveal something it should not, to corrupt what it learns or retrieves, to make downstream systems trust its output, or to exhaust resources.
Where it works best
- Chat assistants, summarisers, classifiers and RAG search where output, not action, is the harm.
- Model and data supply chain review (LLM03, LLM04), which the agentic list narrows towards run-time components.
- Cost and availability (LLM10) and prompt confidentiality (LLM07), which only this list names.
Where it falls short for agents
- Persistence: it has no entry for an attack that survives across sessions through memory.
- Identity: delegation, cached credentials and inherited privileges appear only indirectly through LLM06.
- Multi-agent behaviour: peer messages, propagation and drift are outside its single-application frame.
The Agentic Top 10 in depth
Threat model and architecture
The agentic list assumes a loop: the agent receives a goal, plans, selects tools, acts with an identity, observes results, updates memory and may hand off to other agents or ask a human to approve. Every arrow in that loop is a trust boundary. The attacker's goals shift from bad output to bad action: redirect the goal, misuse a granted tool, borrow the agent's identity, plant something that persists, or exploit a human's trust in the agent.
Where it works best
- Agents with tools and write access to business systems, code repositories or infrastructure.
- Identity and privilege design, where ASI03 and the Appendix C mapping to the NHI Top 10 connect agent risk to credentials. See the OWASP Agentic Top 10 ASI03 Guide.
- Multi-agent and orchestrated systems, where ASI07, ASI08 and ASI10 describe failure modes no other OWASP list names.
Where it falls short on its own
- Model-level detail: it relies on the LLM entries for injection techniques, output handling and poisoning mechanics rather than repeating them.
- Omitted LLM risks: LLM07 and LLM10 are not referenced.
- Component inventory: Appendix B points to CycloneDX and AIBOM for provenance; the list itself is about behaviour.
Decision criteria: which list for which system
| System characteristic | Primary list | Also apply |
|---|---|---|
| Model produces text for a human; no tools | LLM Top 10 | None, unless output feeds code (then stress LLM05) |
| RAG search over internal documents, read only | LLM Top 10 | ASI06 if the index is written to by users or agents |
| Assistant with read and write tools for one user | Agentic Top 10 | LLM01, LLM02, LLM05, LLM07, LLM10 |
| Coding agent with shell or CI access | Agentic Top 10 (ASI02, ASI04, ASI05 first) | LLM01, LLM03, LLM10 |
| Multi-agent orchestration across teams or organisations | Agentic Top 10 (ASI07, ASI08, ASI10 first) | Full LLM list per agent |
| Agent that acts for customers or approves payments | Agentic Top 10 (ASI03, ASI09 first) | LLM02, LLM09 |
Small teams: start with the reverse mapping table as a single checklist; it covers all twenty entries without duplication. Large organisations: adopt the agentic list as the threat catalogue for agent platform reviews, carry LLM07 and LLM10 into it explicitly, and score findings with AIVSS, which Appendix A references. See the OWASP AIVSS Guide.
Using both lists in threat modelling
- Draw the agent loop: goal source, planner, each tool and its identity, memory stores, peer agents, approval points and outputs.
- Apply the LLM list per model boundary: every place untrusted content enters a model context and every place model output is consumed.
- Apply the agentic list per loop element: ASI01 at the goal, ASI02 and ASI05 at tools, ASI03 at identity, ASI06 at memory, ASI07 and ASI08 between agents, ASI09 at approvals, ASI10 across the whole agent over time.
- Add the two orphans: record LLM07 and LLM10 threats against the agent explicitly so they are not dropped.
- Cross-reference to ATLAS for techniques: for example AML.T0051 LLM Prompt Injection, AML.T0053 AI Agent Tool Invocation, AML.T0080 AI Agent Context Poisoning and AML.T0086 Exfiltration via AI Agent Tool Invocation. See OWASP LLM Top 10 vs MITRE ATLAS.
- Record controls once: many controls serve both lists (least privilege for tools serves LLM06 and ASI02; output encoding serves LLM05 and ASI05), so map each control to every entry it addresses.
A workshop method and template are in the AI Agent Threat Modelling Guide and the AI Agent Threat Model Template.
Using both lists in testing
| Test layer | Entries exercised | What the assessor checks (defensive framing) |
|---|---|---|
| Model input boundary | LLM01, ASI01 | Whether instructions in retrieved content change the agent's goal for one step and for later steps |
| Output handling | LLM05, ASI05 | Whether model output reaches interpreters, shells or renderers without validation |
| Tool authorisation | LLM06, ASI02 | Whether each tool call is authorised by policy outside the model, with parameter limits |
| Identity and delegation | ASI03, LLM02 | Whether tokens are per agent and audience bound, and whether user entitlements are enforced at the resource |
| Memory | ASI06, LLM04, LLM08 | Whether untrusted content can be written to memory and influence a later session |
| Inter-agent | ASI07, ASI08 | Whether peer messages are authenticated and whether one failing agent can stall or mislead others |
| Human approval | ASI09, LLM09 | Whether approvers see the real action and parameters, not only the agent's summary |
| Cost and configuration | LLM10, LLM07 | Whether loops and quotas are capped and whether prompts or configuration leak secrets |
The OWASP AI Testing Guide (version 1, published 26 November 2025) provides a testing methodology, and the OWASP GenAI Red Teaming Manual Guide covers red team planning; NHI Mgmt Group's AI Agent Security Testing Checklist and LLM Application Security Checklist turn the two lists into test cases.
