Summary: Full crosswalk between the seventeen agentic threats and the OWASP Top 10 for LLM Applications 2025 — including the seven agentic threats with no Top 10 counterpart and the four Top 10 entries with no agentic extension.
Sources: raw/Agentic/Agentic-AI-Threats-and-Mitigations-1.1.pdf, raw/OWASP-Top-10-for-LLMs/
Last updated: 2026-07-29
Both documents come from the same OWASP project, so the mappings below are the source’s own claims rather than this wiki’s inference — except where noted.
Agentic → Top 10
| TID | Threat | Top 10 relation | Nature of the relation |
|---|---|---|---|
| T1 | Memory Poisoning | LLM04, LLM08 | Extends — “beyond static data poisoning… to real-time poisoning of persistent agent memory” |
| T2 | Tool Misuse | LLM06; also LLM03, LLM08 | Partial — memory and delegation break the session-scoped model |
| T3 | Privilege Compromise | LLM06 | Partial — amplified by dynamic role delegation |
| T4 | Resource Overload | LLM10 | Related — agents self-trigger, spawn processes, coordinate |
| T5 | Cascading Hallucination | LLM09 | Extends — self-reinforcement and inter-agent propagation |
| T6 | Intent Breaking & Goal Manipulation | LLM01 | Extends — injection of objectives, not just outputs |
| T7 | Misaligned & Deceptive Behaviors | — | None |
| T8 | Repudiation & Untraceability | — | None |
| T9 | Identity Spoofing & Impersonation | — | None |
| T10 | Overwhelming HITL | — | None |
| T11 | Unexpected RCE & Code Attacks | LLM01, LLM05 | Distinct from — no intermediary between output and execution |
| T12 | Agent Communication Poisoning | LLM04, LLM08 | Beyond — targets transient data in flight |
| T13 | Rogue Agents | LLM06 | Adversarial exploitation of |
| T14 | Human Attacks on Multi-Agent Systems | — | None |
| T15 | Human Manipulation | — | None |
| T16 | Insecure Inter-Agent Protocol Abuse | — | None |
| T17 | Supply Chain Compromise | LLM03 | Amplified — long-lived, stateful, propagating |
(source: Agentic-AI-Threats-and-Mitigations-1.1.pdf, pp. 16–19, 21–32)
The seven with no counterpart
T7, T8, T9, T10, T14, T15, T16 — 41% of the agentic taxonomy. They divide cleanly:
- T7 — emergent harm from reasoning. No Top 10 entry contemplates the model as an originating actor.
- T8, T9 — accountability and identity. Conventional security properties that only become relevant once the system acts.
- T10, T15 — the human boundary. The Top 10 treats humans as users; the agentic taxonomy treats them as a control surface with exploitable limits.
- T14, T16 — the seams between agents. Nothing in a single-model threat model has a place for them.
This is the agentic gap, and the vault has now recorded it from five directions: the OWASP crosswalk, AI Act Article 15, ATLAS mitigation coverage, PITAX’s technique clustering, and now OWASP’s own agentic taxonomy explicitly declining to map seven of seventeen threats.
The strongest version of the finding: the Top 10 was built for systems that generate, and the gap is exactly the set of threats that require a system that acts.
Top 10 → agentic
Reading the other direction, which the source does not do:
| Entry | Agentic extension |
|---|---|
LLM01 Prompt Injection | T6 (goals, not outputs); delivery for T2, T9, T11, T15 |
LLM02 Sensitive Information Disclosure | — none named — |
LLM03 Supply Chain | T17 |
LLM04 Data and Model Poisoning | T1, T12 |
LLM05 Improper Output Handling | T11 (distinguished from, not extended) |
LLM06 Excessive Agency | T2, T3, T13 — the most-extended entry |
LLM07 System Prompt Leakage | — none named — |
LLM08 Vector and Embedding Weaknesses | T1, T2, T12; RAG deferred here wholesale |
LLM09 Misinformation | T5 |
LLM10 Unbounded Consumption | T4 |
Two observations:
LLM06 Excessive Agency splits into three. Tool misuse, privilege compromise and rogue agents were all one entry in the Top 10. That single entry carrying three distinct agentic threats — each with its own scenarios and playbook coverage — is the clearest evidence that the Top 10’s granularity is wrong for agentic systems. Worth reading against the note in the OWASP index that Insecure Plugin Design dissolved into Excessive Agency in the 2023→2025 revision. It is now overloaded.
LLM02 and LLM07 have no agentic extension. Sensitive information disclosure and system prompt leakage are unchanged by agency in OWASP’s treatment. For LLM07 this is consistent with the Top 10’s own position that the system prompt “should not be considered a secret, nor should it be used as a security control.” LLM02 is more surprising, given how much of the agentic taxonomy ends in exfiltration — the document appears to treat disclosure as the consequence of T2, T3 and T9 rather than a threat in its own right.
RAG is deliberately out of scope
The document defers retrieval security entirely to LLM08 (p. 14), directing readers to implement “permission-aware vector databases, data validation pipelines, and continuous monitoring for poisoning or embedding inversion risks.” That leaves retrieval-time poisoning thinner here than in this vault’s own RAG and runtime poisoning page, which should be read alongside T1.
Related pages
- agentic-threat-taxonomy — the seventeen threats
- agentic-ai-threats-and-mitigations — the source page
- OWASP crosswalk — the vault’s PITAX / ATLAS / AI Act mapping
- The ten risks
- ATLAS matrix