OWASP Top 10:2025 now sits alongside OWASP LLM Top 10:2025 and Agentic Top 10:2026. Use this web security cheat sheet to ship safer AI apps. Read now.
Three lists, one shared job
OWASP Top 10:2025 still covers the web and API surface your AI product sits on: broken access control, injection, misconfiguration, supply-chain risk, and weak authentication. OWASP LLM Top 10:2025 focuses on model-facing failures—prompt injection, insecure output handling, excessive agency, data leakage through context, and model theft or poisoning. Agentic Top 10:2026 addresses systems that plan, call tools, and act across sessions: goal hijacking, tool abuse, privilege escalation through chained actions, and weak human oversight.
Treat them as layers, not alternatives. A chat feature can pass an LLM review and still fail classic web checks. An agent can follow a safe prompt policy and still overreach if tool scopes are too broad. Ship safer AI apps by mapping every user path to all three lists before you call the design “done.”
Map threats before you write features
Start from entry points: public forms, authenticated APIs, admin tools, background jobs, and any channel that can inject text or files into a model. For each path, ask three questions. What can a caller force the model to say or do? What data can leave the system through completions, logs, or tool results? What can an agent invoke without a second check?
Capture answers in a short threat sketch next to the architecture diagram. Label each risk with the matching OWASP list so reviewers know which control family applies. Prefer concrete assets—user PII, tenant secrets, production tool credentials—over vague “AI risk” labels. If you cannot name the asset and the abuse path, you are not ready to implement the feature.
Controls that cut across all three lists
- Identity and authorization first. Enforce least privilege on APIs and tools the same way you would for any backend. Models and agents must inherit the caller’s rights, not a service account with god mode.
- Untrusted input, untrusted output. Treat prompts, retrieved documents, and tool responses as hostile. Validate structure, encode for the destination, and never execute model output as code or as a privileged command without a policy gate.
- Scoped tools and hard limits. Give agents narrow tool catalogs, rate limits, and spend or action caps. Require confirmation for irreversible steps: deletes, payments, external sends, privilege changes.
- Data minimization in context. Send only the fields the task needs. Strip secrets from logs and traces. Separate system instructions from user content so injection cannot silently rewrite policy.
- Supply chain and config hygiene. Pin model providers, plugins, and retrieval sources; review defaults; turn off unused endpoints and debug surfaces.
These controls are boring on purpose. They work whether the model is a single completion call or a multi-step agent graph.
Use this as a release cheat sheet
Before launch, walk a checklist derived from the three Top 10s: authz on every tool; input/output boundaries; prompt and retrieval isolation; agent stop conditions; secret handling; monitoring for anomalous tool use and data exfil patterns; and a clear rollback when the agent misbehaves. Fail closed when confidence is low—refuse, ask a human, or degrade to read-only—rather than “helpfully” completing a risky action.
Security for AI apps is still web security, model security, and autonomy security stacked together. OWASP Top 10:2025, LLM Top 10:2025, and Agentic Top 10:2026 give you a shared vocabulary to review designs, write tests, and reject shortcuts. Use them as the gate, not as reading material after an incident.