State-Focused Crosswalk: OWASP LLM Top 10 2025 × Agentic Top 10 2026 × MITRE ATLAS

This page is a state-focused crosswalk between three published catalogs: the OWASP Top 10 for LLM Applications 2025, the OWASP Top 10 for Agentic Applications 2026, and MITRE ATLAS. Item names, identifiers, and versions are quoted from those projects. The relationship labels and the state-boundary analysis are SSA editorial synthesis, not an official equivalence table.

What it is

Each row starts from a security thread expressed as a state transition, then records what each catalog calls the nearest thing, then states the boundary that keeps the row from collapsing into a synonym set.

Provenance differs by column, and the difference is deliberate:

The OWASP LLM and OWASP Agentic columns are Standard Terms. Where they appear together in one row, the pairing is also standard-owned: Appendix A of the Agentic document publishes OWASP's own ASI-to-LLM mapping, and this page follows it rather than inventing a parallel one.
The MITRE ATLAS column is a Standard Term for the identifiers and names. Selecting which ATLAS techniques belong beside a given OWASP row is SSA judgement.
The relationship label and the boundary column are SSA editorial synthesis.

Because the page spans every row rather than describing one attack, its classification fields read `Multiple`. Target state, entry path, persistence, and intended effect belong to individual rows and to the focused articles, and assigning one representative value to the whole crosswalk would misdescribe it.

What it is not

A replacement for any framework's own definitions, examples, mitigations, or version history.
A claim that similarly named items have identical scope.
A complete mapping of every technique, sub-technique, control, or agent failure mode.
An official OWASP or MITRE product, or a mapping endorsed by either project.
Attack payloads, procedures, or framework entries presented as an operational sequence.

In scope

All ten OWASP Agentic Top 10 2026 risks, ASI01 through ASI10.
The OWASP LLM Top 10 2025 risks that OWASP itself associates with those agentic risks.
The MITRE ATLAS techniques in release v2026.06 that describe attacker behavior against agent runtime state, tools, configuration, or identity.
State targets, trust boundaries, persistence, and control implications for each row.
Explicit statements of where a catalog has no direct counterpart.

What the table deliberately leaves out: `LLM10:2025 Unbounded Consumption`, which OWASP's own appendix does not tie to an agentic risk and which is not a state-integrity thread; ATLAS techniques covering model extraction, adversarial examples, dataset integrity, and physical access, which sit outside runtime agent state; and every sub-technique not needed to distinguish one row from another.

Why the lists do not align one to one

The two OWASP lists are risk lists at different system scopes. The LLM Top 10 for 2025 covers risks in an LLM application, including `LLM01:2025 Prompt Injection`, `LLM04 Data and Model Poisoning`, `LLM06:2025 Excessive Agency`, `LLM07:2025 System Prompt Leakage`, and `LLM08:2025 Vector and Embedding Weaknesses` (OWASP Top 10 for LLM Applications 2025).

The Agentic Top 10 for 2026 covers agent-centered risks: `ASI01 Agent Goal Hijack`, `ASI02 Tool Misuse and Exploitation`, `ASI03 Identity and Privilege Abuse`, `ASI04 Agentic Supply Chain Vulnerabilities`, `ASI05 Unexpected Code Execution (RCE)`, `ASI06 Memory & Context Poisoning`, `ASI07 Insecure Inter-Agent Communication`, `ASI08 Cascading Failures`, `ASI09 Human-Agent Trust Exploitation`, and `ASI10 Rogue Agents` (OWASP Top 10 for Agentic Applications 2026).

MITRE ATLAS organizes attacker behavior rather than producing another Top 10. Release v2026.06 contains a large agent-oriented technique set, including `AML.T0051 LLM Prompt Injection` with the sub-techniques `.000 Direct`, `.001 Indirect`, and `.002 Triggered`; `AML.T0054 LLM Jailbreak` as a separate technique rather than a prompt-injection variant; and `AML.T0080 AI Agent Context Poisoning` with `.000 Memory` and `.001 Thread` (MITRE ATLAS; ATLAS release v2026.06).

The practical consequence is that one incident may map to multiple OWASP risks and multiple ATLAS behaviors. A match can be direct at the topic level while remaining different in definition, phase, or system boundary. OWASP states the same thing in its own appendix note: an ASI entry often blends several LLM entries.

