Testing checklist

OWASP LLM Top-10 for AI agents — as runnable evals

Most OWASP LLM Top-10 checklists are static lists you read and nod at. This one maps each risk to a runnable evaluator for your agent — generated from its real traces, so ticking the box means you actually tested it.

The OWASP Top-10 for LLM Applications is the reference risk list for LLM systems. It's a strong framework and a weak checklist — because "check for prompt injection" isn't a test, it's a homework assignment. Below, each risk is paired with what it means for an agent specifically and the evsec evaluator or dataset that tests it. Where a risk is about build-time supply chain or infrastructure rather than agent behavior, we say so plainly rather than pretend a runtime eval covers it.

OWASP riskFor an agent, this is…Test with
LLM01 Prompt InjectionDirect and indirect injection that overrides instructions or hijacks tool use — including instructions hidden in retrieved documentsinjection eval · free tester
LLM02 Sensitive Information DisclosureLeaking PII, other customers' records, or secrets through the agent's data toolspii data-exfiltration
LLM06 Excessive AgencyState-changing tools (refund, delete, transfer) used past their guardrails under pressuresensitive-tool-use tool-abuse
LLM07 System Prompt LeakageExtracting the agent's instructions or tool schemassystem-prompt-leak
LLM09 MisinformationAnswers not grounded in the tool results / retrieved context the agent was givengroundedness
LLM08 Vector & Embedding WeaknessesPoisoned or adversarial content in the retrieval store steering behaviorinjection on retrieval spans + groundedness
LLM05 Improper Output HandlingDownstream systems trusting agent output that carries injected markup / commandsPartial — injection flags the vector; output sanitization is a code-side control
LLM10 Unbounded ConsumptionPrompt-driven loops or expensive tool storms driving cost/DoSObservability concern — track via cost/usage monitoring, not a security judge
LLM03 Supply Chain · LLM04 Data & Model Poisoning (training)Compromised models, dependencies, or training dataBuild-time / MLOps controls — outside runtime eval scope; noted for completeness
Honest scope: evsec generates runtime behavioral evals from traces. It covers the Top-10 risks that show up in what the agent says and does (LLM01, 02, 06, 07, 08, 09, and the vector for 05). Supply-chain and training-time risks (LLM03, LLM04) and pure infrastructure DoS (LLM10) need controls elsewhere — we flag them rather than overclaim coverage.

Why "runnable" changes the checklist

A static checklist tells you a risk exists. A runnable one tells you whether your agent is exposed to it — with a pass/fail result over real traffic, dated and repeatable. That's the difference between a document that says "we considered prompt injection" and evidence that says "our injection-resilience judge scored 0.98 over 2,000 production spans this week." The second is what an auditor, a customer security review, or an EU AI Act technical file actually wants.

Generate the whole checklist from one trace

evsec reads a sample of your agent's traffic and writes the evaluators for every runtime risk above — each tagged to its OWASP category. Try it on a bundled sample: no signup, no key.