An agent is riskier than a chatbot because it acts: it sends email, queries databases, calls APIs, spends money. So the things that can go wrong are bigger. This chapter takes the standard list of LLM risks (the OWASP Top 10 for LLM Applications, 2025) and maps each one to the AgentCore control that blunts it, and to the part that stays your job.
New to these words? Read chapter 02 "Key terms". Related: Identity (chapter 13), Policy (chapter 23), Common mistakes (chapter 03).| RISK (OWASP 2025) | IN PLAIN WORDS | AGENTCORE CONTROL | STILL YOUR JOB |
|---|---|---|---|
| LLM01 Prompt injection | Hidden instructions in a message or web page hijack the agent. | Bedrock Guardrails filter inputs; Policy blocks disallowed tool calls; least-privilege scopes limit the damage. | Add Guardrails, scope tools tightly, validate external content. |
| LLM02 Sensitive info disclosure | The agent leaks secrets or personal data. | KMS encryption; Identity token vault (the agent never holds raw secrets); Guardrails PII filters. | Classify data, enable PII filters, keep secrets out of Memory metadata. |
| LLM03 Supply chain | A poisoned model, tool, or dependency gets in. | Registry (only vetted, approved tools and MCP servers are discoverable); IAM on who can publish. | Vet dependencies; use the Registry approval workflow. |
| LLM04 Data / model poisoning | Bad data corrupts the agent's memory or behavior. | Validate inputs at CreateEvent; Guardrails; Memory namespace isolation. | Check what enters Memory; guard untrusted inputs. |
| LLM05 Improper output handling | The agent's output is used unsafely downstream (SQL, code). | Policy / Cedar gates every tool call; Code Interpreter sandbox; the gateway SQL-injection guard pattern. | Treat output as untrusted; parameterize queries. |
| LLM06 Excessive agency | The agent is simply allowed to do too much. | Policy (allow/deny per tool and parameter); least-privilege scopes; human in the loop (Browser live view). | Grant least privilege; add approval gates for risky actions. |
| LLM07 System prompt leakage | Secrets hidden in the system prompt get exposed. | Keep secrets out of the prompt, use the Identity vault; Guardrails. | Never put secrets, or rules-as-secrets, in the prompt. |
| LLM08 Vector / embedding weaknesses | Memory or retrieval is manipulated, or leaks across tenants. | Memory namespace isolation and access control; per-tenant scoping (see chapter 32). | Scope retrieval to the right namespace and tenant. |
| LLM09 Misinformation | The agent confidently makes things up. | Evaluations (LLM-as-a-judge scoring); Observability traces; grounding via tools and Memory. | Evaluate every version, ground answers, monitor quality. |
| LLM10 Unbounded consumption | Runaway cost, or denial of service. | Runtime session limits (15-min idle, 8-h max); Payments spending limits; Observability cost alarms. | Set budgets, quotas, and CloudWatch alarms. |
CloudTrail, Observability traces. See and prove what happened.
VPC, PrivateLink. Keep traffic off the public internet.
Workload identity, token vault, IAM least privilege.
Per-session microVM, wiped at the end. No cross-session bleed.
Policy / Cedar on tool calls; Bedrock Guardrails on model text.
TLS 1.2+ in transit; KMS at rest; customer-managed keys for Memory, Gateway, and the Identity vault.