OWASP LLM Top 10: Mapping an AI Workspace

The OWASP Top 10 for LLM Applications is the OWASP GenAI Security Project’s ranked list of the top ten security risks in applications built on large language models. This map puts each 2025 risk beside the control Insulin’s documentation describes, the setting that owns it, and what the documentation doesn’t promise. It is Fours’ reading of its own docs, not OWASP’s assessment.

---

If a security review asks how an AI workspace handles the OWASP Top 10 for LLM Applications, it is asking about the model layer: what reaches the model, what leaves it, what it retrieves and what it consumes. The agents and tools around the model are the other half, and the OWASP Agentic Top 10 checklist maps Insulin against that list.

This map takes the ten LLM risks one row at a time: what each looks like in an AI workspace, the control Insulin’s documentation describes and where it’s set, and what the documentation doesn’t promise. Six rows have no counterpart in the agentic checklist, and the other four point across to it rather than repeat it. Every control comes from Insulin’s live documentation, OWASP has not reviewed the table, and no row claims a risk is solved.

What is the OWASP Top 10 for LLM Applications?

The OWASP Top 10 for LLM Applications is the OWASP GenAI Security Project’s ranked list of ten security risks in applications that use large language models (LLMs), each with examples and mitigations. The 2025 edition, dated November 17, 2024 on OWASP’s resource page, numbers them LLM01:2025 to LLM10:2025.

Each entry gives a description, common examples, prevention and mitigation strategies, and example attack scenarios. Many of the mitigations are application controls rather than model fixes: access control on the data a model retrieves, rate limits and quotas, and validating output before it goes downstream.

The LLM list and the agentic list split the ground between them. OWASP’s 2026 edition draws the line: the LLM list “owns the risk when the model is a component inside your application”, and once the model becomes an actor, with tools, memory and consequences downstream, the risk moves to the agentic list. An AI workspace is both, so a review needs both.

Which edition does this map, 2025 or 2026?

This map follows the 2025 edition and gives each row’s 2026 number beside it. OWASP’s Top 10 page still presents the 2025 entries. On August 3, 2026, the project also posted a 2026 edition to its resource library, which it calls “the latest”. It keeps nine of the ten names, moves Excessive Agency up to third and Improper Output Handling down to tenth, and renames System Prompt Leakage as Hidden Context Exposure, a broader entry.

A questionnaire may cite either numbering, so every row below carries both, and the risk names do the matching.

How does Insulin map to each OWASP LLM risk?

Row by row: the 2025 risk, what it looks like in an AI workspace, the control Insulin’s documentation describes and where it’s set, and what that documentation doesn’t promise. The second column paraphrases OWASP’s 2025 description of each risk.

