OWASP Top 10 Crosswalk
Purpose: Let a team that uses the OWASP lists to name AI application risks find the wiki control objectives that treat each item and the test cases that exercise them.
Audience: Application security, AI red teams, product developers, vendor evaluation teams.
Using the two together: Use the OWASP lists to name and rank the risks of an LLM application or an agent. Use this wiki for the control objectives, evidence and test cases for each item.
About the lists and this page
The OWASP GenAI Security Project publishes two lists that the wiki cites: the Top 10 for LLM Applications, 2025 edition (LLM01:2025 to LLM10:2025), and the Top 10 for Agentic Applications (ASI01 to ASI10). The editions used are the ones named in the control library.
The tables are generated each time the site is built. They are read from the OWASP field of each control and from the OWASP mapping field of each test case. To change a mapping, edit the control or the test case; this page follows on the next build.
Verify before use. OWASP revises its lists and renumbers items between editions. Check identifiers and titles against the current published lists before quoting them. The mappings are the wiki's own judgment and have not been reviewed by OWASP.
How to read the tables
- Wiki controls are the control objectives whose record cites the item.
- Test cases under those controls counts the distinct test cases that test at least one of those controls.
- Test cases that cite it counts the test cases whose own record names the item. Most test cases name items from the LLM list only. The agent-to-agent cases also name ASI07, so it is the one agentic item with a count in this column.
Items to wiki controls
Top 10 for LLM Applications 2025
| Item | Name | Wiki controls | Test cases under those controls | Test cases that cite it |
|---|---|---|---|---|
| LLM01:2025 | Prompt Injection | AI-CTRL-005; AI-CTRL-021; AI-CTRL-026; AI-CTRL-034 | 113 | 66 |
| LLM02:2025 | Sensitive Information Disclosure | AI-CTRL-002; AI-CTRL-003; AI-CTRL-004; AI-CTRL-010; AI-CTRL-013; AI-CTRL-017; AI-CTRL-018; AI-CTRL-020; AI-CTRL-021; AI-CTRL-028; AI-CTRL-034 | 218 | 90 |
| LLM03:2025 | Supply Chain | AI-CTRL-001; AI-CTRL-004; AI-CTRL-014; AI-CTRL-024; AI-CTRL-030; AI-CTRL-031; AI-CTRL-032; AI-CTRL-034 | 177 | 78 |
| LLM04:2025 | Data and Model Poisoning | AI-CTRL-019; AI-CTRL-026; AI-CTRL-029; AI-CTRL-030; AI-CTRL-034 | 81 | 15 |
| LLM05:2025 | Improper Output Handling | AI-CTRL-020; AI-CTRL-034 | 49 | 8 |
| LLM06:2025 | Excessive Agency | AI-CTRL-006; AI-CTRL-015; AI-CTRL-016; AI-CTRL-022; AI-CTRL-023; AI-CTRL-025; AI-CTRL-027; AI-CTRL-034; AI-CTRL-045 | 174 | 86 |
| LLM07:2025 | System Prompt Leakage | AI-CTRL-005; AI-CTRL-034 | 87 | 3 |
| LLM08:2025 | Vector and Embedding Weaknesses | AI-CTRL-018; AI-CTRL-019; AI-CTRL-034 | 57 | 5 |
| LLM09:2025 | Misinformation | AI-CTRL-034; AI-CTRL-039 | 44 | 7 |
| LLM10:2025 | Unbounded Consumption | AI-CTRL-028; AI-CTRL-034; AI-CTRL-036 | 83 | 23 |
Top 10 for Agentic Applications
| Item | Name | Wiki controls | Test cases under those controls | Test cases that cite it |
|---|---|---|---|---|
| ASI01 | Agent Goal Hijack | AI-CTRL-005 | 52 | 0 |
| ASI02 | Tool Misuse & Exploitation | AI-CTRL-022; AI-CTRL-024 | 32 | 0 |
| ASI03 | Identity & Privilege Abuse | AI-CTRL-015; AI-CTRL-016 | 90 | 0 |
| ASI04 | Agentic Supply Chain Vulnerabilities | AI-CTRL-024 | 15 | 0 |
| ASI05 | Unexpected Code Execution (RCE) | AI-CTRL-027 | 11 | 0 |
| ASI06 | Memory & Context Poisoning | AI-CTRL-026 | 5 | 0 |
| ASI07 | Insecure Inter-Agent Communication | AI-CTRL-006; AI-CTRL-015 | 56 | 13 |
| ASI08 | Cascading Failures | AI-CTRL-025 | 11 | 0 |
| ASI09 | Human-Agent Trust Exploitation | AI-CTRL-023; AI-CTRL-045 | 9 | 0 |
| ASI10 | Rogue Agents | AI-CTRL-006; AI-CTRL-025 | 26 | 0 |
Items that no control cites
None.
Attribution
The OWASP Top 10 for LLM Applications and the OWASP Top 10 for Agentic Applications are published by the OWASP GenAI Security Project. This page cites item identifiers and titles only. Check the project's licence before reusing its text.