OWASP Coverage Across Praxen Baseline Targets
How each OWASP category actually shows up across 12 real-world AI agents — as a finding's primary risk (solid) or a secondary, co-occurring concern (hatched).
12targets analyzed
147total findings
113LLM-classified
70Agentic-classified
Companion views · RAISE coverage · Suite Health — popularity & freshness
Targets analyzed 12 Praxen scans
Each card links to the agent's source repository and its per-target Praxen analysis report. Counts show how many of that agent's findings fall primarily under an LLM or Agentic OWASP category.
FinBot
OWASP Agentic AI CTF — invoice processor
14 findings
10 LLM
3 Agentic
HelperBot
Damn Vulnerable AI Agent — training agent
9 findings
6 LLM
6 Agentic
OpenAI Customer Service
OpenAI Agents SDK example
7 findings
6 LLM
1 Agentic
AutoGen Code Executor
Microsoft AutoGen code-executor family
15 findings
12 LLM
9 Agentic
Aider
Interactive pair-programming agent
12 findings
11 LLM
4 Agentic
OpenHands
Autonomous software-engineering platform
12 findings
9 LLM
5 Agentic
Deep Agents CLI
LangChain agent harness (MCP coverage)
15 findings
10 LLM
7 Agentic
yaah
Yet Another Agent Harness (MCP coverage)
13 findings
11 LLM
8 Agentic
Hermes (Agent + Desktop)
Multi-component LLM agent + desktop control layer
10 findings
9 LLM
5 Agentic
CraftBot
Self-hosted general-purpose agent that builds and operates its own SaaS tools
17 findings
14 LLM
9 Agentic
uAgents
Fetch.ai decorator-based autonomous multi-agent framework runtime
14 findings
8 LLM
12 Agentic
Agentforce Help Agent
Salesforce Agentforce customer-service agent (Knowledge-article RAG)
9 findings
7 LLM
1 Agentic
OWASP LLM Top 10 — coverage by category
How the OWASP Top 10 for LLM Applications 2026 categories apply across these agents. Solid = the finding's primary category; hatched = a category it also touches. Empty rows are categories these apps don't exercise.
primary — the finding's main category
secondary — a category it also touches
hover any bar to see the findings behind it
LLM01Prompt Injection
Primary — 18 findings
- FinBot — An anonymous goal write persists into every later decision — stored custom_goals a
- FinBot — The fallback engine scores authority and urgency phrases out of the attacker-contr
- HelperBot — Any network caller reaches HelperBot: the port binds all interfaces with wildcard
- HelperBot — Attack detection classifies injections and then routes them into the matching expl
- OpenAI Customer Service Agent — No input, output, or tool guardrails are wired on any agent or tool, so nothing de
- AutoGen Code Executor — Execution output returns to the model raw — no size cap, no provenance label, no c
- aider — Scraped pages and command output enter the model context as operator-voiced user m
- +11 more
- HelperBot — HelperBot returns its own system prompt on request — the canned handler echoes the
- aider — Untrusted fetched content reaches the model unlabeled and can steer an unbounded f
- Deep Agents Code — Hostile repository content reaches the model as system-prompt text and can drive f
- Hermes Agent (with Hermes Desktop) — In non-interactive, non-gateway runs every non-hardline dangerous command and all
- CraftBot — Unlabeled external content reaches host shell execution in one hop, with the paren
- CraftBot — The ChromaDB memory index ingests agent-written content with no validation, authen
LLM02Sensitive Information Disclosure
Primary — 30 findings
- FinBot — GET /api/vendors returns every vendor's full record — bank name, account number, r
- FinBot — The Flask SECRET_KEY is a hardcoded string literal committed in source rather than
- FinBot — Vendor contact email, a remit-declared PII class, is placed in the model context o
- HelperBot — HelperBot returns its own system prompt on request — the canned handler echoes the
- HelperBot — An internal API-key literal is embedded in HelperBot's LLM-mode system prompt, wit
- OpenAI Customer Service Agent — Conversation content including passenger PII is exported by default to OpenAI's tr
- AutoGen Code Executor — The Jupyter kernel websocket URL is hardcoded to ws:// even when the connection is
- +23 more
- HelperBot — Any network caller reaches HelperBot: the port binds all interfaces with wildcard
LLM03Excessive Agency
Primary — 31 findings
- FinBot — Every /api/admin/* route — goals, thresholds, fraud toggle, invoice approval, vend
- FinBot — The approve tool commits an approval with no check on amount, on the injection fla
