The Aurascape OWASP LLM mapping is precise, not a blanket compliance claim: Aurascape governs the OWASP Top 10 risks that execute at the interaction layer, and marks the model-internal ones as outside its runtime scope. For security architects, the risk is buying tools that promise coverage they cannot enforce. Aurascape governs prompts, responses, and tool calls inline, giving teams enforcement evidence per risk class.

Last updated: August 2026.

OWASP ranks Prompt Injection (LLM01), Sensitive Information Disclosure (LLM02), and Excessive Agency (LLM06) among the top risks for LLM applications (OWASP, 2025). The 2025 edition renumbered the list and added categories that reflect agent adoption, including System Prompt Leakage (LLM07) and Unbounded Consumption (LLM10). Control owners should note one thing: the 2023 edition used different numbering and lacked these agent-focused categories, so a control mapped to a 2023 label may not align to the current 2025 framing. This mapping uses the 2025 categories throughout.

Destination-based controls identify the AI service, but they often lack the conversation context needed to judge intent, data, response, and action. Interaction-layer coverage means governing the live AI exchange itself, the prompt, the response, and any tool call, rather than the network destination it travels to. Aurascape’s AI Proxy secures the intelligence channel (the model channel) and the Zero-Bypass MCP Gateway secures the tool-execution channel, so a risk gets caught where it executes for traffic that traverses the Aurascape proxy.

The tier labels below carry consistent meaning. Strong means an Aurascape control point governs the risk inline for traffic traversing the proxy. Moderate means Aurascape detects and acts on the risk when it matches a data pattern in a governed exchange. Partial means Aurascape contributes discovery or evidence, while another owner holds the primary control. Out of runtime scope means the risk lives upstream in model, retrieval, or training design, where a runtime proxy is not the right control point. The tier map applies across all ten categories:

LLM01 Prompt Injection

Prompt injection means an attacker plants instructions in a prompt, a document, a webpage, or a tool result so the model follows them instead of its operator. It matters because injected instructions can redirect an agent toward data exfiltration or unauthorized actions, and OWASP ranks it the top LLM risk (OWASP, 2025). EchoLeak (CVE-2025-32711) shows the indirect path reaching a production AI assistant (NVD, 2025).

Aurascape inspects prompts at the prompt boundary and tool calls at the tool-call boundary, so injected instructions that reach a governed action meet policy before that action runs. Coverage tier: strong for both direct and indirect paths that surface in a governed AI exchange.

LLM02 Sensitive Information Disclosure

Sensitive information disclosure means proprietary or regulated data leaves through a prompt an employee sends or a response the model returns. It matters because 43% of workers admit sharing sensitive workplace information with AI tools without employer knowledge (National Cybersecurity Alliance, 2025).

Aurascape classifies data in real time in both directions with 600+ real-time data classifiers, then applies inline policy actions at the prompt boundary and the response boundary. It redacts sensitive content before it reaches a public model or a downstream tool (Aurascape, 2026). Coverage tier: strong at the runtime data boundary.

LLM03 Supply Chain

Supply chain risk means compromised models, datasets, plugins, or MCP servers enter an environment through a third party. It matters because most MCP endpoints sit exposed and unauthenticated: researchers found more than 12,520 internet-accessible MCP services, mostly unauthenticated, and the protocol does not require authentication by default (Censys, 2026).

Aurascape discovers AI apps, accounts, and agents across the network, endpoint, and API planes. Its discovery process also evaluates new AI tools before first employee use, surfacing unknown apps and agent connections (Aurascape, 2026). It does not vet model training provenance, which belongs to the model developer. Coverage tier: partial, strongest on discovery of the connected surface.

LLM04 Data and Model Poisoning (Out of Runtime Scope)

Data and model poisoning means training data or fine-tuning inputs are corrupted to alter model behavior. The team that builds or fine-tunes the model owns this risk, and the evidence lives in dataset provenance and training pipeline controls. A runtime proxy sees the exchange after the model is already trained, so it is not the right control point for this risk. Aurascape operates at the runtime interaction layer and does not govern training or fine-tuning pipelines. Coverage tier: out of runtime scope.

