SSOGEN / Learn / OWASP LLM Top 10: What Identity Can and Cannot Fix
Learn
OWASP LLM Top 10: What Identity Can and Cannot Fix
The OWASP list names the ten most critical risks in applications built on large language models, and identity controls reduce about half of them, though not prompt injection.
Updated
The OWASP Top 10 for LLM Applications is a community-ranked list of the ten most critical security risks in software built around a large language model. The current edition, 2026, was published in August 2026 (the PDF is dated 4 August). OWASP maintains a second, separate list for agentic applications.
This page maps each entry in the OWASP LLM top 10, and in the agentic list, to the identity control that reduces it and to what identity leaves untouched.
Identity answers six questions: who the agent is, what it may do, for whom, for how long, who approved it and what was logged. Excessive Agency is the entry those answers fit best.
Which OWASP list is current
OWASP’s GenAI Security Project publishes the LLM list. The 2025 edition (LLM01:2025 to LLM10:2025) is still online at the project’s older address, which is why search results show both years.
The 2026 edition replaces it. Two ranking changes matter:
- Excessive Agency rose from sixth to third.
- System Prompt Leakage became Hidden Context Exposure, with a wider scope.
OWASP also documents its method: three quarters of the weight is a practitioner vote and one quarter is a corpus of 6,639 classified real incidents.
The two sources disagree in places. The project’s own letter says prompt injection would drop out of the top 10 on incident counts alone, because teams defend against it so heavily.
The agentic list is a different document: the OWASP Top 10 for Agentic Applications, published 9 December 2025, with ids ASI01 to ASI10.
OWASP draws the boundary itself. The LLM list treats the model as a component inside your application; once the model becomes an actor with tools and memory, the risk belongs to the agentic list.
The six identity questions
A control counts as an identity control if it answers one of these questions:
- Who is the agent? A registered identity with a named owner, not a shared key.
- What may it do? Scopes per tool, enforced outside the model.
- For whom? The person it acts for, carried in the credential.
- For how long? Credentials that expire in minutes and consent that can be withdrawn.
- Who approved it? A person confirming the sensitive actions.
- What was logged? A record of each call, the agent and the person.
The LLM list, risk by risk
The descriptions are our short paraphrase of OWASP’s. The right-hand column matters most: most of this list concerns what the model reads, writes and remembers, and an authentication system sees none of that.
| Risk | What OWASP describes | Identity control that reduces it | What identity cannot fix |
|---|---|---|---|
| LLM01 Prompt Injection | Input of any kind, including retrieved content and tool output, changes the model’s behavior in ways the developer did not intend | Narrow scopes and a person’s approval cap what an injected instruction can do (questions 2 and 5) | Nothing stops the model being fooled. Identity limits the damage; it does not detect or block the injection |
| LLM02 Sensitive Information Disclosure | Confidential data leaves through a channel nobody authorized, not only the final answer | Run retrieval and tools in the person’s own context, so the model can only reach what that person can (question 3) | Data already in the prompt, a model trained on it, or logs that hold it |
| LLM03 Excessive Agency | Damaging actions follow from unexpected or manipulated model output | Most directly: per-tool scopes, user-context credentials, approval for high-impact actions, a record of every call (all six questions) | A permitted action taken for a wrong reason. A scope that was too broad on purpose |
| LLM04 Supply Chain | Tampered models, datasets, adapters and tool packages | Allow only registered agents and tool servers, each with an owner (question 1) | Whether a model file or package is what it claims to be. That needs signing and provenance |
| LLM05 Data and Model Poisoning | Harmful behavior embedded through training, fine-tuning, embedding or retrieval data | Control who may write to a knowledge store, with logged writes (questions 2 and 6) | The content of the data itself |
| LLM06 Unbounded Consumption | Uncontrolled inference, with cost and availability effects | Per-identity limits and a way to suspend an identity that runs wild (questions 1 and 4) | Cost from legitimate users within their limits, and model-extraction patterns spread across identities |
| LLM07 Misinformation | Credible but wrong output that people or agents act on | Approval before consequential actions is the only help (question 5) | Whether the output is true |
| LLM08 Hidden Context Exposure | Extraction of system instructions and operational context | Keep secrets and authorization logic out of the prompt; hold credentials in the gateway, not the model (question 2) | The model repeating whatever is in its context |
| LLM09 Vector and Embedding Weaknesses | Weaknesses in how embeddings and similarity search feed the model | Per-person access to the vector store, so retrieval respects permissions (question 3) | Embedding inversion and poisoned vectors |
| LLM10 Improper Output Handling | Model output passed downstream without validation | Little. Downstream systems should treat the agent as an authenticated but untrusted caller (question 2) | Validation and sanitization are application code |
Identity barely touches LLM01, LLM07 and LLM10, and affects LLM08 only indirectly. A claim that an access-management product “solves” the LLM top 10 overstates what identity can do.