- FinBot — The approve tool sets payment_processed on the invoice record, taking the agent pa
- HelperBot — HelperBot's declared inventory contains write_file and search_web — a filesystem-w
- OpenAI Customer Service Agent — Seat changes execute on any confirmation number the model supplies — update_seat p
- AutoGen Code Executor — The default executor factory silently downgrades from container isolation to host
- AutoGen Code Executor — The local executor's documented dangerous-command sanitizer does not exist anywher
- +24 more
- aider — Untrusted fetched content reaches the model unlabeled and can steer an unbounded f
- CraftBot — Unlabeled external content reaches host shell execution in one hop, with the paren
- CraftBot — The repository's only prompt-injection filter is dead code, and would not block an
LLM04Supply Chain
Primary — 16 findings
- FinBot — Only Flask is version-pinned; every other dependency is an open-ended floor with n
- HelperBot — Three of six direct dependencies are caret-ranged and the image builds with npm in
- AutoGen Code Executor — Execution environments are resolved by mutable image tag and pulled with no digest
- aider — Model metadata and the help embedding model are fetched at runtime from mutable re
- OpenHands — No component inventory and no vulnerability scanning beyond Dependabot, alongside
- Deep Agents Code — Auto-update is enabled by default and replaces the runtime from PyPI with no signa
- Deep Agents Code — No component inventory ships with the package, and one dependency carries no upper
- +9 more
LLM05Data and Model Poisoning
0
LLM06Unbounded Consumption
Primary — 5 findings
- FinBot — The public invoice endpoint has no rate limit and no cost ceiling, and each anonym
- OpenAI Customer Service Agent — No failed-attempt counter or end-of-interaction path exists; the conversation loop
- OpenHands — The rate limiter keys on the immediate socket address and stores counters in per-p
- uAgents (Fetch.ai uAgent) — The default inbound path applies no counterparty allowlist and no rate limit, so a
- Salesforce Help Agent Accelerator — HAA Help Agent — No input-length cap or rate limit on the Experience Cloud submit path, which the t
LLM07Misinformation
Primary — 4 findings
- OpenAI Customer Service Agent — The rule that FAQ answers come only from the lookup tool is prompt text over a thr
- OpenAI Customer Service Agent — The seat routine writes the confirmation number and a randomly generated flight nu
- Salesforce Help Agent Accelerator — HAA Help Agent — The off-topic block tells the agent to offer a human escalation that the escalatio
- Salesforce Help Agent Accelerator — HAA Help Agent — Grounding and citation configuration ships empty and disabled while the instructio
LLM08Hidden Context Exposure
Secondary — 3 findings
- OpenAI Customer Service Agent — No input, output, or tool guardrails are wired on any agent or tool, so nothing de
- Salesforce Help Agent Accelerator — HAA Help Agent — Prompt-only guardrails combined with default-off audit leave a jailbreak of the ag
- Salesforce Help Agent Accelerator — HAA Help Agent — Every prohibition and non-disclosure rule is enforced only by prompt text; no dete
LLM09Vector and Embedding Weaknesses
Primary — 1 finding
- CraftBot — The ChromaDB memory index ingests agent-written content with no validation, authen
LLM10Improper Output Handling
Primary — 8 findings
- AutoGen Code Executor — The Docker backend builds the host file path from the model-supplied language stri
- AutoGen Code Executor — Azure download_files writes to a host path built from filenames supplied by the re
- aider — Untrusted fetched content reaches the model unlabeled and can steer an unbounded f
- aider — Model-supplied file paths are resolved with no repo-root containment, and the oper
- Deep Agents Code — Hostile repository content reaches the model as system-prompt text and can drive f
- yaah — The fail-closed command guard is seven regexes over a shell, so trivial rewrites o
- yaah — The yaah_lint MCP tool spawns external binaries on a model-supplied path without c
- +1 more
- AutoGen Code Executor — Execution output returns to the model raw — no size cap, no provenance label, no c
OWASP Agentic Top 10 — coverage by category
How the OWASP Top 10 for Agentic AI Applications 2026 categories apply. Outcome categories — Cascading Failures, Rogue Agents — appear hatched-only: they're real concerns, but a more specific category is usually the primary one.
