Use the OWASP Top 10 for LLM Applications when your risk centres on a model inside an application, and the OWASP Top 10 for Agentic Applications when software plans, remembers and acts through tools. Many teams need both. Pick by architecture, then ask each tool to show coverage for the risks that apply to you.
What each list is
The OWASP GenAI Security Project publishes both. The LLM Top 10 2025 has ten entries, from LLM01 Prompt Injection through LLM10 Unbounded Consumption. They include sensitive information disclosure, supply chain, improper output handling, excessive agency, system prompt leakage and misinformation.
The Top 10 for Agentic Applications for 2026 was published on 9 December 2025, and OWASP describes it as a peer-reviewed framework for the most critical risks to autonomous and agentic AI systems, developed with more than 100 experts. Read the official document for its exact categories before you quote them.
Choosing by architecture
| Your system | Start with | Why |
|---|---|---|
| Chat feature that answers questions from a model | LLM Top 10 | Risks sit in prompts, outputs and data |
| Retrieval over your documents | LLM Top 10 | Vector and data risks matter |
| Assistant with tools that act | Both | Model risks plus the risks of acting |
| Several agents coordinating | Agentic Top 10 first, then LLM | Delegation and autonomy dominate |
| Coding assistant in the developer workflow | Both | Tool access and supply chain together |
Excessive agency appears in the LLM list already. OWASP defines it as a system taking damaging actions in response to unexpected, ambiguous or manipulated output, with excessive functionality, permissions and autonomy as root causes. That entry is the bridge between the two lists.
How to use a list when buying
Do not accept "covers the OWASP Top 10" as an answer. Ask for a table: each entry, what the tool does about it, and how you can verify. Mark the entries as detect, prevent, or not covered. An honest vendor will have not covered rows. A page that claims all ten should lead you to ask for the test.
Keep in mind that a list is a prioritised awareness document. It does not tell you which of your own systems are affected, and it does not measure a product.
A simple method
- Draw your architecture and mark where a model decides something.
- Mark where it can call a tool or change data.
- Choose the list or lists that match.
- For each entry, write a one line statement of your exposure.
- Compare candidate tools against your highest exposures first.
See also what a tool claim should mean.
Try it yourself
Click through it at your own pace, or open it full screen.
See how one control maps to several frameworks, then imagine doing the same for each OWASP entry.
Quick check
Are the OWASP lists a standard I can certify against?
No. They are awareness and guidance documents, not certifications.
Which list changes more often?
Check the publication dates on both pages. The LLM list carries a 2025 edition and the agentic list a 2026 edition.
Safeguard offers policies and guardrails, an MCP Guardrail and dependency scanning that relate to supply chain and agency risks, and a free scan.
Sources
- OWASP, Top 10 for LLM Applications 2025
- OWASP, Top 10 for Agentic Applications for 2026
- OWASP, LLM06:2025 Excessive Agency
Last reviewed: 19 October 2026.
