OWASP Top 10 for Large Language Model Applications, issued by OWASP Foundation, applies to anyone building llm-powered applications. This page covers what affects AI agent teams specifically and how to map controls to it.
*Source: official OWASP LLM Top 10 reference. This page is practical guidance — confirm interpretation with your counsel.*
Key dates
Current 2025 version
Key provisions for AI agents
- LLM01: Prompt Injection
- LLM02: Insecure Output Handling
- LLM03: Training Data Poisoning
- LLM04: Model DoS
- LLM05: Supply Chain
- LLM06: Sensitive Information Disclosure
- LLM07: Insecure Plugin Design
- LLM08: Excessive Agency
- LLM09: Overreliance
- LLM10: Model Theft
Who is affected
Anyone building LLM-powered applications
How Prefactor addresses it
| Provision | What it requires | How Prefactor addresses it |
|---|---|---|
| Risk management | Continuous risk management process across agent lifecycle | Eval suites, drift detection, policy versioning, tamper-evident logs, approval flows |
| Record-keeping | Automatic logging that enables traceability | Eval suites, drift detection, policy versioning, tamper-evident logs, approval flows |
| Human oversight | Effective human intervention and override | Eval suites, drift detection, policy versioning, tamper-evident logs, approval flows |
| Accuracy and robustness | Performance, robustness, attack resilience | Eval suites, drift detection, policy versioning, tamper-evident logs, approval flows |
| Post-market monitoring | Continuous performance monitoring in production | Eval suites, drift detection, policy versioning, tamper-evident logs, approval flows |
| Transparency | Documentation and information for deployers | Eval suites, drift detection, policy versioning, tamper-evident logs, approval flows |
Evidence collection
Auditors and reviewers typically expect:
- Continuous, dated evidence — not point-in-time snapshots
- Override and intervention records — proof humans actually retained control
- Eval results tied to specific agent versions
- Risk decisions tied to changes
- Incident records, even minor ones
- Plain-language documentation
Common gaps in OWASP LLM Top 10 for AI agents
1. Logs not tamper-evident — application database isn't audit evidence.
2. Human oversight is theoretical — system allows override but nobody uses it.
3. Post-market monitoring is reactive — only investigated when something breaks.
4. No change management — prompts edited in production with no record.
5. Retrieval corpus not in scope of data governance — only training data is considered.
Implementation timeline
30 days: Inventory agents in scope. Begin technical documentation. Enable comprehensive tamper-evident logging.
90 days: Operate risk management. Stand up human oversight. Establish post-market monitoring cadence. First self-assessment.
180 days: Complete documentation. Pre-conformity review. Incident reporting workflow. Full readiness.
FAQ
Does using a 'compliant' provider make us compliant? No. Deployers have independent obligations under most frameworks.
Can Prefactor make us compliant? Prefactor provides the technical and operational layer. Full compliance requires legal, organizational, and product decisions too.
Related
Get a OWASP LLM Top 10 readiness assessment
[Book a briefing →]