Compliance OWASP

OWASP Top 10 lists for LLM and agentic applications

Not legal advice, and not a claim that Tracekit removes any of these risks (about these pages).

Scope

OWASP's GenAI Security Project publishes community lists of the most important security risks in applications built on large language models. The OWASP Top 10 for LLM Applications 2025 was released in November 2024. A 2026 edition was published on 3 August 2026 and renumbers the entries; each row gives the 2026 ID next to the 2025 one, but quotes and paraphrases come from the 2025 text. The OWASP Top 10 for Agentic Applications for 2026, from the project's Agentic Security Initiative, was released on 9 December 2025 and covers risks specific to agents. The lists bind no one: they are awareness documents whose IDs security reviews and questionnaires use. Each row starts with Tracekit's role: mitigates in part (it can stop or hold some of the actions the risk leads to) or records (it gives evidence but doesn't reduce the risk). Risks it doesn't address are listed under Not covered.

Mapping: OWASP Top 10 for LLM Applications 2025

Requirement	What Tracekit provides	Evidence to show	Your responsibility / limits
LLM01:2025 Prompt Injection (2026: LLM01). Prompts alter the model's behaviour or output in unintended ways; OWASP's mitigations include least privilege, human approval for high-risk actions, and segregating untrusted content.	Mitigates in part, for the tool calls an injection leads to. The signer decides each routed call before it runs, with a policy the agent can't change; ask rules hold high-risk actions for a person (policy). Provenance rules (experimental) hold an email, a payment or data sent to a target that only untrusted content brought into the run (policy).	Held and denied decisions; a decision's provenance (argument, kind of value, the record it came from).	Detecting the injection itself, and what the model says. Provenance matches values verbatim, so a paraphrased value gets past it, and its trust labels are the calling process's claim. Rules are tripwires (limits).
LLM02:2025 Sensitive Information Disclosure (2026: LLM02). Sensitive information (personal data, financial details, credentials, confidential business data) is exposed through the model or its application; mitigations include least-privilege access and redaction.	Mitigates in part, for secrets in tool calls. The packs deny a secret in any tool's arguments (TK-S002, TK-S003), credential files (TK-S004), sending credential files off the machine (TK-D011) and a request body to a host outside the allowlist (TK-N002) (packs). The signer redacts known secret patterns in results before it commits to them, and records keep commitments, not content (privacy).	Denied decisions by rule id; redaction manifests on tool.result records.	What the model tells users. Redaction is pattern-based and misses secrets it doesn't recognise. Every path the agent may use, the model gateway included, can carry data out hidden in ordinary requests (guarantees).
LLM05:2025 Improper Output Handling (2026: LLM10). Model output passed downstream without enough validation; mitigations include logging and monitoring.	Mitigates in part, where output becomes a tool call. The signer decides over the raw arguments: SQL is read as PostgreSQL, MySQL, SQLite and SQL Server would read it, shell lines are parsed, and a statement or command it can't read is held for a person (TK-SQL-PARSE, TK-SHELL-PARSE) (policy). Every decision is signed.	Decisions; the args source report line (raw, parsed, coerced).	Output rendered in a browser or passed to components outside a tool call; validating and encoding output.
LLM06:2025 Excessive Agency (2026: LLM03). Damaging actions follow from unexpected, ambiguous or manipulated model output; root causes are excessive functionality, permissions and autonomy. Mitigations include minimising extensions and their permissions, requiring user approval, and complete mediation in downstream systems; logging, monitoring and rate limiting limit the damage.	Mitigates in part. Each routed call is decided by a policy outside the model, and the server pack holds tools it doesn't know (unknown_tools: ask). An ask is a person's approval, bound to the exact arguments and used once (approvals). The tool executor and MCP gateway keep credentials out of the agent (experimental, executor). Detection limits count calls per window, such as TK-L001 for a runaway loop (experimental). Every call and decision is in the signed log.	Decisions; approval records; T2 records naming the service in via; incident records.	Giving the agent only the tools and permissions it needs. Calls that skip the adapter aren't mediated (T1), and custody covers only actions routed through the executor and gateways (limits). OWASP counts logging and rate limits as damage limitation, not prevention.
LLM10:2025 Unbounded Consumption (2026: LLM06). Excessive, uncontrolled inference leads to denial of service, cost, model theft or degraded service; mitigations include rate limits, quotas and monitoring.	Mitigates in part, for tool calls; records model usage. With an enforced respond rule, a detection limit holds or quarantines a run that goes past a count or a sum in a window (experimental, policy). The LLM gateway records each exchange's usage (experimental, gateway).	Incident records; model.exchange records with usage.	Quotas and cost limits on model calls, and protecting the model service. Tracekit enforces neither.