Why identity fits excessive agency best
OWASP names three root causes for LLM03: excessive functionality, excessive permissions and excessive autonomy. Its prevention list reads like an identity design:
- Run tools in the user’s context.
- Apply complete mediation: enforce policy in code, not in the model.
- Require human approval for high-impact actions.
- Log and monitor tool use.
OWASP adds that sanitizing inputs and outputs is not a root control for this entry.
OWASP’s 2026 text also maps this entry to the agentic list: ASI02 Tool Misuse and Exploitation, ASI03 Identity and Privilege Abuse and ASI08 Cascading Failures. That cross-reference links the two lists.
The agentic list, risk by risk
| Risk | What OWASP describes | Identity control that reduces it | What identity cannot fix |
|---|---|---|---|
| ASI01 Agent Goal Hijack | Hidden prompts redirect what the agent is trying to do | Scopes bound the redirected agent to what it was granted | The hijack itself |
| ASI02 Tool Misuse | Legitimate tools bent toward destructive results | Per-tool scopes checked on each call, sensitive tools gated by approval | Misuse inside a granted scope |
| ASI03 Identity and Privilege Abuse | Leaked credentials let agents operate beyond intended scope | The core fit: short-lived credentials bound to the agent’s key, user-context delegation, owners | A credential stolen and used within its few minutes and scope |
| ASI04 Agentic Supply Chain | Runtime components such as MCP servers and agent-to-agent services get poisoned | Authenticate servers and clients, and authorize every tool call, as in MCP authentication | A malicious tool description or server that was approved |
| ASI05 Unexpected Code Execution | Natural-language paths reach remote code execution | Do not give an agent a shell scope; keep code-running tools sensitive | Sandboxing and input handling |
| ASI06 Memory and Context Poisoning | Poisoned memory reshapes behavior long after the first interaction | Separate memory per person and per agent, with logged writes | Whether stored content is true |
| ASI07 Insecure Inter-Agent Communication | Spoofed messages between agents misdirect groups of agents | Each agent proves itself with its own key; delegation records the chain of actors | Message content and protocol design |
| ASI08 Cascading Failures | False signals spread through automated pipelines | A kill switch, short credentials and limits stop the spread | Detecting the false signal |
| ASI09 Human-Agent Trust Exploitation | Polished explanations lead operators to approve harmful actions | The approval exists, which beats none | Approvers who trust a persuasive screen. Show what will change |
| ASI10 Rogue Agents | Agents drift from scope or conceal what they do | Owners, review dates, suspension and an audit trail you can compare against intent | Deciding that behavior is wrong |
One way to apply the controls
None of these controls depends on a specific product. As one example, SSOGEN’s AI agent identity implements the design below; compare it with what you run:
-
Each agent is a registered identity with one to five named owners and no password. It proves itself with its own key.
-
When it acts for a person, the credential carries the person as
suband the agent asact(the delegation pattern in OAuth token exchange), and is tied to the agent’s key. It lasts 240 seconds by default, never more than 270. -
The MCP Gateway checks each tool call against the scopes granted for that tool. Sensitive scopes wait for the person’s approval, which issues a fresh credential for that change.
-
Every call and refusal goes to an audit record. A kill switch stops one type of agent, or all of them.
-
Scopes. AI agent permissions shows how to choose them.
-
Ownership. AI agent governance covers ownership and review.
-
Wider picture. Read agentic AI security.
Questions people ask
What are the top 10 LLM models?
What are the top 10 vulnerabilities that LLMs are most susceptible to?
What are the top 10 AI agents according to OWASP?
Is the OWASP Top 10 still relevant?
Where to go next
- Related explainers. The Learn hub lists them.
- Credentials. Read MCP authentication and OAuth token exchange.
- Product details. See AI agent identity, AI agent permissions and the MCP Gateway.
Sources, all read 2026-10-11: OWASP GenAI LLM Top 10 2026 and its PDF (version 2026, dated 4 August 2026), LLM Top 10 for 2025, LLM06:2025 Excessive Agency, OWASP Top 10 for Agentic Applications. SSOGEN statements come from SSOGEN’s own pages linked above.