Which OWASP LLM risk to tackle first: chatbot, RAG app or agent

Start with the risk your architecture makes most expensive. A plain chatbot should begin with sensitive information disclosure and system prompt hygiene. A RAG assistant should add vector and embedding weaknesses. A tool using agent should begin with excessive agency and improper output handling. Prompt injection matters for all three.

The ten, in one line each

The 2025 OWASP Top 10 for LLM Applications lists: Prompt Injection, Sensitive Information Disclosure, Supply Chain, Data and Model Poisoning, Improper Output Handling, Excessive Agency, System Prompt Leakage, Vector and Embedding Weaknesses, Misinformation and Unbounded Consumption.

OWASP's page does not rank them by what to fix first for your app, so the order below is engineering judgement, not an OWASP priority list.

Plain chatbot, no tools, no private data

Impact is mostly reputation and cost.

1. Misinformation, because wrong answers reach users.
2. Unbounded Consumption, because the bill is the main attack surface.
3. System Prompt Leakage, so nothing sensitive sits in the prompt.
4. Prompt Injection, to keep it on task.

RAG assistant over internal documents

Now data exposure is the headline.

1. Vector and Embedding Weaknesses: permission aware retrieval and tenant separation.
2. Sensitive Information Disclosure: what the model may quote.
3. Data and Model Poisoning: who can write to the knowledge base.
4. Prompt Injection, since retrieved text is untrusted input.

Tool using agent

The model can now act, so the blast radius is set by its permissions.

1. Excessive Agency: minimise tools, scopes and autonomy, require approval for high impact actions.
2. Improper Output Handling: validate what reaches shells, queries and browsers.
3. Prompt Injection: every content source can carry instructions.
4. Supply Chain: tools, plugins and models you did not write.

When two items tie

Pick the one that is cheaper to fix and fixes more. Least privilege, for example, reduces the impact of injection, agency and leakage at once.

A two hour exercise

Draw your data flow. Mark every place the model reads untrusted text and every place it can write or call something. For each write, ask what the worst outcome is if an attacker controlled the text. Rank by that outcome and start at the top.

Safeguard can help with the supply chain and policy items on that list, such as dependency scanning, SBOMs and guardrails, but not with the application design choices above.

Revisit as the app grows. Apps change type. A chatbot that gains a retrieval source becomes a RAG app. A RAG app that gains an action tool becomes an agent. Each step moves you down a different list. Put a rule in your design review: adding a data source or a tool triggers a refresh of the risk ranking, with the same exercise of drawing the data flow.

Quick check

Sources

• OWASP Top 10 for LLM Applications (GenAI Security Project)
• OWASP GenAI: LLM06 Excessive Agency
• OWASP GenAI: LLM08 Vector and Embedding Weaknesses

Last reviewed: 19 October 2026.