Mapping method

SSA uses exactly three relationship labels, and no others appear in the table.

`Strong overlap`: the items in the row center on substantially the same state or instruction-integrity problem, although their formal definitions still differ.
`Partial`: at least one item in the row describes an entry path, enabling condition, consequence, or amplification of another rather than the same problem.
`No direct counterpart`: at least one catalog has no item-level match in the version cited, and the boundary column states which one.

The label describes the row as a whole. Where a row mixes a standard-owned pairing with an SSA-selected ATLAS entry, the boundary column says which part is weaker. Each row also identifies the state transition that makes the relationship useful, so that title similarity cannot become false equivalence.

State-focused crosswalk

| Security thread | OWASP LLM Top 10 2025 | OWASP Agentic Top 10 2026 | MITRE ATLAS v2026.06 | SSA relationship | Boundary that prevents false equivalence | | --- | --- | --- | --- | --- | --- | | Instruction influence becomes goal redirection | `LLM01:2025 Prompt Injection`; `LLM06:2025 Excessive Agency` | `ASI01 Agent Goal Hijack` | `AML.T0051 LLM Prompt Injection` and its sub-techniques `.000 Direct`, `.001 Indirect`, `.002 Triggered` | Partial | LLM01 centers on instruction influence, ASI01 on the agent's governing objective, ATLAS on attacker behavior. A prompt injection can occur with no durable goal change. `AML.T0054 LLM Jailbreak` is a separate ATLAS technique about bypassing model restrictions and is not the counterpart for this row. | | Malicious state survives in context or memory | `LLM01:2025 Prompt Injection`; `LLM04 Data and Model Poisoning`; `LLM08:2025 Vector and Embedding Weaknesses` | `ASI06 Memory & Context Poisoning` | `AML.T0080 AI Agent Context Poisoning`; `AML.T0080.000 Memory`; `AML.T0080.001 Thread`; `AML.T0070 RAG Poisoning` for the retrieval layer | Strong overlap | LLM04 reaches training data and model artifacts beyond runtime memory. LLM08 centers on retrieval infrastructure. The agentic and ATLAS items address operative agent context directly. Storage layer still differs between memory, thread, and retrieval index. | | Compromised state gains external effect through capability | `LLM06:2025 Excessive Agency` | `ASI02 Tool Misuse and Exploitation` | `AML.T0053 AI Agent Tool Invocation`; `AML.T0086 Exfiltration via AI Agent Tool Invocation`; `AML.T0101 Data Destruction via AI Agent Tool Invocation` | Partial | Excessive authority is an enabling condition, tool misuse is the agentic outcome, and the ATLAS entries are observed behaviors. None of them alone establishes that state was poisoned. | | Agent identity or delegated privilege is abused | `LLM01:2025 Prompt Injection`; `LLM02:2025 Sensitive Information Disclosure`; `LLM06:2025 Excessive Agency` | `ASI03 Identity and Privilege Abuse` | `AML.T0012 Valid Accounts`; `AML.T0055 Unsecured Credentials`; `AML.T0083 Credentials from AI Agent Configuration`; `AML.T0098 AI Agent Tool Credential Harvesting` | Partial | The OWASP items describe how the abuse becomes possible and what it exposes. The ATLAS entries describe credential and account behavior that may or may not involve any change to agent state. | | Tooling or dependency supply chain is compromised | `LLM03:2025 Supply Chain` | `ASI04 Agentic Supply Chain Vulnerabilities` | `AML.T0010 AI Supply Chain Compromise` and `AML.T0010.005 AI Agent Tool`; `AML.T0104 Publish Poisoned AI Agent Tool`; `AML.T0110 AI Agent Tool Poisoning`; `AML.T0109 AI Supply Chain Rug Pull` | Strong overlap | LLM03 was written for static software and model dependencies. The agentic and ATLAS items add tool definitions and tool servers that can change after adoption, which is a different lifecycle even where the label matches. | | Untrusted content becomes executed code | `LLM01:2025 Prompt Injection`; `LLM05:2025 Improper Output Handling` | `ASI05 Unexpected Code Execution (RCE)` | `AML.T0050 Command and Scripting Interpreter`; `AML.T0011 User Execution` | Partial | Improper output handling is the application defect, ASI05 is the agentic consequence, and the ATLAS entries describe execution behavior reachable by many routes that have nothing to do with agent state. | | Confidential instructions become exposed | `LLM07:2025 System Prompt Leakage` | No dedicated entry; OWASP's own appendix associates no ASI risk with LLM07 | `AML.T0056 Extract LLM System Prompt`; `AML.T0069.002 System Prompt` | No direct counterpart | The missing counterpart is on the agentic side. Disclosure changes who can observe state; it is not the same transition as altering the state that governs a later decision. `ASI03` covers privilege consequences that may follow disclosure, which is a different claim. | | One agent's state influences another | `LLM02:2025 Sensitive Information Disclosure`; `LLM06:2025 Excessive Agency` | `ASI07 Insecure Inter-Agent Communication` | No dedicated inter-agent communication technique in v2026.06. `AML.T0080.001 Thread` is the nearest state-integrity effect when poisoned context crosses a thread or agent boundary; `AML.T0099 AI Agent Tool Data Poisoning` covers the data-channel variant | Partial | The communication weakness is the path and context poisoning is the state effect. Propagation requires evidence that another agent consumed the state, not merely that a channel was weak. | | A local failure spreads through dependent agents or actions | `LLM01:2025 Prompt Injection`; `LLM04 Data and Model Poisoning`; `LLM06:2025 Excessive Agency` | `ASI08 Cascading Failures` | No dedicated technique. `AML.T0061 LLM Prompt Self-Replication` is the nearest propagation behavior; `AML.T0034.002 Agentic Resource Consumption` covers a resource-side consequence | Partial | Cascading failure names a downstream consequence, and a state attack is only one possible cause. ATLAS has no entry for emergent multi-agent failure, so the ATLAS cell here is an analogy rather than a match. | | Humans are induced to trust or approve agent output | `LLM01:2025 Prompt Injection`; `LLM05:2025 Improper Output Handling`; `LLM06:2025 Excessive Agency`; `LLM09:2025 Misinformation` | `ASI09 Human-Agent Trust Exploitation` | `AML.T0067 LLM Trusted Output Components Manipulation`; `AML.T0077 LLM Response Rendering`; `AML.T0100 AI Agent Clickbait` | Partial | These entries concern the human decision surface rather than the agent's internal state. A compromised state can reach a person through them, but the same presentation problems occur with no state compromise at all. | | An agent acts outside intended governance | `LLM02:2025 Sensitive Information Disclosure`; `LLM09:2025 Misinformation` | `ASI10 Rogue Agents` | No dedicated technique for autonomous divergence. `AML.T0103 Deploy AI Agent` and `AML.T0108 AI Agent` describe adversary-deployed or adversary-controlled agents, which is a different condition | No direct counterpart | The missing counterpart is on the ATLAS side. ASI10 includes divergence that emerges without active attacker control, while the ATLAS entries presuppose an adversary operating the agent. Do not use them as evidence for each other. |