LLM05 Improper Output Handling

Improper output handling means an application trusts model output and passes it to a browser, a shell, or another system without inspection. It matters because a manipulated response can carry markup or commands that execute downstream, for example AI-generated markup rendered in a browser or a generated command sent to a shell. Prompt-only inspection misses this because it never reads the response.

Aurascape inspects the response side of governed exchanges at the response boundary. It can warn, block, or redact output before it flows onward. Where output feeds a tool call, the tool-call boundary adds a second checkpoint (Aurascape, 2026). Coverage tier: moderate to strong at the response boundary.

LLM06 Excessive Agency

Excessive agency means an agent holds more permission, tools, or autonomy than its task requires, so a single bad instruction can reach high-impact actions. It matters because agent blast radius scales with tool access, and 82% of organizations have unknown AI agents while 65% had agent-related incidents (Cloud Security Alliance, 2026). Model Context Protocol (MCP) is one common tool-execution pattern here, not the whole agent access-control problem.

Aurascape discovers and secures local AI agents and their interactions, and adds a Zero-Bypass MCP Gateway that marks approved tool calls and blocks unmarked ones, governing the agent-to-tool execution path inline for approved tool-execution paths rather than observing it after the fact (Aurascape, 2026). That makes excessive agency a control at the tool-call boundary rather than a monitoring problem after execution. Coverage tier: strong.

LLM07 System Prompt Leakage

System prompt leakage means the instructions and secrets embedded in a system prompt escape into a response, exposing logic, credentials, or guardrails an attacker can bypass. This category is new in the 2025 edition (OWASP, 2025). It matters because leaked system context hands an attacker a blueprint for the next attack.

Aurascape inspects responses inline in governed exchanges and classifies sensitive content in both directions at the response boundary, so it detects configuration or credential patterns surfacing in an exchange and applies a block or redact action (Aurascape, 2026). Coverage tier: moderate, strongest when the leaked material matches a data classifier.

LLM08 Vector and Embedding Weaknesses (Out of Runtime Scope)

Vector and embedding weaknesses means retrieval pipelines and vector stores are manipulated to return malicious or biased context. The team that designs the retrieval and embedding pipeline owns this risk, and the evidence lives in index integrity and access controls on the vector store. A runtime proxy inspects the resulting exchange, not the retrieval internals, so it is not the right control point. Aurascape does not govern the retrieval pipeline. Coverage tier: out of runtime scope.

LLM09 Misinformation (Out of Runtime Scope)

Misinformation means the model generates plausible but factually incorrect output. The model developer and the application team that grounds and validates output own this risk, and the evidence lives in model evaluation and human review. A runtime proxy cannot judge factual accuracy, so it is not the right control point. Where misinformation surfaces as sensitive content in a response, LLM05 and LLM02 response-boundary controls still apply to that exchange, but the root cause sits upstream. Coverage tier: out of runtime scope.

LLM10 Unbounded Consumption

Unbounded consumption means uncontrolled query volume or resource use drives runaway cost, denial of service, or model extraction. It matters because agent loops and automated pipelines generate high-volume traffic faster than human users, making resource governance a control requirement rather than an operations afterthought.

Because AI exchanges traverse the AI Proxy inline, Aurascape creates per-account and per-agent interaction evidence at the proxy. Model provider or application controls still handle hard quotas and resource limits. Coverage tier: partial, complementary to model provider and application rate limits.