OWASP risk	What it looks like in an AI workspace	What Insulin’s docs describe, and where it’s set	What the docs don’t promise
LLM01:2025 Prompt Injection (2026: LLM01)	Text an agent reads, such as an email, a document or a web page, carries instructions that change what the model does, even text a person can’t see	A Text the AI read line on every HTML email in Inbox, with a warning when that text holds a passage the visible email doesn’t show; auto-send rules that get no outside context. The agentic checklist’s ASI01 row has the detail	The hidden-text check warns; it “never blocks anything”
LLM02:2025 Sensitive Information Disclosure (2026: LLM02)	Personal, financial or confidential data reaches the wrong reader through an answer, a shared resource or an outgoing reply, or ends up with a model vendor or in its training data	”Even an organization admin cannot open an org knowledge base they were not shared on”; Planner, the organization-channel coordinator, “never reads your personal integrations, knowledge bases, or memory”; Fours event payloads scrubbed of emails, secrets and tokens before a push job’s agent sees them; an auto-send reply held for review when its subject or body holds what looks like a card number, a US Social Security number or a private key. Which vendors see prompts: the AI Model Policy (LLM03)	The pattern check covers auto-send replies only; no such check is described for a chat answer or a draft for review. For training, check Fours’ terms and each model provider’s, and see what to ask a vendor about training on your data
LLM03:2025 Supply Chain (2026: LLM04)	The models and providers behind each answer, and the add-ons agents load, come from third parties: a model can be outdated or tampered with, or a provider’s terms can let it train on your data	The AI Model Policy under Settings → Organization → AI Model Policy: an ordered allow-list, where AI features use only the providers on it and an empty list means no restriction. Every Fours-hosted model resolves through one integration, the hosted-model (DeepInfra) row, so a non-empty list without that row drops the hosted pool. With the platform-key fallback toggle off, the organization is bring-your-own-key only, and an allowed provider with no key fails closed. Skills: the ASI04 row	The hosted-model (DeepInfra) row “pins no particular model”. The metering page names the hosted models, but not how one is chosen or checked. Ask
LLM04:2025 Data and Model Poisoning (2026: LLM05)	Planted or tampered content in what agents retrieve or remember, such as a knowledge-base document or a stored memory, skews later answers	Only a knowledge base’s Owner, Admin or Editor adds or syncs content; Deprecate takes a suspect file out of search, and no sync brings it back; your own memories can be edited or deleted under Settings → Personal → Memory. The ASI06 row has the detail	The docs describe no check on what a document or memory says before agents use it
LLM05:2025 Improper Output Handling (2026: LLM10)	Model output reaches a person or system unchecked: a drafted email carries a phishing link, or generated text is rendered or run without escaping	Inbox’s last check holds an auto-send reply carrying a link or email address that isn’t the sender’s own or at the sender’s domain; Send takes two steps because “sending is irreversible”; “A CRM action is never executed silently”: it waits for Run in chat, which reaches only the CRM connection the action came from (when Inbox acts or asks)	How the workspace encodes model output before rendering it, in a chat reply or a job’s Markdown Result card, isn’t described. Ask
LLM06:2025 Excessive Agency (2026: LLM03)	An agent has more functionality, permissions or autonomy than its task needs, so a confused or manipulated model can do real damage	Each agent’s integration allowlist; knowledge bases attached in Read or Edit mode, never delete; organization-agent integrations changed only by an org admin; the account behind each connection, whose permissions set the ceiling, as read-only access for AI agents maps system by system. The ASI02 row has the detail	Whether a tool call pauses for approval depends on where the agent runs, as where the approval gate is armed maps. Scope the agent rather than count on a pause
LLM07:2025 System Prompt Leakage (2026: LLM08 Hidden Context Exposure)	An agent’s instructions hold something its audience shouldn’t read, such as a credential or an internal rule, or keeping the prompt hidden is treated as the control	Everyone an agent is shared with sees its configuration, system prompt included; below Editor, the settings render read-only and “you see the full configuration” (working with a shared resource); the agent’s description is generated by summarizing its system prompt; credentials belong in integrations, and an agent reports a connection’s details without them: “Credentials are never returned”	No guard against an agent revealing its own prompt is described. OWASP’s LLM07 entry says a system prompt “should not be considered a secret”
LLM08:2025 Vector and Embedding Weaknesses (2026: LLM09)	Retrieval returns documents the asker shouldn’t see, one group’s content surfaces in another’s answers, or stored embeddings give the source text away	Each knowledge base attached to an agent has an access mode, Read or Edit, and Edit never deletes; an organization knowledge base opens only through a share, never through an org role alone (which agents see which documents); up to three knowledge bases per search, each result citing its source document; one embedding model per knowledge base, and changing it re-embeds every document without mixing results across two models	How stored embeddings are kept apart between organizations, or protected against inversion, isn’t described. Ask
LLM09:2025 Misinformation (2026: LLM07)	An agent states something false or unsupported with confidence, and someone acts on it without checking	Each knowledge-base result cites its source document (why answers need citations); Test search shows what an agent would retrieve, with each result’s source and relevance score, before you attach the knowledge base; Deprecate takes a stale file out of search without deleting it	A citation shows where an answer came from; no check that the answer matches its source is described
LLM10:2025 Unbounded Consumption (2026: LLM06)	Runaway or abusive use, such as an automation loop or a flood of runs or uploads, drives up cost or exhausts capacity	A monthly spending limit on Settings → Billing that pauses AI requests for the rest of the month and blocks rather than warns (why AI is paused); automatic top-up that needs a saved payment method and a top-up larger than its trigger, and stops at the limit; automatic job runs capped at 60 an hour per job and 300 an hour per organization, with one run in flight per job; uploads of up to 10 files per message, 25 MB each	The monthly limit is the only spend cap your organization sets, and it covers everyone at once. The job caps are fixed, and a manual job’s Run skips them

Four rows overlap the agentic list, so each points to the matching row of the agentic checklist instead of repeating it: LLM01 to ASI01, LLM03 to ASI04, LLM04 to ASI06 and LLM06 to ASI02. Those pairs are Fours’ choice of the closest row in that checklist. The crosswalk in OWASP’s 2026 edition maps most LLM risks to several agentic ones, these four pairs among them.

Which Insulin settings do these controls depend on?

