1. Home
  2. Compliance
  3. OWASP LLM Top 10 for AI Agents
Compliance Solution

Turn agent activity into OWASP LLM Top 10 evidence

Prefactor observes every agent action, evaluates quality and risk, and acts on policy at runtime — generating the evidence OWASP LLM Top 10 actually asks for, from real production data.

OWASP LLM Top 10 · at a glance
StatusVoluntary best-practices guide
JurisdictionGlobal — no jurisdiction, no enforcement
Key datesCurrent 2025 version
Updated29 June 2026
§01 / APPLICABILITYscope: where it applies
Applicability

Where it applies, and to whom.

Any team building LLM-powered applications or agents — not a law or certification, but increasingly referenced inside vendor security questionnaires and cited by emerging AI regulation as a baseline for what "reasonable" LLM security looks like.

Where it applies
🌐Global — no single jurisdiction
§02 / HOW IT MAPScoverage: requirement to evidence
Requirement to evidence

How Prefactor maps to OWASP LLM Top 10.

OWASP Top 10 for Large Language Model Applications, issued by OWASP Foundation, applies to anyone building llm-powered applications. This page covers what affects AI agent teams specifically and how to map controls to it.

Source: official OWASP LLM Top 10 reference. This page is practical guidance — confirm interpretation with your counsel.

Act
LLM01 Prompt Injection

What it requiresMalicious input subverts the agent

How Prefactor addresses itRuntime guardrails detect and block injection and out-of-policy actions before execution; traces flag anomalous inputs.

Act
LLM02 Sensitive Information Disclosure

What it requiresAgent leaks sensitive data

How Prefactor addresses itPII and sensitive-data detection in outputs, with redaction or blocking.

Act
LLM05 Improper Output Handling

What it requiresUnsafe outputs reach downstream systems

How Prefactor addresses itEval suites validate outputs; guardrails block unsafe or malformed actions before they execute.

Act
LLM06 Excessive Agency

What it requiresAgent does more than intended

How Prefactor addresses itScoped permissions and runtime enforcement; high-risk actions are routed for human approval.

Evaluate
LLM09 Misinformation

What it requiresHallucinated or wrong outputs

How Prefactor addresses itEval suites score groundedness and accuracy on real traffic; drift detection catches regressions.

Act
LLM10 Unbounded Consumption

What it requiresRunaway cost or resource use

How Prefactor addresses itCost and token tracking with limits enforced at runtime, and anomaly alerts on spend spikes.

§03 / QUESTIONSdetail: the long answers
Questions

The detail, in full.

Frequently asked questions

Does using a 'compliant' provider make us compliant?
No. Deployers have independent obligations under most frameworks.
Can Prefactor make us compliant?
Prefactor provides the technical and operational layer. Full compliance requires legal, organizational, and product decisions too.
Key provisions for AI agents
  • LLM01: Prompt Injection
  • LLM02: Insecure Output Handling
  • LLM03: Training Data Poisoning
  • LLM04: Model DoS
  • LLM05: Supply Chain
  • LLM06: Sensitive Information Disclosure
  • LLM07: Insecure Plugin Design
  • LLM08: Excessive Agency
  • LLM09: Overreliance
  • LLM10: Model Theft
Who is affected

Anyone building LLM-powered applications

Evidence collection

Auditors and reviewers typically expect:

  • Continuous, dated evidence — not point-in-time snapshots
  • Override and intervention records — proof humans actually retained control
  • Eval results tied to specific agent versions
  • Risk decisions tied to changes
  • Incident records, even minor ones
  • Plain-language documentation
Common gaps in OWASP LLM Top 10 for AI agents

1. Logs not tamper-evident — application database isn't audit evidence.

2. Human oversight is theoretical — system allows override but nobody uses it.

3. Post-market monitoring is reactive — only investigated when something breaks.

4. No change management — prompts edited in production with no record.

5. Retrieval corpus not in scope of data governance — only training data is considered.

Implementation timeline

30 days: Inventory agents in scope. Begin technical documentation. Enable comprehensive tamper-evident logging.

90 days: Operate risk management. Stand up human oversight. Establish post-market monitoring cadence. First self-assessment.

180 days: Complete documentation. Pre-conformity review. Incident reporting workflow. Full readiness.

Related

See how every agent performs, and make it better

Prefactor helps teams observe, evaluate, and improve their AI agents in production, across every framework and provider.