How Aurascape Compares to Network-Only AI Governance

Architects weighing an OWASP mapping should separate what network-only or prompt-only controls can evidence from what interaction-layer enforcement can evidence. The side-by-side comparison below keeps Aurascape in the final column and states published facts per capability:

Applying the Mapping in Practice

Architects should separate detection from enforcement: a useful OWASP control map names the point where a prompt, response, or tool call can be stopped. Shadow AI discovery matters because a control map is incomplete if it covers only the AI tools security already knows about. Aurascape discovers shadow apps, personal accounts, and embedded SaaS AI features, so coverage extends across the AI surface. To apply the mapping, work in order:

1. Discover the full AI surface: sanctioned apps, shadow apps, personal accounts, embedded SaaS AI, and local agents, across network, endpoint, and API planes.
2. Classify data inline in both directions at the input and output boundaries to cover LLM02 and LLM07.
3. Set the tool-call boundary: mark approved calls, block unmarked ones, to contain LLM06 on approved tool-execution paths.
4. Calibrate policy actions per category: allow, coach, warn, block, redact, rather than one blanket setting across all risk classes.
5. Record interaction records for audit and effectiveness, governed by role-based access control (RBAC) for privacy, and document the model-internal risks handled upstream as out of runtime scope.

This mapping also supports broader governance work. The NIST AI RMF govern and map functions, ISO 42001 operational controls, and EU AI Act risk documentation all benefit from per-category enforcement records, though those records support audit readiness rather than automatically satisfying any legal obligation. See the Aurascape ISO 42001 technical controls mapping and the enterprise AI governance frameworks guide for how these intersect.

Frequently Asked Questions

Which OWASP LLM risks does Aurascape cover most strongly?

Aurascape covers the risks at the input boundary, output boundary, and tool-call boundary most strongly: LLM01 prompt injection, LLM02 sensitive information disclosure, LLM05 improper output handling, and LLM06 excessive agency are all strong. LLM07 system prompt leakage is moderate.

Which OWASP risks are outside Aurascape’s runtime scope?

LLM04 data and model poisoning, LLM08 vector and embedding weaknesses, and LLM09 misinformation fall outside Aurascape’s runtime scope. They live in training, retrieval, and generation design, and the model and application teams address them upstream, not at a runtime proxy.

Does the mapping use the 2023 or 2025 OWASP edition?

This mapping uses the 2025 edition throughout. The 2025 list renumbered categories and added System Prompt Leakage and Unbounded Consumption, which did not exist in the 2023 edition, so a control mapped to a 2023 label may not align to the current framing (OWASP, 2025).

How is the OWASP Top 10 for LLM Applications different from the OWASP Agentic Top 10?

The OWASP Top 10 for LLM Applications addresses risks in how an application uses a model, such as prompt injection, sensitive information disclosure, and excessive agency. The OWASP Agentic Top 10 addresses risks specific to multi-step autonomous agents, such as goal manipulation and inter-agent trust. They overlap where an agent invokes tools, but they are distinct lists with different scopes, and this page maps the LLM Applications list.

How does Aurascape handle LLM06 excessive agency specifically?

Aurascape discovers local AI agents and governs the agent-to-tool execution path with the Zero-Bypass MCP Gateway, which marks approved tool calls and blocks unmarked ones before they run on approved tool-execution paths. That turns excessive agency into a control at the tool-call boundary rather than an after-the-fact alert.

What evidence does Aurascape produce for auditors per OWASP category?

Aurascape generates interaction records for audit and effectiveness, governed by role-based access control (RBAC) for privacy. Records show which account or agent acted, what data moved, what the AI returned, which tool was invoked, and what policy decision occurred, giving each OWASP category an enforcement receipt that supports audit and governance work.

How does this OWASP mapping relate to NIST AI RMF or ISO 42001 evidence requirements?

The NIST AI RMF govern and map functions and ISO 42001 operational controls both call for documented, per-category risk treatment. Per-OWASP-category enforcement records from the interaction layer support that documentation and give auditors traceable evidence that specific risks were evaluated at the control point. Use the OWASP LLM security checklist for implementation steps.

Aurascape gives security architects a precise OWASP LLM mapping: inline enforcement at the input, output, and tool-call boundaries for the risks that execute in governed AI exchanges; honest out-of-scope disclosure for the model-internal ones; and per-category interaction records that support audit and distinguish enforcement from detection alone.

See how Aurascape maps to the OWASP Top 10 for LLM Applications in your environment →