The OWASP LLM Top 10 is the industry-standard framework for AI security risk. It lists 10 attack categories actively exploited against AI agents and LLMs in production.
Critically: these attacks don't only arrive through the user-facing prompt. They come through tool responses, RAG documents, web search results, and memory — every layer of your agent stack is an independent attack surface.
Crafted input overrides system prompt instructions.
An attacker crafts input that hijacks the model's instructions. Direct injection targets the system prompt via the user message. Indirect injection embeds malicious instructions in content the agent reads — documents, emails, web pages — causing the model to execute attacker-controlled instructions without explicit user action.
A researcher used role-play framing to bypass a customer-facing LLM. Within 3 messages, the agent revealed its complete system prompt, including internal pricing overrides and escalation policies.
$4.88M average data breach cost (IBM 2024). System prompt leaks expose proprietary logic, pricing rules, and internal workflows.
Model reveals private data, system prompts, or cross-session PII.
The model discloses information it should protect: the system prompt, embedded API keys, PII from training data, or data from other users' sessions. Memory contamination can cause cross-session data leakage at scale.
A support agent surfaced private data from prior user sessions — names, account numbers, and complaints — to unrelated users, exposing thousands of records.
$150–$750 per PII record under CCPA/GDPR. At scale, a mid-size breach can exceed $50M in regulatory exposure.
Compromised model, plugin, or data components in the AI stack.
Attackers compromise upstream components: poisoned fine-tuning datasets, malicious plugins or tools, compromised model providers, or vulnerable third-party libraries. The AI application inherits these vulnerabilities.
Malicious packages published to PyPI with names similar to popular AI libraries captured API keys from CI environments.
Full compromise of the agent's behavior, including data exfiltration and instruction hijacking.
Manipulate model behavior via poisoned training data or retrieval stores.
An attacker contaminates the data the model learns from or retrieves: training data, RAG vector stores, or in-context examples. The poisoned data shifts model behavior in ways the attacker controls.
Adversarial documents injected into a corporate knowledge base caused a RAG system to surface attacker-controlled content during normal user queries.
Silent, persistent behavioral manipulation that can persist across all users and sessions.
Model output passed to downstream systems without validation.
The model generates output — SQL, shell commands, HTML, API calls — that gets passed to another system without sanitization. The downstream system executes the model's output, which may contain injected malicious commands.
A code-generation agent produced SQL with injected DROP TABLE statements when fed adversarial input. The output was passed directly to a database.
Arbitrary code execution, database compromise, or XSS in downstream applications.
Agent takes actions beyond what the user authorized.
An over-permissioned agent takes real-world actions — sending emails, modifying files, executing transactions — without explicit user authorization. Often triggered by indirect injection or over-permissioning during development.
A malicious email contained hidden instructions. The AI email assistant, summarizing the message, silently created a forward-all rule to an attacker-controlled address.
€20M+ max GDPR fine for AI-driven data exposure via unauthorized actions.
System prompt exposed, revealing proprietary business logic.
Distinct from general data disclosure — specifically exposing the system prompt. System prompts often contain business logic, pricing rules, persona definitions, internal escalation paths, and competitive information.
A competitor obtained another company's AI assistant system prompt by systematically probing with roleplay and summarization requests, then replicated the product.
Intellectual property theft, competitive exposure, and the removal of security instructions the attacker now knows to work around.
Poison or manipulate RAG retrieval stores and embeddings.
Attacks targeting the retrieval layer of RAG systems: poisoning the vector database with adversarial content, crafting queries that surface sensitive documents, or exploiting embedding similarity to retrieve unintended content.
Carefully crafted queries were used to surface confidential internal documents from a company's RAG-powered chatbot by exploiting embedding similarity thresholds.
Unauthorized access to sensitive documents, data exfiltration via retrieval, and behavioral manipulation through poisoned knowledge bases.
Model generates false information that is acted upon.
The model confidently generates incorrect information — fabricated citations, wrong medical advice, false legal guidance — and users act on it without verification. Hallucination at scale becomes a liability.
A legal AI tool cited non-existent court cases in a brief submitted to federal court, resulting in sanctions against the attorneys.
Legal liability, regulatory action, user harm, and reputational damage from AI-generated misinformation.
Crafted inputs exhaust compute, tokens, or degrade output quality.
An attacker crafts inputs designed to cause excessive resource consumption: very long recursive reasoning chains, inputs that force maximum context usage, or patterns that degrade response quality through repetition.
A production API was taken offline by 50 concurrent requests, each engineered to maximize token output by asking for recursive 'explain in more detail' chains.
Service unavailability, cost explosion, and quality degradation for legitimate users.
AASA tests all 10 categories at every layer — endpoint, tool calls, RAG sources, and web search. You get scored results, not a checklist.
Sign up required · Works with any agent API · Full-stack layer testing · Intro pricing on first audit