ASI01Agent Goal Hijack
Primary — 3 findings
- FinBot — The fallback engine scores authority and urgency phrases out of the attacker-contr
- HelperBot — HelperBot's persona states no topic scope and no safety constraint — it is told to
- HelperBot — Attack detection classifies injections and then routes them into the matching expl
- FinBot — An anonymous goal write persists into every later decision — stored custom_goals a
ASI02Tool Misuse and Exploitation
Primary — 6 findings
- HelperBot — HelperBot's declared inventory contains write_file and search_web — a filesystem-w
- aider — Model-supplied file paths are resolved with no repo-root containment, and the oper
- OpenHands — The Tavily MCP proxy is mounted as a top-level route rather than under the V1 rout
- yaah — MCP tool arguments reach the filesystem with no containment check, so reads and di
- CraftBot — No outbound destination control — the agent can POST to any public URL and email a
- uAgents (Fetch.ai uAgent) — Every handler receives an unrestricted wallet and ledger client, and the framework
ASI03Identity and Privilege Abuse
Primary — 21 findings
- FinBot — Every /api/admin/* route — goals, thresholds, fraud toggle, invoice approval, vend
- HelperBot — Any network caller reaches HelperBot: the port binds all interfaces with wildcard
- OpenAI Customer Service Agent — Seat changes execute on any confirmation number the model supplies — update_seat p
- AutoGen Code Executor — The Azure backend caches its access token for the life of the executor with no exp
- aider — Browser mode launches Streamlit with no bind address and no authentication, so the
- OpenHands — Eleven of the thirteen V1 API routers ship with no authentication dependency unles
- OpenHands — The host-direct sandbox copies the app server's entire environment into the agent-
- +14 more
ASI04Agentic Supply Chain Vulnerabilities
Primary — 8 findings
- HelperBot — Three of six direct dependencies are caret-ranged and the image builds with npm in
- Deep Agents Code — MCP tools exempt themselves from the approval gate through a server-declared readO
- yaah — Default generation wires outbound MCP servers that install unpinned npm packages a
- yaah — Remote skill markdown and its third-party frontmatter are written into the host ag
- Hermes Agent (with Hermes Desktop) — The desktop first-run and repair install pipes a remote shell script straight into
- CraftBot — Both default-enabled MCP servers resolve unpinned upstream packages on every start
- uAgents (Fetch.ai uAgent) — The runtime contacts a Fetch.ai testnet faucet automatically when registration fun
- +1 more
ASI05Unexpected Code Execution (RCE)
Primary — 16 findings
- AutoGen Code Executor — The default executor factory silently downgrades from container isolation to host
- AutoGen Code Executor — The local executor's documented dangerous-command sanitizer does not exist anywher
- AutoGen Code Executor — DockerJupyterServer publishes a stateful arbitrary-code kernel gateway on every ho
- AutoGen Code Executor — The executor contract has no approval interposition point; every backend runs a su
- AutoGen Code Executor — JupyterCodeExecutor runs LLM-generated code in a host kernel with no isolation, no
- AutoGen Code Executor — DockerJupyterServer chmods the host bind directory to 0777 and mounts it read-writ
- AutoGen Code Executor — Function setup installs packages into the host interpreter and compiles function s
- +9 more
ASI06Memory and Context Poisoning
Primary — 5 findings
- FinBot — An anonymous goal write persists into every later decision — stored custom_goals a
- HelperBot — HelperBot affirms conversations that never happened, confirming a fabricated prior
- aider — `--restore-chat-history` re-loads a transcript aider itself wrote, carrying earlie
- Hermes Agent (with Hermes Desktop) — Skills the agent writes for itself bypass Skills Guard entirely because the gate t
- CraftBot — Session-loaded identity and memory files are agent-writable with no code guard, gi
ASI07Insecure Inter-Agent Communication
Primary — 6 findings
- AutoGen Code Executor — The Jupyter kernel websocket URL is hardcoded to ws:// even when the connection is
- Deep Agents Code — The local agent-runtime API runs with authentication disabled, so any same-user pr
- CraftBot — Living UI HTTP surfaces bind 0.0.0.0 with wildcard CORS and no authentication, con
- uAgents (Fetch.ai uAgent) — Envelope expiry and nonce are signed but never checked on receipt, so any captured
- uAgents (Fetch.ai uAgent) — A synchronous response envelope that carries no signature skips verification entir
- uAgents (Fetch.ai uAgent) — The default inbound path applies no counterparty allowlist and no rate limit, so a
ASI08Cascading Failures
Primary — 1 finding
- uAgents (Fetch.ai uAgent) — The framework offers no alert or halt primitive, so every escalation condition the
ASI09Human-Agent Trust Exploitation
Primary — 1 finding
- Hermes Agent (with Hermes Desktop) — With approvals.mode set to smart, an auxiliary LLM resolves the destructive-comman
ASI10Rogue Agents
Primary — 3 findings
- Deep Agents Code — Headless mode approves every non-shell side-effecting tool unconditionally — file
- yaah — Every generated /yaah:* command, including the autonomous phase runner, is model-i
- CraftBot — The documented approval architecture is enforced nowhere in code — permission_tier
Where LLM and Agentic risks meet co-occurrence heat map
Every square counts the findings tagged with both that LLM category (row) and that Agentic category (column) — primary or secondary. It shows how a model-layer weakness and an agent-layer weakness combine in the same finding: 55 of 147 findings span both layers, lighting 19 of 100 pairings. Blank squares are pairings that never co-occur; hotter squares occur more often (peak 11).