Mapping: OWASP Top 10 for Agentic Applications for 2026

Requirement	What Tracekit provides	Evidence to show	Your responsibility / limits
ASI01 Agent Goal Hijack. Agents can't reliably tell instructions from content, so an attacker can redirect their goals. Mitigations include least privilege for tools and human approval for high-impact or goal-changing actions.	Mitigates in part, for the actions a hijacked agent takes: as for LLM01, policy decisions, approvals and provenance rules (experimental). Detection sequences flag a pattern across calls, such as a secret read followed by egress (TK-Q001, experimental).	Decisions, approvals, incident records.	Tracekit sees actions, not goals or plans. tracekit why (experimental) can find afterwards which input caused an action, by replay (why).
ASI02 Tool Misuse and Exploitation. Agents misuse legitimate tools through prompt injection, misalignment or unsafe delegation. Mitigations include per-tool least privilege with egress allowlists, action-level approval, a pre-execution policy enforcement point that validates intent and arguments, immutable logs of every tool invocation, and monitoring unusual tool chains.	Mitigates in part. The signer is a pre-execution decision point for every routed call, over its raw arguments. Approvals are bound to exact arguments: edited ones are refused, and the executor runs exactly the approved ones (experimental). Every invocation and decision is signed and chained. TK-N002 denies a request body to a host outside the allowlist; detection sequences catch chains such as a secret read then egress (experimental).	Decisions, approvals, the run's bundle, incident records.	Tamper-evident is not immutable: a deletion shows, it isn't prevented (limits). Rules match text. Tracekit doesn't sandbox the tool.
ASI03 Identity and Privilege Abuse. Agents escalate access through delegation chains, role inheritance and shared context; without its own governed identity, an agent's actions can't be attributed. Mitigations include per-agent identities, short-lived credentials and human approval for privilege escalation.	Mitigates in part. Each run is registered by an authenticated identity, recorded on run.registered; run tokens are bound to tenant, run and identity; a principal is recorded as attested or app-asserted (identity). The packs deny privilege escalation (TK-D001) and IAM changes (TK-C001). On a signer started from signer.yaml, a requester can't approve its own call unless the config allows it. Credentials can stay in the executor and gateways (experimental).	run.registered (caller identity, principal, principal_attested); decisions.	Issuing per-agent, short-lived credentials. An identity proves the workload, not the end user, unless the principal is attested. The signer can't tell a real event from a well-formed fake sent with the agent's identity (limits). The HTTPS identities (mTLS, Kubernetes service account, OIDC) are experimental.
ASI04 Agentic Supply Chain Vulnerabilities. Agents, tools and related artefacts from third parties may be malicious, compromised or tampered with.	Records, for MCP tools. The MCP gateway records each upstream's tool, resource and prompt listings as untrusted input and decides every call (experimental, MCP gateway). The server pack holds an MCP tool that takes a command (TK-S010).	input.observed records of tool listings; decisions on mcp: tools.	Verifying where tools, models and packages come from (signatures, SBOMs). A stdio upstream runs as the gateway's own user.
ASI05 Unexpected Code Execution (RCE). Attackers turn code generation or tool access into code execution.	Mitigates in part, for shell and code reaching a tool call. The packs deny running a downloaded script (TK-D002) and SQL that reaches the server's shell or files (TK-DB005), and hold a shell line they can't parse. The LLM gateway can refuse requests that enable provider-run code execution (experimental, gateway).	Decisions by rule id.	Sandboxing execution. Actions inside a subprocess aren't observed, only the command line (limits).
ASI08 Cascading Failures. One fault propagates across agents into system-wide harm. Mitigations include independent policy enforcement, and recording policy decisions and execution outcomes in tamper-evident, time-stamped logs bound to cryptographic identities.	Mitigates in part. Policy is enforced by the signer, apart from the agent that plans. Decisions and results are signed records naming the caller's authenticated identity. A sub-agent's run is linked to its parent's (parent_run). A hold can reach every run of a session, and new runs of the same owner and principal start held during the cooldown (experimental, incidents).	Bundles; run.held records; parent_run in run.registered.	Records are signed with the signer's key and name the caller; they aren't signed by per-agent keys. Record times come from the signer's clock; only witnesses and timestamps give independent time (limits).
ASI09 Human-Agent Trust Exploitation. An agent exploits people's trust to steer their decisions, including getting a person to perform the final, audited action. Mitigations include explicit confirmation before risky actions and tamper-proof records of user queries and agent actions.	Records, and narrows one path. Approvers see the signer's copy of the arguments, not the agent's description, and a reason the agent gave is shown as unverified (approvals). An approval that requires a passkey (experimental) needs an assertion from the approver's registered passkey. Who approved what is signed.	Approval records; approvals: self and break-glass approvals lines.	An agent can still persuade the person who approves, and a person's actions outside Tracekit carry no record (guarantees).
ASI10 Rogue Agents. Agents deviate from their intended function or authorised scope. Mitigations include immutable, signed audit logs of all agent actions, kill switches, credential revocation, quarantine, and keys never directly available to agents.	Mitigates in part. The agent never holds the signing key or assigns sequence numbers (threat model). Operators quarantine runs and suspend identities, and a switch turns off every agent approver (experimental, incidents).	run.quarantined, identity.suspension and approval.agents records.	Suspension refuses the identity's calls but revokes no token: revoke credentials yourself. Containment is enforced only where the signer decides each step (limits). Tracekit doesn't sandbox agents.

