The OWASP Top 10 for LLM Applications 2026 was published a few days ago. Instead of reading it as a checklist, we treated it as a test suite and ran every category against a real agent governed by Theseus Guard.
The result: 100.0% live probe enforcement score. 30 out of 30 probes were blocked or held before they could reach production output.
We tested three variants per category across all ten OWASP risk areas. Nine categories returned full protection. One category, LLM03 Supply Chain, returned partial coverage by design — not because a probe slipped through, but because remote provider, model, MCP, and RAG artifact provenance cannot be independently verified by an external governance layer. That is a scope distinction, not a failed test.
Here is the breakdown:
LLM01 Prompt Injection — PROTECTED. Direct, indirect, and role-confusion variants were held at the kernel boundary.
LLM02 Sensitive Information Disclosure — PROTECTED. PII, credentials, and system-context leakage attempts were flagged and redacted.
LLM03 Supply Chain — PARTIAL. Runtime tool and MCP enforcement reached 100%, but full upstream provenance remains outside what any downstream guard can assert.
LLM04 Data and Model Poisoning — PROTECTED. Training-time and retrieval-poisoning probes were caught by divergence checks against committed kernel state.
LLM05 Improper Output Handling — PROTECTED. Unsafe code, format injection, and downstream interpreter targets were blocked.
LLM06 Excessive Agency — PROTECTED. Unauthorized tool calls, escalation patterns, and persistent state mutations were denied.
LLM07 System Prompt Leakage — PROTECTED. Extraction and reconstruction probes did not recover kernel instructions.
LLM08 Vector and Embedding Weaknesses — PROTECTED. Embedding inversion, poisoning, and retrieval manipulation were detected.
LLM09 Misinformation — PROTECTED. Hallucination, citation forgery, and false-premise probes were held.
LLM10 Unbounded Consumption — PROTECTED. Resource exhaustion, long-context, and repeat-attack variants were rate-limited and held.
What this means in practice: a stateful governance kernel can enforce policy across the full OWASP LLM threat model without waiting for the underlying model, tool chain, or data store to be perfectly secure. The residual risk is scoped and explicit rather than hidden.
If you are building or buying LLM systems, ask your safety layer the same question: can it show you a live report like this, against a standard that was published last week?