LLM ↓
ASI →
ASI →
ASI01ASI01 — Agent Goal Hijack
ASI02ASI02 — Tool Misuse and Exploitation
ASI03ASI03 — Identity and Privilege Abuse
ASI04ASI04 — Agentic Supply Chain Vulnerabilities
ASI05ASI05 — Unexpected Code Execution (RCE)
ASI06ASI06 — Memory and Context Poisoning
ASI07ASI07 — Insecure Inter-Agent Communication
ASI08ASI08 — Cascading Failures
ASI09ASI09 — Human-Agent Trust Exploitation
ASI10ASI10 — Rogue Agents
LLM01LLM01 — Prompt Injection
3LLM01 × ASI01 — 3 findings
- FinBot — An anonymous goal write persists into every later decision — stored custom_goals a
- FinBot — The fallback engine scores authority and urgency phrases out of the attacker-contr
- HelperBot — Attack detection classifies injections and then routes them into the matching expl
1LLM01 × ASI03 — 1 finding
- HelperBot — Any network caller reaches HelperBot: the port binds all interfaces with wildcard
1LLM01 × ASI04 — 1 finding
- yaah — Remote skill markdown and its third-party frontmatter are written into the host ag
3LLM01 × ASI05 — 3 findings
- Deep Agents Code — Hostile repository content reaches the model as system-prompt text and can drive f
- Hermes Agent (with Hermes Desktop) — In non-interactive, non-gateway runs every non-hardline dangerous command and all
- CraftBot — Unlabeled external content reaches host shell execution in one hop, with the paren
3LLM01 × ASI06 — 3 findings
- FinBot — An anonymous goal write persists into every later decision — stored custom_goals a
- aider — `--restore-chat-history` re-loads a transcript aider itself wrote, carrying earlie
- CraftBot — Session-loaded identity and memory files are agent-writable with no code guard, gi
LLM02LLM02 — Sensitive Information Disclosure
1LLM02 × ASI02 — 1 finding
- CraftBot — No outbound destination control — the agent can POST to any public URL and email a
10LLM02 × ASI03 — 10 findings
- HelperBot — Any network caller reaches HelperBot: the port binds all interfaces with wildcard
- OpenHands — The host-direct sandbox copies the app server's entire environment into the agent-
- OpenHands — The default secrets store writes git provider tokens and user custom secrets to di
- Deep Agents Code — The full process environment, including provider API keys, is copied into the runt
- yaah — The Notion MCP provider interpolates the operator's API token into a config value
- CraftBot — Live third-party OAuth client secrets and a Telegram API hash are shipped in sourc
- uAgents (Fetch.ai uAgent) — The agent inspector's REST endpoints are reachable by any remote or cross-origin c
- +3 more
1LLM02 × ASI07 — 1 finding
- AutoGen Code Executor — The Jupyter kernel websocket URL is hardcoded to ws:// even when the connection is
LLM03LLM03 — Excessive Agency
4LLM03 × ASI02 — 4 findings
- HelperBot — HelperBot's declared inventory contains write_file and search_web — a filesystem-w
- OpenHands — The Tavily MCP proxy is mounted as a top-level route rather than under the V1 rout
- yaah — MCP tool arguments reach the filesystem with no containment check, so reads and di
- uAgents (Fetch.ai uAgent) — Every handler receives an unrestricted wallet and ledger client, and the framework
6LLM03 × ASI03 — 6 findings
- FinBot — Every /api/admin/* route — goals, thresholds, fraud toggle, invoice approval, vend
- OpenAI Customer Service Agent — Seat changes execute on any confirmation number the model supplies — update_seat p
- aider — Browser mode launches Streamlit with no bind address and no authentication, so the
- OpenHands — Eleven of the thirteen V1 API routers ship with no authentication dependency unles
- Hermes Agent (with Hermes Desktop) — Four gateway adapters opt out of the central default-deny and default their own DM
- CraftBot — The documented Docker deployment mounts the host Docker socket into the agent cont
1LLM03 × ASI04 — 1 finding
