The OWASP GenAI LLM Top 10 2026 is a risk catalogue, not a runtime control. A security review still has to answer which component contains each risk, which attack paths remain open, and what the customer must own.
The OWASP GenAI LLM Top 10 2026 describes these risks and their mitigations for developers, architects, security teams, and CISOs.[1]
AgentPaaS addresses the part of the problem where an agent turns untrusted input into an external effect. It uses isolated execution, default-deny egress, brokered credentials, signed authority, and tamper-evident audit records. Those controls contain some risks at runtime. They do not certify the application, model, data, or supply chain.
This is the AgentPaaS coverage map for the OWASP GenAI LLM Top 10 2026. The canonical project source is also available.[2] The related AgentPaaS runtime security post explains the enforcement model and the threat scenario behind these controls.
How to read this map
Covered means AgentPaaS has a runtime control that contains part of the risk. It does not mean the risk is prevented. Partial means the runtime controls one attack path while leaving application or model-level work to the customer. Not covered means we make no product claim for that risk.
OWASP 2026 coverage
LLM01: Prompt Injection
Covered for blast radius
Runtime covers: Isolated execution, default-deny egress, brokered credentials, and signed audit decisions contain the effects of a manipulated agent.
Outside the claim: The model can still follow the injection. AgentPaaS does not prevent prompt injection.
LLM02: Sensitive Information Disclosure
Covered on the governed path
Runtime covers: Credentials stay outside the agent. Gateway policy controls approved destinations and the PII path.
Outside the claim: Customers still own source permissions, data classification, and the policy for each allowed destination.
LLM03: Excessive Agency
Covered
Runtime covers: Signed authority, per-run identity, policy enforcement, and child-workflow lineage limit what an agent or delegated child can do.
Outside the claim: A broad customer policy can still authorize a harmful action.
LLM04: Supply Chain
Partial
Runtime covers: Signed `.agentpaas` bundles, publisher identity, provenance, and admission checks cover the deployed artifact path.
Outside the claim: AgentPaaS does not vouch for every upstream dependency, model, or service in the supply chain.
LLM05: Data and Model Poisoning
Not covered
Runtime covers: Runtime controls can contain an agent that consumes poisoned data.
Outside the claim: AgentPaaS does not validate training data, model weights, or the truth of source content.
LLM06: Unbounded Consumption
Covered by the governed path
Runtime covers: Gateway-side budgets, metering, and bounded workflow execution limit governed consumption.
Outside the claim: Cost and rate policy still needs to match the customer's workload and provider contracts.
LLM07: Misinformation
Not covered
Runtime covers: Audit records show what the workflow did and which sources or tools it used.
Outside the claim: AgentPaaS does not establish that an answer is true or safe to publish.
LLM08: Hidden Context Exposure
Covered for runtime secrets and lineage
Runtime covers: Brokered credentials keep long-lived secrets out of the agent. Audit lineage records parent, child, tool, and gateway decisions.
Outside the claim: Application context, prompts, and retrieved data still need customer-side access controls.
LLM09: Vector and Embedding Weaknesses
Not covered
Runtime covers: Egress and identity controls limit what a compromised retrieval workflow can reach.
Outside the claim: AgentPaaS does not assess embedding integrity, retrieval quality, or vector-store poisoning.
LLM10: Improper Output Handling
Partial
Runtime covers: Sandboxed execution and allow-listed egress contain code or network effects from an unsafe output.
Outside the claim: AgentPaaS does not replace output encoding, schema validation, or application-specific sink controls.
The coverage is deliberately uneven. Runtime containment covers the path where an agent turns untrusted input into an external effect. It does not turn data quality, model behavior, dependency trust, or application output handling into platform guarantees.
What a CISO should ask the vendor
- Which component denies an undeclared destination?
- Can the agent read a reusable credential, or does a broker authorize each request?
- Can a child agent inherit broader authority than its parent?
- Can an operator trace a denied action to the parent run and policy version?
- Which OWASP risks remain the customer’s responsibility?
If the answer to the first question is that the model will refuse, keep working. That is a hope, not a control. For the broader runtime threat model, read AgentPaaS runtime security for agents.
FAQ
Does AgentPaaS cover the OWASP GenAI LLM Top 10 2026?
AgentPaaS contains parts of several OWASP risks at runtime. The coverage is risk-specific and does not mean AgentPaaS is certified against the OWASP list.
Does AgentPaaS prevent prompt injection?
No. AgentPaaS limits the blast radius of a manipulated agent with isolation, default-deny egress, brokered credentials, and audit records.
Which OWASP risks remain outside AgentPaaS runtime controls?
Data and model poisoning, misinformation, and vector or embedding weaknesses remain outside the product claim. Supply chain and improper output handling receive partial runtime coverage, with application and dependency responsibilities remaining with the customer.
What should a security team validate in a proof of concept?
Send a controlled poisoned input, attempt an undeclared outbound request, verify that credentials remain outside the agent, and trace the denial back through parent-child lineage and the audit record.
Sources
[1] OWASP GenAI LLM Top 10 2026: https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/ [2] OWASP GenAI LLM Top 10 2026 canonical source: https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/tree/main/2026/final