OWASP Top 10 for Agentic Applications (2026), explained with controls

By Pulkit Batra · 29 October 2026 · 4 min read

In December 2025 the OWASP GenAI Security Project published the Top 10 for Agentic Applications: the ten risks that appear once an AI system stops answering and starts acting. It is quickly becoming the checklist security teams use to review agent projects. Here is each risk in plain language, a real incident where we have one, and what actually reduces it.

Why a separate list for agents

The OWASP Top 10 for LLM Applications already covers prompt injection and "excessive agency". The agentic list exists because agents add things a chatbot doesn't have: tools with write access, memory that persists, other agents to talk to, and a loop that runs without a person reading every step. The risks move from "the model said something bad" to "the model did something bad".

All ten at a glance

ASI01 to ASI05

ASI01 Agent goal hijack. Content the agent reads (an issue, an email, a web page) redirects what it is trying to do. In May 2025 a GitHub issue got an agent using the GitHub MCP server to copy private repositories into a public pull request. Controls: treat tool output as untrusted, and check where an action sends data against where that destination came from. A checkpoint can't stop the hijack, but it can stop what the hijack leads to. See prompt injection in AI agents.

ASI02 Tool misuse and exploitation. Legitimate tools used for harm: a delete, a refund, a force push, or safe tools chained into an unsafe result. Replit's agent ran destructive SQL on production during a code freeze. Controls: per-tool rules, holding irreversible calls for a person, and rules that look at sequences ("backups turned off, then a delete within a day").

ASI03 Identity and privilege abuse. Agents running on shared, long-lived or borrowed credentials can reach far more than their task needs. Controls: one key per agent so each call is attributable and revocable alone, tokens held on a gateway instead of in the agent's environment, least privilege on the tokens themselves.

ASI04 Agentic supply chain. Compromised MCP servers, plugins, prompts or packages. A copycat postmark-mcp package added a hidden BCC to every email. Controls: verified publishers, pinned versions, holding changes to agent config. Be honest about the limit: a gateway approves the visible call, and a malicious server can add side effects inside itself afterwards. That is the one incident in our benchmark Squidbrake does not stop.

ASI05 Unexpected code execution. Natural language turns into code that runs: a generated script, python -c, a heredoc. Controls: sandboxes for untrusted agents, parsing inline code rather than trusting the outer command, and holding scripts the agent just wrote before they run.

ASI06 to ASI10

ASI06 Memory and context poisoning. False or malicious content planted in memory shapes behaviour later, sometimes in another session. Controls: track where content came from across sessions, so an action the next day that sends data to an address from yesterday's web page is still flagged.

ASI07 Insecure inter-agent communication. Agents impersonating each other, replayed delegations, tampered messages. Controls: authenticated, signed messages between agents and per-agent identity. This is protocol work; an action checkpoint doesn't address it.

ASI08 Cascading failures. One bad decision spreads through every workflow that trusts the agent. Controls: a kill switch that stops one session, one agent or all of them in one call, and rate limits on high-impact actions.

ASI09 Human-agent trust exploitation. People approve because the agent's summary sounded fine. This is the risk most approval flows get wrong: if the approver only sees what the agent says it's doing, the agent controls the approval. Controls: show the measured effect, not the agent's description ("deletes 4,312 rows", "destroys 12 resources including the prod database"), and require someone other than the person running the agent.

ASI10 Rogue agents. Agents acting outside policy through compromise, misalignment or drift, while looking normal. Controls: policy enforced outside the model, a tamper-evident record of every action, alerts on agents trying to change their own permissions, and the kill switch.

A practical order of work

1. Inventory every agent and every tool it can reach (ASI03, ASI04).
2. Put a checkpoint between agents and tools, in shadow mode first, to see what they actually do (ASI02, ASI10).
3. Hold irreversible actions for a second person who sees the effect (ASI02, ASI09).
4. Track untrusted content and flag actions whose destination came from it (ASI01, ASI06).
5. Sandbox agents you don't trust and code they generate (ASI05).
6. Sign inter-agent messages if you run multi-agent systems (ASI07).

FAQ

Related guides

• MCP security checklist: 10 controls for AI agent toolsTokens, untrusted content, config tampering, malicious servers, approvals and logging.
• Prompt injection in AI agents: how to stop data exfiltrationIndirect prompt injection turns AI agents into data leaks. Real incidents (GitHub MCP, Supabase MCP, EchoLeak), the lethal trifecta, and controls that work.
• AI agent guardrails: input, output and action guardrails comparedWhat AI agent guardrails are, the three kinds (input, output, action), what each catches, and benchmark numbers on approval fatigue and false positives.