- Deep Agents Code — MCP tools exempt themselves from the approval gate through a server-declared readO
11LLM03 × ASI05 — 11 findings
- AutoGen Code Executor — The default executor factory silently downgrades from container isolation to host
- AutoGen Code Executor — The local executor's documented dangerous-command sanitizer does not exist anywher
- AutoGen Code Executor — DockerJupyterServer publishes a stateful arbitrary-code kernel gateway on every ho
- AutoGen Code Executor — The executor contract has no approval interposition point; every backend runs a su
- AutoGen Code Executor — JupyterCodeExecutor runs LLM-generated code in a host kernel with no isolation, no
- AutoGen Code Executor — Function setup installs packages into the host interpreter and compiles function s
- aider — Auto-lint runs a shell command after every edit with no pre-execution confirmation
- +4 more
1LLM03 × ASI09 — 1 finding
- Hermes Agent (with Hermes Desktop) — With approvals.mode set to smart, an auxiliary LLM resolves the destructive-comman
3LLM03 × ASI10 — 3 findings
- Deep Agents Code — Headless mode approves every non-shell side-effecting tool unconditionally — file
- yaah — Every generated /yaah:* command, including the autonomous phase runner, is model-i
- CraftBot — The documented approval architecture is enforced nowhere in code — permission_tier
LLM04LLM04 — Supply Chain
5LLM04 × ASI04 — 5 findings
- HelperBot — Three of six direct dependencies are caret-ranged and the image builds with npm in
- yaah — Default generation wires outbound MCP servers that install unpinned npm packages a
- Hermes Agent (with Hermes Desktop) — The desktop first-run and repair install pipes a remote shell script straight into
- CraftBot — Both default-enabled MCP servers resolve unpinned upstream packages on every start
- uAgents (Fetch.ai uAgent) — Both published distributions declare unbounded dependency floors, and no dependenc
1LLM04 × ASI06 — 1 finding
- Hermes Agent (with Hermes Desktop) — Skills the agent writes for itself bypass Skills Guard entirely because the gate t
LLM05LLM05 — Data and Model Poisoning
LLM06LLM06 — Unbounded Consumption
1LLM06 × ASI07 — 1 finding
- uAgents (Fetch.ai uAgent) — The default inbound path applies no counterparty allowlist and no rate limit, so a
LLM07LLM07 — Misinformation
LLM08LLM08 — Hidden Context Exposure
LLM09LLM09 — Vector and Embedding Weaknesses
LLM10LLM10 — Improper Output Handling
1LLM10 × ASI02 — 1 finding
- aider — Model-supplied file paths are resolved with no repo-root containment, and the oper
4LLM10 × ASI05 — 4 findings
- Deep Agents Code — Hostile repository content reaches the model as system-prompt text and can drive f
- yaah — The fail-closed command guard is seven regexes over a shell, so trivial rewrites o
- yaah — The yaah_lint MCP tool spawns external binaries on a model-supplied path without c
- CraftBot — Unlabeled external content reaches host shell execution in one hop, with the paren
no co-occurrence
1cooler → hotter11
hover a cell for the findings behind it
How to read this primary vs secondary
Every finding is classified against the OWASP Top 10 by its primary risk — the single category that best captures what an attacker could actually do — and may note secondary categories it also touches. The solid bar counts the primary classification; the hatched extension shows the secondary, co-occurring concerns, kept separate so a headline number reflects only where a category is genuinely the dominant risk, not merely implicated. Some real findings have no OWASP home at all — a missing audit trail, for instance, is something the Top 10 treats as a defensive gap to close rather than a vulnerability to classify. Those are left unclassified and appear in neither chart. Where the taxonomy reaches, and where it doesn't, is itself part of what this view measures. For how these categories are applied, see the OWASP Gen AI Security guide.