The OWASP Top 10 for Agentic Applications, explained
Agents don't just say things — they do things. The OWASP Agentic Top 10 lists the ten ways that goes wrong. Here they are in plain language, with controls.
By Diego Bianqui · Updated
What the list is — and what it isn't
The OWASP Top 10 for Agentic Applications for 2026 was published in December 2025 by the OWASP GenAI Security Project, through its Agentic Security Initiative. It names the ten most important security risks specific to AI agents — systems that plan and act with tools, memory and delegated authority — and gives each an identifier from ASI01 to ASI10.
Like other OWASP Top 10 lists, it is an awareness document: a starting point for threat modelling, design reviews and testing, not a certifiable standard and not full coverage. It complements the OWASP Top 10 for LLM Applications 2025, which covers risks of LLM applications in general.
The ten risks and their controls
| ID and risk | What goes wrong | Controls that help |
|---|---|---|
| ASI01 Agent Goal Hijack | Instructions hidden in emails, documents, web pages or tool output redirect the agent to an attacker's goal. | Treat external content as data; separate instructions from data; validate actions against the original task; approval for sensitive actions. |
| ASI02 Tool Misuse and Exploitation | The agent uses legitimate tools in harmful ways — wrong arguments, wrong targets, chained to cause damage. | Narrow tools with strict schemas; argument validation; rate and budget limits; least privilege per tool. |
| ASI03 Identity and Privilege Abuse | The agent acts with inherited, excessive or leaked credentials, or is used to escalate privileges. | Distinct agent identities; short-lived, scoped credentials; no shared admin tokens; audit of delegated access. |
| ASI04 Agentic Supply Chain Vulnerabilities | Compromised tools, MCP servers, plugins, models, prompts or agent components. | Inventory and review components; pin versions; verify sources; isolate third-party tools. |
| ASI05 Unexpected Code Execution (RCE) | Generated or injected code runs with access it shouldn't have. | Sandboxed execution; no direct shell or eval on production systems; allow-lists; resource limits. |
| ASI06 Memory & Context Poisoning | Malicious or false data gets into memory or context and shapes future decisions. | Provenance on memory entries; validation before writing; expiry and review; isolation between users and tenants. |
| ASI07 Insecure Inter-Agent Communication | Messages between agents are spoofed, tampered with or trusted blindly. | Authenticate agents; sign and validate messages; scope what remote agents may request. |
| ASI08 Cascading Failures | One agent's error or compromise propagates through a chain of agents and systems. | Circuit breakers; budgets and timeouts; validation at each hand-off; blast-radius limits. |
| ASI09 Human-Agent Trust Exploitation | People over-trust the agent, or the agent is used to manipulate them into approving harmful actions. | Clear disclosure of what the agent did and why; meaningful approvals, not rubber stamps; training. |
| ASI10 Rogue Agents | Agents that drift from their intended behaviour or act outside their mandate, whether compromised or misaligned. | Behavioural monitoring; tight mandates; kill switch with credential revocation; regular review. |
Summaries and control suggestions are my own paraphrase. Read the full descriptions, examples and mitigations in the official OWASP document (CC BY-SA 4.0).
Three patterns behind the ten risks
- Untrusted input steers behaviour (ASI01, ASI06, ASI07). The fix is architectural: keep a hard boundary between instructions and data, and validate before acting. See context engineering.
- Too much agency (ASI02, ASI03, ASI05). The fix is to shrink what the agent can do and with whose authority: fewer tools, scoped credentials, sandboxes. See harness engineering.
- Failures that spread or hide (ASI04, ASI08, ASI09, ASI10). The fix is visibility and brakes: component inventory, tracing, circuit breakers, real human oversight. See AgentOps.
Using the list in practice
- Threat-model each agent against ASI01–ASI10 at design time, before it gets tools or credentials.
- Remove tools and permissions the agent doesn't need before adding controls for the ones it does.
- Test the risks that apply to your system — prompt injection, tool misuse, data leakage — in a safe environment, with written authorization.
- Record findings, owners and fixes, and retest after changes.
- Feed the results into your governance: the same evidence supports an AI management system under ISO/IEC 42001 and the NIST AI RMF.
Related guides
- Harness engineering: the system around the model
- Governing AI agents with ISO/IEC 42001 and the NIST AI RMF
- AI agent protocols: MCP, A2A, AG-UI, A2UI, AP2 and UCP
Sources
- OWASP GenAI Security Project, OWASP Top 10 for Agentic Applications for 2026 (external site)
- OWASP GenAI Security Project, OWASP Top 10 for LLM Applications 2025 (external site)
Working on agents in production? Get in touch.