The table is intentionally asymmetric. A `No direct counterpart` cell means the named catalog, at the version cited above, has no item at the required precision. It is not a statement that the risk does not exist or that the project will not add one.

How to read the main overlaps

LLM01, ASI01, and the ATLAS prompt-injection family

These are often discussed together because they describe successive views of one security thread. LLM01 identifies the instruction-control risk. ASI01 identifies redirection of the agent's governing objective. ATLAS supplies attacker-behavior classification, and its `AML.T0051` sub-techniques separate direct, indirect, and triggered delivery. The useful mapping is a chain, so the row is labelled `Partial` rather than a synonym set.

For state analysis, ask whether the input remained a transient instruction conflict or changed operative goals, plans, memory, or later action selection. That evidence decides which rows apply.

One frequent error is worth naming. `AML.T0054 LLM Jailbreak` is sometimes cited alongside `AML.T0051` as though it were an injection variant. In ATLAS v2026.06 they are separate techniques: `AML.T0051` covers instructions introduced into the model's input, while `AML.T0054` covers bypassing the restrictions placed on a model's behavior. A jailbreak can be a step toward an injection outcome without being the same entry.

LLM04, LLM08, ASI06, and ATLAS context poisoning

This cluster has the strongest state-centered overlap. Each item can involve information being made untrustworthy before a later model or agent decision. The layers remain different:

`LLM04` reaches training data and model artifacts, so it is broader than runtime agent state.
`LLM08` focuses on vector and embedding weaknesses, which can affect what retrieval supplies.
`ASI06` focuses on agent state used across decisions, and OWASP notes that it excludes one-time input prompts already covered by `LLM01:2025`.
`AML.T0080` classifies the attacker behavior, and its sub-techniques separate durable memory from a single long-running thread.