Five, and your organization sets each of them: the AI Model Policy, knowledge-base shares and access modes, agent sharing, Inbox auto-send rules, and the monthly spending limit.

• AI Model Policy (LLM02, LLM03). It sits under Settings → Organization → AI Model Policy, among the organization settings an org ADMIN manages. List the providers that may serve your prompts, keep the hosted-model (DeepInfra) row on a non-empty list if you want the hosted models, and turn off the platform-key fallback toggle only once every allowed provider has a connected key, because nothing falls back to Fours after that.
• Knowledge-base shares and access modes (LLM02, LLM04, LLM08). An org role grants no access to an organization knowledge base by itself, so share each one only with the people who need it, and attach it to an agent in Edit mode only when the agent should maintain it.
• Agent sharing (LLM07). Everyone an agent is shared with can read its configuration, so take credentials and anything the widest audience shouldn’t read out of the system prompt before you share it with the whole organization. Who can read your AI agent’s system prompt walks through who sees what.
• Inbox auto-send rules (LLM02, LLM05). Insulin sends mail without review only through an auto-send rule written on the Inbox Rules page. The chat rail refuses to create one, and every other reply waits for your Send.
• Monthly spending limit (LLM10). Set on Settings → Billing, it pauses AI requests for the whole organization once reached, stops automatic top-up too, and never just warns. Set it as a hard stop, not as an alert.

What should a security review ask Fours about the LLM Top 10?

Three rows rest on behaviour the documentation doesn’t describe: how the Fours-hosted models are chosen and checked (LLM03), how rendered output is encoded (LLM05), and how stored embeddings are isolated (LLM08). Put each to Fours in writing:

1. How is a model chosen and checked before it serves prompts in the Fours-hosted pool? The documentation names the pool’s models and the one integration they resolve through, not how they are vetted.
2. How does the workspace encode model output before rendering it, in a chat reply or a job’s Result card? The documentation describes the review steps before mail goes out and before a CRM write, not output encoding.
3. How are stored embeddings kept apart between organizations, and protected against inversion? The documentation says who can open a knowledge base, not how its vectors are stored.

LLM07 needs no question. Treat every system prompt as readable by everyone its agent is shared with, and keep secrets in integrations.

Frequently asked questions

Is this map an OWASP assessment of Insulin?

No. OWASP hasn’t reviewed it, and it makes no certification claim. It is Fours’ reading of Insulin’s live documentation against the 2025 list, and the last column says where each control stops.

What are the ten risks in the OWASP Top 10 for LLM Applications 2025?

They are LLM01:2025 Prompt Injection, LLM02:2025 Sensitive Information Disclosure, LLM03:2025 Supply Chain, LLM04:2025 Data and Model Poisoning, LLM05:2025 Improper Output Handling, LLM06:2025 Excessive Agency, LLM07:2025 System Prompt Leakage, LLM08:2025 Vector and Embedding Weaknesses, LLM09:2025 Misinformation and LLM10:2025 Unbounded Consumption.

What changed in the 2026 edition of the OWASP LLM Top 10?

Mostly the order. The 2026 edition, posted on August 3, 2026, keeps nine of the ten names, moves Excessive Agency up to third and renames System Prompt Leakage as Hidden Context Exposure, a broader entry. Several other entries widen in scope. Each row above gives its 2026 number.

Does Insulin cap how much AI an organization can use?

Yes. A monthly spending limit on Settings → Billing pauses AI requests for the rest of the month; it blocks rather than warns. Automatic job runs are capped at 60 an hour per job and 300 per organization, though a manual job’s Run skips the caps.

Which OWASP LLM risks do Insulin’s docs say least about?

LLM03, LLM05 and LLM08. The documentation names the hosted models but not how they are vetted, describes reviews before mail and CRM writes but not how rendered output is encoded, and says who can open a knowledge base but not how embeddings are isolated.

Takeaways

• Six of the ten rows are model-layer risks the agentic checklist doesn’t cover: sensitive data, output handling, the system prompt, retrieval, misinformation and consumption. The other four point to their agentic rows.
• Most rows turn on settings your organization owns: the AI Model Policy, knowledge-base shares and modes, agent sharing, auto-send rules and the monthly spending limit.
• Three rows end in questions for Fours: how the hosted models are vetted (LLM03), how rendered output is encoded (LLM05) and how stored embeddings are isolated (LLM08). Treat every system prompt as readable.

OWASP’s list covers the model layer, and a vendor review asks about more than that. Take this map into your review with the 25 security questions to ask an enterprise AI agent vendor, and see how Insulin knowledge bases ground answers in your own documents, with citations.