Implementation and Evaluation of OWASP LLM Security Mitigation in Multi-Agent Systems: A Design Science Approach

Abstract

Multi-agent large language model (LLM) systems face critical security vulnerabilities that lack systematic mitigation strategies and rigorous empirical evaluation. This work focuses on four high-severity risks from the OWASP Top 10 for LLM Applications 2025: LLM01 (Prompt Injection), LLM02 (Sensitive Information Disclosure), LLM06 (Excessive Agency), and LLM09 (Misinformation). It addresses three critical gaps in the surveyed literature: the absence of clearly documented OWASP implementation patterns for multi-agent LLM applications, limited understanding of multi-agent-specific threats, and a lack of statistically rigorous security evaluation in this setting. A Design Science Research methodology is used to design, implement, and evaluate a defense‑in‑depth architecture for a multi‑agent LLM system called the Finnish Politician Analysis System (FPAS). FPAS analyzes all current Members of Parliament, and recent political news articles of Finland. The architecture integrates four security components (PromptGuard, OutputSanitizer, AgentPermissionManager, and VerificationSystem) through a decorator‑based security pipeline. Its effectiveness is evaluated using 2,247 adversarial attack scenarios that combine 37 OWASP‑aligned test cases with 2,210 WildJailbreak prompts, measuring attack success rate, detection rate, false positive rate, and performance overhead. The security-enhanced configuration increases the detection rate on Wildjailbreak from 52.49 percent to 71.90 percent, a 19.4 percentage point improvement, while maintaining zero false positives and adding only 121 ms mean latency overhead. McNemar’s test (x2 = 427.00, p < 0.001) and bootstrap 95 percent confidence intervals (70.05 percent to 73.71 percent) indicate that these gains over a pattern-matching baseline are statistically significant and robust. This research contributes a validated multi-layer, security-enhanced architecture for multi-agent LLM systems, a reproducible, containerized OWASP-guided evaluation protocol, a characterization of emergent multi-agent attack patterns such as cross-agent prompt injection and workflow-based privilege escalation, and reusable architectural patterns for integrating these mitigations into existing multi-agent LLM applications without fundamental system redesign.