Treat the OWASP LLM Top 10 as a checklist, not a certificate. For each of the ten risks, write one sentence on whether you are exposed, one control you run, and one artifact that proves it. Then reuse those ten answers whenever a questionnaire asks about AI security.
What the list is
The OWASP GenAI Security Project publishes a Top 10 for large language model applications. The 2025 edition lists: prompt injection, sensitive information disclosure, supply chain, data and model poisoning, improper output handling, excessive agency, system prompt leakage, vector and embedding weaknesses, misinformation, and unbounded consumption.
It is a list of risks to consider. Nobody can be "OWASP compliant", so avoid that phrase in an answer.
Which risks matter for assistants and MCP
| Risk | Where it shows up | Answer ingredient |
|---|---|---|
| Prompt injection | Untrusted content read by an agent | Scoped tools, approvals |
| Sensitive information disclosure | Prompts and context holding secrets or customer data | Data rules, exclusions |
| Supply chain | Assistant extensions, MCP packages | Vetting, SBOM, pinning |
| Improper output handling | Model output used by code or shell | Review gates, validation |
| Excessive agency | Tools that can write or delete | Least privilege, approvals |
| System prompt leakage | Instructions with embedded secrets | No secrets in prompts |
| Unbounded consumption | Runaway agent loops and cost | Rate limits, quotas |
The remaining three, poisoning, vector weaknesses and misinformation, matter if you build retrieval or train models. Say "not applicable, because we do not operate X" where that is true.
Build your ten sentence sheet
- Copy the list into a table.
- For each row write exposure: yes, partly, or no, with a reason.
- Add the control you operate today.
- Add evidence: a policy section, a config, a log, a test record.
- Add an owner and a review date.
- Mark gaps clearly with a plan.
Keep each cell short. The sheet is an answer bank, so it should paste cleanly into forms.
Where the MCP specification lines up
Several controls in the MCP tools and security guidance map to rows above. Servers must validate tool inputs, rate limit invocations and sanitize outputs. Clients should prompt for confirmation on sensitive operations and validate results before passing them to the model. Using the same words in your answers shows you have read the source. See what excessive agency means for MCP tools and which OWASP LLM risks matter for coding assistants.
Wording to avoid
- "Fully mitigated." Few of these risks are ever fully mitigated.
- "Compliant with OWASP." There is no such status.
- A sheet with every cell reading "yes, controlled". Reviewers distrust uniform answers.
Evidence and tooling
Attach the sheet, a policy excerpt, and test notes. Safeguard supports several rows: SBOM and dependency scanning and reachability for supply chain, policies and gates for output review, and the MCP Guardrail for agency limits.
Quick check
Do we have to cover all ten?
Cover all ten in the sheet, but answer only the ones the questionnaire asks about, and mark not applicable with a reason.
How often should the sheet be refreshed?
At least when your AI features change and when OWASP publishes a new edition. Date the sheet either way.
Sources
Last reviewed: 19 October 2026.
