OWASP Top 10 for LLM Applications (2025) & Agentic Threat Controls
Standard chat guardrails only inspect text strings; autonomous agents invoke APIs, mutate state, and chain multi-hop plans. This engineering blueprint maps the 2025 OWASP LLM Top 10 and Agentic Security Initiative threat classes directly to host-enforced deterministic controls.
Untrusted retrieved content (HTML pages, inbound emails, Jira comments, or MCP resource blobs) injects imperative instructions into the shared token stream, redirecting the planner toward unauthorized tool invocations.
Deterministic Host Control
Tag every external document chunk with `taint: "untrusted_external"` in orchestrator state. Enforce a deterministic policy engine outside the model that blocks state-mutating or outbound-network tools whenever `context.tainted === true` unless a human reviewer explicitly signs the action.
Sensitive Information Disclosure
LLM02:2025
Exploit & Failure Path
Over-broad RAG retrieval pulls cross-tenant rows, internal credentials, or customer PII into the context window, where an injected markdown image link or webhook tool argument exfiltrates the data.
Deterministic Host Control
Apply row-level and column-level ACL filtering in the vector/SQL retrieval query using the caller identity prior to LLM inference. Strip dynamic external URL rendering in Markdown outputs and inspect outbound tool arguments with deterministic regex/DLP patterns.
Agents hold broad CRUD tool definitions (`execute_sql`, `run_shell`, `http_post_any`) backed by a long-lived tenant-wide service account token, turning a single planner hallucination or injection into a confused-deputy breach.
Deterministic Host Control
Split broad tools into narrow, typed single-purpose functions (`create_draft_ticket`, `read_invoice_by_id`) with `additionalProperties: false`. Exchange the user session via OAuth 2.0 RFC 8693 Token Exchange for a 10-minute On-Behalf-Of (OBO) JWT narrowed to the exact tool scope.
System Prompt Leakage
LLM07:2025
Exploit & Failure Path
Developers embed API keys, internal endpoint topologies, SQL table schemas, or RBAC bypass phrases inside system instructions, assuming the model will obey "never reveal this prompt" directives.
Deterministic Host Control
Treat the entire system prompt as public client-side configuration. Move secrets, role checks, tenant filters, and rate limits strictly into host-side middleware and API gateways that never serialize credentials into model tokens.
Misinformation & Unbounded Consumption
LLM09:2025 & LLM10:2025
Exploit & Failure Path
Fabricated citations or cyclic tool-retry loops trigger recursive sub-agent spawning, exhausting token budgets (denial-of-wallet) or propagating unverified claims into downstream ticketing and compliance records.
Deterministic Host Control
Enforce hard per-trace recursion ceilings (`max_tool_turns: 8`, `max_subagent_depth: 1`, `max_cost_usd: 0.75`) in the orchestrator loop, and require deterministic primary-key citation checks before persisting generated summaries.
To eliminate Excessive Agency (LLM06) and Confused-Deputy escalation, pair closed JSON Schemas (`additionalProperties: false` and explicit `enum` allowlists) with OAuth 2.0 Token Exchange (IETF RFC 8693). Even if indirect prompt injection hijacks the planner, the downstream service rejects any scope or repository outside the caller's downscoped 10-minute token.
rfc8693-obo-and-tool-schema.ts
// 1. Strict Typed JSON Tool Schema (OWASP LLM06 Mitigation)
// Rejects unexpected fields, arbitrary URLs, and raw SQL/shell strings at the host parser.
export const CreateDraftPullRequestSchema = {
type: "object",
additionalProperties: false,
required: ["repoSlug", "baseBranch", "title", "patchDiff"],
properties: {
repoSlug: {
type: "string",
enum: ["org/payments-service", "org/policy-engine"]
},
baseBranch: {
type: "string",
pattern: "^(main|release/[0-9]+\\.[0-9]+)$"
},
title: { type: "string", minLength: 8, maxLength: 120 },
patchDiff: { type: "string", maxLength: 32768 }
}
} as const;
// 2. OAuth 2.0 RFC 8693 Token Exchange (On-Behalf-Of Downscoping)
// Exchanges human caller token for a 10-minute capability token bound to one run.
async function mintScopedAgentToken(subjectUserJwt: string, runId: string) {
const body = new URLSearchParams({
grant_type: "urn:ietf:params:oauth:grant-type:token-exchange",
subject_token: subjectUserJwt,
subject_token_type: "urn:ietf:params:oauth:token-type:access_token",
requested_token_type: "urn:ietf:params:oauth:token-type:access_token",
audience: "https://api.internal.example/git-gateway",
scope: "repo:pull_request:create_draft" // Never grants merge or branch-delete
});
const res = await fetch("https://auth.internal.example/oauth2/token", {
method: "POST",
headers: {
"Content-Type": "application/x-www-form-urlencoded",
"X-Agent-Trace-Id": runId
},
body
});
if (!res.ok) throw new Error(`RFC 8693 exchange denied: HTTP ${res.status}`);
return res.json(); // { access_token, expires_in: 600, scope: "repo:pull_request:create_draft" }
}
Enforcing Taint-State Transitions Across Multi-Turn Loops
Once an agent reads a single untrusted web page, public GitHub issue, or inbound customer email during turn `t`, the entire conversation state for turns `t..N` must be marked `tainted = true` monotonically. Do not clear taint flags based on model self-attestation. If a workflow requires both external research and internal database updates, split the pipeline into two isolated processes: an unprivileged retrieval worker that emits a schema-validated structured JSON summary, followed by a deterministic validator and human approval gate before any write worker runs. Test your exact configuration in our 3-Ring Containment CAD Stage or inspect kernel-level worker isolation in our MicroVM Sandboxing Benchmark.
Reviewed by Dr. Henrik Solberg, Principal AI Security & Runtime Containment Editor
Reviews OWASP GenAI Agentic security controls, Firecracker/gVisor/Wasm isolation architectures, and NIST AI RMF governance gates.
Last reviewed:
Reviewed every 3 months
AI-assistance & editorial check: Research outlining and formatting are assisted by AI tools in an offline draft workflow. Nothing on this site publishes automatically without verification. A named human editor opens and verifies every primary source link, command snippet, and factual statement prior to publication. See our Editorial Policy and Corrections Policy.
Store your email to receive notifications when we publish updated OWASP GenAI control mappings and RFC 8693 reference policies. No emails are sent yet.