A retrieval weakness is not automatically memory poisoning. Retrieved material must cross a write or decision boundary and become operative state. Likewise, a training or model poison can stay outside this site's runtime definition even though it belongs under `LLM04`.

LLM06, ASI02, and ASI10

These items explain impact and control boundaries better than they explain the initial state compromise. Excessive authority can turn a bad decision into an external action. `ASI02` names an agentic risk around capability use, and OWASP describes it as extending the `LLM06:2025` mitigations to multi-step workflows and tool orchestration. `ASI10` names a broader governance failure. The common defensive bridge is deterministic authorization and least privilege, not a claim that the three items are the same risk.

Target state and trust boundaries

The crosswalk becomes operationally useful when each classification is tied to evidence.

Input boundary: which user, retrieved, tool, artifact, or agent content entered the system?
State-write boundary: did that content become context, memory, goal, plan, or shared state?
Decision boundary: which state influenced the model or orchestration layer?
Authority boundary: which independent control permitted or blocked the external effect?
Propagation boundary: which later session, agent, or artifact inherited the state?

These boundaries support one-to-many mapping. An incident can begin under `LLM01:2025`, change a goal under `ASI01`, persist as `ASI06`, and be classified under `AML.T0080` without treating those entries as duplicate names.

Preconditions and impact of a bad mapping

A weak crosswalk fails when it matches words instead of system transitions. Three errors are common in review:

Treating an enabling condition such as excessive authority as if it were the poisoning mechanism.
Treating a consequence such as cascading failure as proof of a specific entry path.
Treating a technique catalog entry as if it carried the same prioritization and remediation scope as a Top 10 risk.

The impact is practical. Controls can be assigned to the wrong boundary, evidence can be collected at the wrong stage, and incident records can appear complete while omitting the compromised state itself. A precise mapping keeps source-owned terminology intact and adds the local state transition as a separate field.

Detection: observable signs that the crosswalk is being misused

A record lists three framework labels but cannot identify the state that changed.
A mapping is declared exact solely because two titles contain "context," "agent," or "poisoning."
An ASI consequence is used as evidence that a particular ATLAS behavior occurred.
`AML.T0054 LLM Jailbreak` is cited as a prompt-injection identifier.
`LLM06:2025 Excessive Agency` is recorded as the cause when the evidence only establishes impact amplification.
Framework version, identifier, or source URL is missing from the record.
A `No direct counterpart` cell is read as "the risk does not exist."
Controls are copied between rows without identifying the transition they block or a test that verifies them.

Defenses: using and maintaining the crosswalk

Use the crosswalk as an index into primary sources, then attach incident-specific evidence.

| Maintenance control | Purpose | Verification | | --- | --- | --- | | Store source project, item title, identifier, version, and URL separately | Prevent renamed or renumbered items from silently changing old records | Recheck every row when a source project publishes a new version. ATLAS has published a new data release roughly monthly through 2026. | | Store SSA relationship and rationale separately | Keep editorial synthesis distinct from source-owned definitions | Require a state-transition explanation for every strong or partial match. | | Prefer a project's own cross-mapping where one exists | Avoid competing with a standard's published view of itself | The ASI-to-LLM pairings on this page follow Appendix A of the Agentic document rather than an SSA reinterpretation. | | Permit one-to-many mappings | Represent entry path, state effect, consequence, and amplification together | Review whether each label contributes a distinct fact. | | Preserve explicit gaps | Avoid invented equivalence | Revisit a `No direct counterpart` cell only with a cited source in a named version. | | Link controls to boundaries | Turn classification into defense | Test the write, decision, authority, and propagation boundaries independently. |

For incident response, the framework label should never replace evidence. Preserve state diffs, provenance, promotion decisions, action authorizations, and propagation lineage. For architecture review, select controls based on the state transition, then use the source frameworks to broaden coverage.

Containment and recovery are also outside a simple label match. Quarantine compromised state, identify descendants, restore from a verified source, and revalidate actions and artifacts. The same response can address several mapped entries without implying the entries are synonyms.

