OWASP Top 10 for LLM applications: what every AI agent reviewer should know

The OWASP Top 10 for LLM Applications lists the most important security risks in systems built on large language models, including prompt injection, excessive agency and sensitive information disclosure. Every AI agent reviewer should know those three well, because the reviewer is often the last person to see a manipulated, overreaching or leaking action before it takes effect.

What is the OWASP Top 10 for LLM Applications?

OWASP is an open community that publishes widely used security guidance. Its Top 10 for LLM Applications is a list of the main risks in applications built on language models, written mainly for developers and security teams. It is not a law or a certification; it is a shared vocabulary that security teams, auditors and employers use.

Three of its risks matter most for reviewers:

• Prompt injection: content the agent reads, such as an email, a document or a web page, contains instructions that try to make it do something it should not.
• Excessive agency: the agent has more functions, permissions or autonomy than its job needs, so a mistake or attack can do more damage.
• Sensitive information disclosure: the agent reveals data it should not, such as another customer's details or internal information.

The list also covers, in substance, risks such as poisoned data the system learns from or relies on, other systems trusting model output without checks, misinformation the model produces with confidence, and weaknesses in the supply chain of models and components. How the list applies to agents that act is covered in how the OWASP Top 10 for LLM applications applies to AI agents.

Who should know it?

Developers and security teams use it to design and test systems. But anyone who reviews agent actions benefits from knowing it, because these risks show up in review queues as odd drafts, unexpected actions and leaked details. Reviewers in payments, claims, customer service, procurement, recruitment and AML all see agent output that may have been shaped by an attack.

Employers increasingly expect reviewers to recognise these patterns, even if they never use the word "OWASP".

What should a reviewer actually look for?

Each risk has a reviewer's version.

1. Prompt injection. Watch for drafts that change direction after the agent read something from outside: a supplier invoice that leads to a bank detail change, a customer email that leads to a refund above policy, a CV that leads to an unusually high ranking. Treat anything that arrived from outside as the weakest kind of evidence. An external claim should never be enough to authorise a payment or a security-relevant change.
2. Excessive agency. Notice when an agent can do things its job does not need, such as a support agent that can change account ownership. Report it. The fix is to lower its depth for that capability, not to hope reviewers catch every case. The idea of depth is explained in what is depth in AI agent work.
3. Sensitive information disclosure. Read drafts for details that belong to someone else, internal notes, or more personal data than the purpose needs. Stop and record.
4. Misinformation. Check confident statements against sources. An agent quoting a policy or a rate that does not exist is a reviewer's problem until it is corrected.
5. Downstream trust. If the agent's output feeds another system, such as a payments file or a record update, check that it is in the right form and within limits before approving.

Employers' training for the excessive agency point is covered in OWASP Top 10 for LLM applications: training reviewers to spot excessive agency.

How can you show employers you know it?

Make the evidence checkable. A CV line that says "familiar with OWASP" is weak; a line that says "stopped agent-drafted bank detail changes triggered by external invoices, all verified by call-back" is strong. The case for checkable skills is made in why every AI skill on your CV should be checkable.

What might an interviewer ask?

1. "An agent reads a supplier's email and drafts a change to their bank details. What do you do?" Hold it, verify through a known contact, and report it as a possible injection or fraud attempt.
2. "Why does it matter how much an agent is allowed to do?" Because excessive agency turns a small error or attack into a large one.
3. "The agent's reply quotes a policy you have never heard of. What now?" Check the source; if it does not exist, correct the reply and report it.

A procurement assistant we will call Kofi prepared by describing an invoice fraud attempt his team had caught by phone verification, and how the same attack would look through an agent. It turned an abstract list into a concrete skill.

What does the OWASP list not cover?

It is not a law or a compliance standard, and no regulator requires reviewers to know it by name. It does not certify individuals. It does not cover fairness, consumer outcomes or data protection duties, which other rules address. And it is written mainly for builders, so reviewers should take its ideas, not its technical detail.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

Where the Academy fits

Pryme Intelligence Academy's Foundations track explains depth and the decision chain, which frame excessive agency. The Operator track adds human review and what to do when something goes wrong, including manipulated inputs. Certified Pryme Operator requires no missed red line in the practicum, and the certificate is checkable at source through VerifyDoc.ai.