Worked scenario: one incident, two lists
EchoLeak (CVE-2025-32711, disclosed 11 June 2025) involved a crafted email that Microsoft 365 Copilot later retrieved while answering an ordinary question; hidden instructions caused sensitive data to be placed in an image reference that the browser fetched. See EchoLeak 2025: The Zero-Click Prompt Injection That Could Make Microsoft 365 Copilot Leak Company Data.
- Through the LLM lens: LLM01 indirect prompt injection via retrieved content, LLM02 disclosure of internal data, LLM05 improper handling of output that the client rendered.
- Through the agentic lens: ASI01, because the assistant's task was redirected by content it retrieved; ASI03, because it acted with the user's access; ASI09 is less relevant because no human approval was involved.
- What each lens contributes: the LLM lens points to output redaction and content filtering fixes; the agentic lens points to separating untrusted content from privileged context and limiting outbound channels the assistant can reach. A full review needs both.
Detection and measurement
- Log for both lists: prompts and retrieved sources (LLM01, ASI01), tool calls with parameters and the identity used (ASI02, ASI03), memory writes with their source (ASI06), inter-agent messages (ASI07) and token and cost usage per agent (LLM10).
- Coverage metrics:
| Metric | What good looks like |
|---|---|
| Agent systems with a threat model covering all ten ASI entries plus LLM07 and LLM10 | 100% of agents with write tools |
| Test cases per entry in the release test suite | At least one per applicable entry, run on each model, prompt or tool change |
| Findings tagged with both an LLM and an ASI identifier where both apply | Consistent tagging, so trends are visible in either list |
| Tool calls authorised by policy outside the model | 100% for write and external-send tools |
| Agents with per-agent cost or call quotas | 100% |
Common failure patterns
- Swapping lists instead of layering: a team moves from the LLM list to the agentic list and stops testing output handling and disclosure.
- Dropping the orphans: LLM07 and LLM10 disappear from agent reviews because the ASI list does not cite them, then a looping agent runs up a large bill or a configuration file leaks a token.
- Treating ASI01 as LLM01 renamed: testing only single-turn injection and missing goal changes that persist across steps or sessions.
- Prompt as control: relying on system prompt instructions for authorisation, which LLM07 explicitly warns against and which ASI02 and ASI03 then exploit.
- One-agent scope in a multi-agent system: each agent passes review alone while ASI07 and ASI08 risks between them are never assessed.
- Mapping without controls: a compliance spreadsheet tags every finding with both IDs but no control is owned or tested.
Framework mapping
| Framework | Reference | How it relates to the two lists |
|---|---|---|
| NIST CSF 2.0 | ID.RA-04, ID.RA-05 | Recording and prioritising threats identified with either list |
| NIST CSF 2.0 | GV.SC-07 | Third-party tools, models and MCP servers (LLM03, ASI04) |
| NIST SP 800-53 Rev 5 | RA-3 Risk Assessment; SA-8 Security and Privacy Engineering Principles | Threat modelling and Least-Agency as a design principle |
| NIST SP 800-53 Rev 5 | SA-11 Developer Testing and Evaluation; CA-8 Penetration Testing | Test suites and assessments built from both lists |
| MITRE ATLAS | AML.T0051, AML.T0053, AML.T0080, AML.T0086, AML.T0010 | Technique-level detail behind LLM01, ASI02, ASI06 and ASI04 |
| OWASP NHI Top 10 2025 | NHI1 to NHI10 (Appendix C of the agentic list) | Credential conditions that make ASI03 and ASI10 damaging |
| OWASP AIVSS | Agentic core risks (referenced in Appendix A) | Severity scoring for agentic findings |
Practitioner checklist
- Classify each AI system: output-only, read-only retrieval, tool-using agent, or multi-agent.
- Use the LLM list as the baseline for every system with a model.
- Add the agentic list as primary for any system that calls tools, keeps memory or talks to other agents.
- Carry LLM07 and LLM10 into agent threat models explicitly.
- Threat model the agent loop, not only the model boundary.
- Tag findings with both LLM and ASI identifiers where both apply.
- Keep at least one test case per applicable entry and rerun on model, prompt or tool changes.
- Enforce tool authorisation and cost limits outside the model.
- Review the agentic list's Appendix D incidents when updating test cases.
Standards and references
- OWASP GenAI Security Project: OWASP Top 10 for Agentic Applications for 2026
- OWASP GenAI Security Project: OWASP Top 10 for LLM Applications 2025
- OWASP: Non-Human Identities Top 10 2025
- OWASP: AI Testing Guide
- MITRE: ATLAS
- OWASP: Top 10 for Large Language Model Applications project
Related NHI Mgmt Group resources: OWASP Agentic Top 10 ASI01 Guide · OWASP LLM Top 10 LLM01 Prompt Injection Guide · OWASP LLM Top 10 LLM06 Excessive Agency Guide · Top 10 MCP Security Risks · AI Red Teaming Guide