OWASP's Agentic AI – Threats and Mitigations (version 1.1, December 2025) names the gap a signed log closes as T8 Repudiation & Untraceability: agent actions that can't be traced or accounted for because logging is insufficient. Its mitigation asks for cryptographically signed, immutable logs. Tracekit's log is signed and tamper-evident; deletion shows but isn't prevented, and only an independent witness shows that a key holder didn't rewrite it (guarantees).

Not covered by Tracekit

• LLM03:2025 Supply Chain (2026: LLM04): models, datasets and packages. For agent tools, see ASI04 above.
• LLM04:2025 Data and Model Poisoning (2026: LLM05).
• LLM07:2025 System Prompt Leakage. The closest 2026 entry, LLM08:2026 Hidden Context Exposure, covers hidden context such as the system prompt.
• LLM08:2025 Vector and Embedding Weaknesses (2026: LLM09).
• LLM09:2025 Misinformation (2026: LLM07).
• ASI06 Memory & Context Poisoning. Provenance (experimental) tracks values that untrusted content brought into one run, in memory; it doesn't cover memory that persists across sessions.
• ASI07 Insecure Inter-Agent Communication. Tracekit doesn't authenticate or protect messages between agents. It links a sub-agent's run to its parent's when the sub-agent registers with the parent's run token.

Sources

Checked on 2026-10-18.

• OWASP Top 10 for LLM Applications 2025: https://genai.owasp.org/llm-top-10/ and each entry's page, for example https://genai.owasp.org/llmrisk/llm062025-excessive-agency/; release page https://genai.owasp.org/resource/owasp-top-10-for-llm-applications-2025/
• OWASP GenAI LLM Top 10 2026: https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/
• OWASP Top 10 for Agentic Applications for 2026: https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/
• OWASP Agentic AI – Threats and Mitigations: https://genai.owasp.org/resource/agentic-ai-threats-and-mitigations/