OWASP Top 10 for LLMs and agents
The OWASP GenAI Security Project's lists are the most widely used catalogue of what goes wrong in LLM and agent systems. Here is each risk as it appears across a whole AI factory, not just at the model, and what answers it.
LLM applications, 2025 edition
Ten risks, each with the bands that close it. Tags link to the band that does the work.
- LLM01
Prompt injection
Input that changes what the model does: typed by a user (direct), or hidden in a web page, email or document the model reads (indirect).
Across the AI factory
Every surface that feeds text to a model is an entry point: chat, API calls, retrieved documents, tool results and other agents.
How Kronos Lab answers it
Authorization runs before inspection. Injection and jailbreak classifiers score every prompt before it reaches a GPU, retrieved content is scanned at ingest, and agent tool calls are checked against an allow-list so a successful injection still can't act.
Evidence it leaves
A block record per refused call with the rule, score and session, and red-team runs showing which injection classes are covered.
- LLM02
Sensitive information disclosure
The model reveals personal data, secrets or confidential content in its answers, from training data, context or connected systems.
Across the AI factory
Sensitive data enters through RAG corpora, fine-tuning sets, prompts and tool results, and leaves through responses and logs.
How Kronos Lab answers it
PII is found and redacted, masked or rejected at ingest under a per-tenant policy. Content is encrypted under your keys before it becomes an embedding. Output filters check responses for PII and secrets on the way out.
Evidence it leaves
Per-batch PII counts and actions, key-usage records from your KMS or HSM, and output-filter decisions.
- LLM03
Supply chain
Compromised models, adapters, datasets, packages or plugins enter the system from third parties.
Across the AI factory
Models from public hubs, fine-tunes from your own team, container images, Python dependencies, agent skills and MCP servers.
How Kronos Lab answers it
Every artifact is scanned for malware, unsafe serialization and CVEs, described in an ML-BOM, signed with Sigstore and registered. A promotion gate admits only what is signed, scanned and described. Agent skills and MCP servers are verified before registration.
Evidence it leaves
ML-BOM with in-toto scan attestations, signatures logged to a transparency log, and the gate decision for every promotion.
- LLM04
Data and model poisoning
Training, fine-tuning or retrieval data is manipulated to plant backdoors, bias or wrong answers.
Across the AI factory
Poison can arrive in a pre-trained model, a fine-tuning set or, most cheaply, a document added to a knowledge base.
How Kronos Lab answers it
Every document is traced to a signed, approved source before it is indexed, and unverified sources are held. Weights are scanned on intake and the ML-BOM records the datasets a model was built from.
Evidence it leaves
Signed dataset manifests, provenance per chunk, and hold records for unverified sources.
- LLM05
Improper output handling
Model output is passed to other systems (browsers, shells, databases) without validation, enabling XSS, injection or code execution.
Across the AI factory
Agents turn output into actions: tool calls, queries, file writes and messages to other agents.
How Kronos Lab answers it
Responses pass an output filter before they leave the gate. Tool calls are checked against the agent's policy and run inside a sandbox, so output becomes an action only when policy allows it.
Evidence it leaves
Output-filter decisions and every tool call with its allow or deny verdict.
- LLM06
Excessive agency
An agent has more functions, permissions or autonomy than its task needs, so a manipulated agent can do real damage.
Across the AI factory
Agents connect to tools, MCP servers, models and data. Each connection is a permission.
How Kronos Lab answers it
Each agent gets a workload identity (SPIFFE/SPIRE). Allowed tools, models, data classes and network destinations bind to that identity, and access is mediated per task. Egress is denied by default.
Evidence it leaves
The policy bound to each agent identity, and a trace of every tool and inference call it made.
- LLM07
System prompt leakage
Instructions or secrets in the system prompt are extracted by an attacker, exposing logic or credentials.
Across the AI factory
System prompts often carry business rules, tool descriptions and, wrongly, credentials.
How Kronos Lab answers it
Extraction attempts are classified on the way in and refused. Output is filtered for secrets. Credentials belong in the identity layer, not in prompts, and agents authenticate with their own identity.
Evidence it leaves
Refusal records for extraction attempts and red-team runs against leakage probes.
- LLM08
Vector and embedding weaknesses
Weaknesses in how embeddings are generated, stored or retrieved let an attacker inject content, leak data across tenants or invert embeddings back into text.
Across the AI factory
RAG stores hold the organisation's knowledge, often for many tenants in one database.
How Kronos Lab answers it
Nothing writes to the index directly: a policy gate checks the batch is scanned, clean, signed and encrypted. Collections are tenant-scoped, vectors are stored as ciphertext and queries are encrypted, so the database never sees plaintext.
Evidence it leaves
Vector-gate decisions per write, collection ACLs, and key-usage records.
- LLM09
Misinformation
The model produces false or misleading content that appears credible, and people or systems act on it.
Across the AI factory
Answers drawn from stale or unapproved documents, or from a model that has drifted.
How Kronos Lab answers it
Retrieval is limited to signed, approved document versions, so every answer traces to a source. Drift is tracked against a reference window and raised as a signal alongside security events.
Evidence it leaves
Provenance on every retrieved chunk and drift reports over time.
- LLM10
Unbounded consumption
Excessive or uncontrolled inference: denial of service, runaway cost, or model extraction through volume.
Across the AI factory
Shared GPUs, per-token billing and agents that loop.
How Kronos Lab answers it
Rate limits, token ceilings and cost budgets are checked per tenant before inference. Agents run with runtime limits, and latency and volume are watched on the same stream as security events.
Evidence it leaves
Rate-limit and budget decisions per tenant, and volume metrics in the audit stream.
Agentic applications, 2026 edition
Published in December 2025 for systems that plan, use tools and act on their own. Agents are where a prompt becomes an action, so most of these are answered by identity, policy and isolation.
| Risk | Name | How Kronos Lab answers it |
|---|---|---|
| ASI01 | Agent goal hijack | Guardrails on every input the agent reads, including tool results and retrieved content; policy on what it may do next. |
| ASI02 | Tool misuse | Per-agent tool allow-lists, mediated MCP access and a trace of every call. |
| ASI03 | Identity and privilege abuse | SPIFFE/SPIRE workload identity with short-lived credentials; permissions bound to identity, not environment. |
| ASI04 | Agentic supply chain | Skills and MCP servers verified before registration; signed agent packages with an SBOM. |
| ASI05 | Unexpected code execution | Sandboxed execution with a read-only filesystem, restricted runtime and an egress proxy. |
| ASI06 | Memory and context poisoning | Governed, tenant-scoped retrieval from signed sources; context isolation between sessions. |
| ASI07 | Insecure inter-agent communication | Mutual TLS between attested workloads; every message carries an identity. |
| ASI08 | Cascading failures | Policy at each boundary bounds the blast radius; violations raise incidents before they chain. |
| ASI09 | Human-agent trust exploitation | Reason codes on every decision and a full record of what the agent did, for review. |
| ASI10 | Rogue agents | Only registered agents run; behaviour outside policy is denied, logged and raised to the SOC. |
Agent controls run in the prompts, APIs and agents band today. A dedicated band for agents and MCP gateways is in development.