Building an Agent Risk Register from the OWASP LLM Top 10

There are two OWASP Top 10 lists relevant to agent security, and most developers only know one. The LLM Top 10 covers general language model risks. The Agentic Top 10 (released Dec 2025) addresses autonomous systems that plan, act, and make decisions. You need both.

The Two OWASP Lists

OWASP Top 10 for LLM Applications (v2.0)

ID	Risk
LLM01	Prompt Injection
LLM02	Sensitive Information Disclosure
LLM03	Supply Chain
LLM04	Data and Model Poisoning
LLM05	Improper Output Handling
LLM06	Excessive Agency
LLM07	System Prompt Leakage
LLM08	Vector and Embedding Weaknesses
LLM09	Misinformation
LLM10	Unbounded Consumption

OWASP Top 10 for Agentic Applications (2026)

ID	Risk
ASI01	Agent Goal Hijack
ASI02	Tool Misuse & Exploitation
ASI03	Identity & Privilege Abuse
ASI04	Agentic Supply Chain Vulnerabilities
ASI05	Unexpected Code Execution (RCE)
ASI06	Memory & Context Poisoning
ASI07	Insecure Inter-Agent Communication
ASI08	Cascading Failures
ASI09	Human-Agent Trust Exploitation
ASI10	Rogue Agents

How LLM Risks Amplify in Agents

LLM01 → ASI01 (Prompt Injection → Goal Hijack): Agents can send emails, access databases, modify files. Indirect injection via retrieved documents hijacks the entire agent chain.

LLM06 → ASI02/03/10 (Excessive Agency → Tool Misuse/Identity Abuse/Rogue Agents): The risk OWASP expanded most for agentic systems. Excessive functionality, permissions, and autonomy.

LLM04 → ASI06 (Data Poisoning → Memory Poisoning): Agents maintain persistent memory. Poisoned data corrupts future reasoning.

LLM05 → ASI05 (Improper Output → RCE): LLM outputs passed to tools without validation become injection attacks through the tool layer.

Risk Score Formula

risk_score = likelihood × impact × (1 - control_effectiveness / 5)

Each component rated 1-5. For agents, “Critical Impact” includes any action that is irreversible, financial, externally visible, or involves sensitive data.

Building the Risk Register

from enum import Enum
from dataclasses import dataclass

class RiskLevel(Enum):
    LOW = "low"
    MEDIUM = "medium"
    HIGH = "high"
    CRITICAL = "critical"

@dataclass
class AgentRiskEntry:
    risk_id: str
    owasp_category: str
    agentic_category: str
    description: str
    likelihood: int      # 1-5
    impact: int          # 1-5
    control_effectiveness: int  # 1-5
    risk_score: float
    risk_level: RiskLevel
    mitigation: str
    owner: str
    status: str  # open, mitigated, accepted, closed

# Example entry
risk = AgentRiskEntry(
    risk_id="RISK-001",
    owasp_category="LLM06",
    agentic_category="ASI02",
    description="Agent has wildcard database access beyond task scope",
    likelihood=4,
    impact=5,
    control_effectiveness=2,
    risk_score=4 * 5 * (1 - 2/5),  # = 12.0
    risk_level=RiskLevel.HIGH,
    mitigation="Scope database access to read-only for specific tables",
    owner="platform-team",
    status="open",
)

Mitigation Strategies by Category

Tool Security & Least Privilege

ACTION_RISK = {
    "search_documents": "low",
    "read_file": "low",
    "write_file": "medium",
    "send_email": "high",
    "execute_code": "high",
    "database_delete": "critical",
    "transfer_funds": "critical",
}

SENSITIVE_TOOLS = ["send_email", "execute_code", "database_write"]

def require_confirmation(func):
    async def wrapper(tool_name, params, context):
        if tool_name in SENSITIVE_TOOLS:
            if not context.get("user_confirmed"):
                return {
                    "status": "pending_confirmation",
                    "message": f"'{tool_name}' requires user approval",
                }
        return await func(tool_name, params, context)
    return wrapper

Input Validation

Treat all external data as untrusted. Separate LLM calls to validate untrusted content. Content filtering for injection patterns. Input sanitization before context inclusion.

Memory & Context Security

Validate and sanitize before storing. Memory isolation between users/sessions. Set expiration and size limits. Audit for sensitive data before persistence. Hash-chain integrity for persisted state.

Human-in-the-Loop Controls

Explicit approval for high-impact actions. Action previews before execution. Autonomy boundaries based on risk levels. Allow interruption and rollback.

Multi-Agent Security

Trust boundaries between agents. Validate inter-agent communications. Prevent privilege escalation through agent chains. Circuit breakers for cascading failures.

The OWASP AI Agent Security Cheat Sheet

Nine best practices:

1. Tool Security & Least Privilege — Minimum tools per task, per-tool scoping
2. Input Validation — Treat external data as untrusted
3. Memory Security — Isolation, expiration, integrity checks
4. HITL Controls — Approval for high-impact actions
5. Output Validation — PII filtering, schema validation
6. Monitoring — Log all decisions, anomaly detection
7. Multi-Agent Security — Trust boundaries, circuit breakers
8. Data Protection — Minimize sensitive data in context
9. Adversarial Testing — Abuse-case test matrix in CI/CD

The Agent Control Standard (ACS)

OWASP announced the ACS alongside the 2026 lists — providing practical runtime enforcement guidance. This is the operational layer that turns risk registers into enforced policies.

The Takeaway

Most teams know the LLM Top 10 but not the Agentic Top 10. Map both to your agent’s capabilities. Use the risk score formula to prioritize. Start with the OWASP AI Agent Security Cheat Sheet’s 9 practices as your baseline. Build a living risk register that evolves with the threat landscape.

💡 Start with ACTION_RISK classification and require_confirmation for sensitive tools — these two patterns prevent the most common agent security incidents.