Source versions used on this page

OWASP Top 10 for LLM Applications: Version 2025, published November 18, 2024, as printed on the document cover.
OWASP Top 10 for Agentic Applications: Version 2026, dated December 2025 on the document cover. The project resource page and the launch announcement are dated December 9, 2025, and the press release announcing the same document is dated December 10, 2025.
MITRE ATLAS: data release v2026.06, published June 30, 2026, with a collection modified date of May 27, 2026. Preceding releases were v2026.05 on May 27, 2026, v5.6.0 on May 4, 2026, v5.5.0 on March 31, 2026, and v5.4.0 on February 6, 2026. ATLAS moved from semantic version numbers to date-based release tags in May 2026, so a citation of a v5 number alone no longer identifies a current version.

Every identifier and name in the table above was read from these versions. A later release can rename, renumber, or add entries, so the change history below records when each check happened.

Related terms

Agent state attack: the SSA Working Term used as the state-centered organizing layer.
Compromised summaries and context compaction: a focused example spanning context poisoning and policy suppression.
Prompt injection: the `LLM01:2025` risk and an entry path that may remain ephemeral or alter later state.
Agent Goal Hijack: `ASI01` in the OWASP Agentic Top 10, Version 2026.
AI Agent Context Poisoning: `AML.T0080` in MITRE ATLAS v2026.06.

FAQ

Are OWASP LLM01 and ASI01 the same item?

No. They have a partial relationship, and OWASP itself pairs them: Appendix A of the Agentic document associates `ASI01 Agent Goal Hijack` with `LLM01:2025 Prompt Injection` and `LLM06:2025 Excessive Agency`. LLM01 concerns instruction influence at the LLM application layer. ASI01 concerns redirection of an agent's governing objective. One can lead to the other, but the state transition must be established.

Does every OWASP risk need an ATLAS match?

No. OWASP risk lists and an attacker-behavior catalog serve different purposes. Some risks are enabling conditions, exposure categories, or system consequences rather than a single attacker behavior. Two rows on this page record a missing counterpart for exactly that reason.

Is AML.T0054 the identifier for prompt injection?

No. In ATLAS v2026.06, `AML.T0054` is `LLM Jailbreak`. Prompt injection is `AML.T0051 LLM Prompt Injection`, with `.000 Direct`, `.001 Indirect`, and `.002 Triggered`. The two are separate techniques, and citing the jailbreak identifier for an injection finding misclassifies the behavior.

Which ASI risk covers system prompt leakage?

None directly. `LLM07:2025 System Prompt Leakage` has no dedicated agentic counterpart, and OWASP's own cross-mapping does not associate any ASI risk with it. On the ATLAS side the nearest entries are `AML.T0056 Extract LLM System Prompt` and `AML.T0069.002 System Prompt`. Record disclosure and state alteration as separate findings.

Which ATLAS version should I cite?

The one you verified, by release tag and date. ATLAS changed from semantic versions to date-based tags in May 2026, so "v5" alone is now ambiguous. This page cites v2026.06, published June 30, 2026.

Is this an official OWASP or MITRE mapping?

No. The item names, identifiers, and the ASI-to-LLM pairings are owned by OWASP and MITRE. SSA owns the security-thread rows, the choice of ATLAS entries beside each OWASP row, the relationship labels, and the boundary analysis.

Sources

Verification and change history

Last verified: 2026-07-29. On that date every OWASP identifier and item name on this page was read from the official project documents named above, every ATLAS identifier and technique name was read from the official v2026.06 data release, and the ATLAS release history was read from the project's published release list.

Change history: 2026-07-29, initial defensive draft. 2026-07-29, rebuilt: the crosswalk was reconstructed from the official catalogs, extended from seven partial rows to all ten ASI risks plus a system-prompt-leakage row, given official identifiers, names, versions, and URLs in every cell, aligned with OWASP's own published ASI-to-LLM cross-mapping, updated to ATLAS v2026.06, and corrected where `AML.T0054` had been left unnamed beside prompt-injection entries. The evidence status was changed to `SSA Working Term` to match the page's own provenance statement. Not scheduled for publication.

Working-term label: **Mixed provenance.** The framework item names and identifiers are Standard Terms owned by OWASP and MITRE, and the ASI-to-LLM pairings follow OWASP's published cross-mapping. The security-thread rows, the ATLAS selections, the relationship labels, and the boundary analysis are SSA editorial synthesis, not a standard.