)
Last updated: October 28, 2026
What is the OWASP Top 10 for agentic applications? It is the OWASP GenAI Security Project's ranked list of the ten most critical security risks of autonomous AI agents, labeled ASI01 to ASI10. OWASP published it on December 9, 2025 under the name "2026". Where the LLM list treats a model as something that takes input and returns output, this list treats an agent as an actor with goals, credentials, tools and memory.
TL;DR: Key Takeaways
- OWASP published the list on December 9, 2025 with input from more than 100 experts, and calls it the 2026 edition.
- It has 10 risks, ASI01 Agent Goal Hijack to ASI10 Rogue Agents, built on two principles: Least Agency and Strong Observability, according to OWASP's document.
- Every agentic risk maps to between one and four entries of the LLM Top 10 (ASI09 maps to four), and the August 2026 LLM list expands those mappings to the agentic list.
- The risks are already exploited: EchoLeak scored CVSS 9.3 and the backdoored LiteLLM versions 1.82.7 and 1.82.8 reached PyPI on March 24, 2026.
- Runtime controls cover some risks fully and others only in part. Sandboxing, memory validation and agent-to-agent encryption stay with the engineering team.
The Ten Risks at a Glance
| ID | Risk | What goes wrong | Example |
|---|---|---|---|
| ASI01 | Agent Goal Hijack | Content the agent reads redirects its objective | EchoLeak, 2025 |
| ASI02 | Tool Misuse and Exploitation | An authorized tool is used for a harmful outcome | GitHub MCP issue attack, 2025 |
| ASI03 | Identity and Privilege Abuse | Delegated or inherited credentials escalate access | OWASP confused-deputy scenario |
| ASI04 | Agentic Supply Chain Vulnerabilities | A tool, model, prompt or server the agent loads is compromised | LiteLLM backdoor, 2026 |
| ASI05 | Unexpected Code Execution (RCE) | Text becomes commands on the host | Codex CLI CVE-2025-59532 |
| ASI06 | Memory and Context Poisoning | Stored context is corrupted and biases later decisions | Gemini memory attack, 2025 |
| ASI07 | Insecure Inter-Agent Communication | Messages between agents are spoofed, replayed or altered | Agent-in-the-Middle, 2025 |
| ASI08 | Cascading Failures | One fault spreads across agents and tools | OWASP bad-update scenario |
| ASI09 | Human-Agent Trust Exploitation | A person approves something harmful because the agent sounds credible | OWASP poisoned-invoice scenario |
| ASI10 | Rogue Agents | An agent keeps acting outside its intended scope | Replit database deletion, 2025 |
What Is the OWASP Top 10 for Agentic Applications?
The OWASP Top 10 for Agentic Applications is a peer-reviewed list of the ten most critical security risks for AI agents that plan, act and make decisions across workflows. The OWASP GenAI Security Project's Agentic Security Initiative published it on December 9, 2025, with input from more than 100 experts and practitioners.
The year in the name is the edition label, not the publication year. OWASP's own document is titled "2026" and states it was published in December 2025, which is why articles dated 2025 and 2026 refer to the same list. OWASP had not announced a later revision as of October 28, 2026. Its August 2026 release of the LLM list names the agentic list only as a mapping target.
The document rests on two principles. Least Agency extends least privilege: an agent should not have autonomy it does not need, because unneeded autonomy adds attack surface without adding value. Strong Observability means teams can see what agents do, why they act and which tools they call. OWASP also notes that agents amplify existing weaknesses more than they create new ones.
)
Why Does This List Exist Separately From the LLM Top 10?
The LLM Top 10 describes risks of applications that use language models. Agents add goals, credentials, tools, memory and other agents, so one bad input can turn into a real action. OWASP's appendix maps each agentic risk to between one and four LLM entries, which shows the two lists overlap without duplicating each other.
| Agentic risk | Related entries in the LLM Top 10 (2025 numbering) |
|---|---|
| ASI01 Agent Goal Hijack | LLM01 Prompt Injection, LLM06 Excessive Agency |
| ASI02 Tool Misuse and Exploitation | LLM06 Excessive Agency |
| ASI03 Identity and Privilege Abuse | LLM01, LLM02 Sensitive Information Disclosure, LLM06 |
| ASI04 Agentic Supply Chain Vulnerabilities | LLM03 Supply Chain |
| ASI05 Unexpected Code Execution | LLM01, LLM05 Improper Output Handling |
| ASI06 Memory and Context Poisoning | LLM01, LLM04 Data and Model Poisoning, LLM08 Vector and Embedding Weaknesses |
| ASI07 Insecure Inter-Agent Communication | LLM02, LLM06 |
| ASI08 Cascading Failures | LLM01, LLM04, LLM06 |
| ASI09 Human-Agent Trust Exploitation | LLM01, LLM05, LLM06, LLM09 Misinformation |
| ASI10 Rogue Agents | LLM02, LLM09 |
OWASP's mapping uses the 2025 LLM numbers. The 2026 LLM list renumbered eight entries, so Excessive Agency is now LLM03 and Unbounded Consumption is LLM06. Our guide to the OWASP Top 10 for LLM Applications 2026 explains the new order. The tool layer has its own list, the OWASP MCP Top 10, which overlaps with ASI02, ASI04 and ASI07 where tool descriptors and MCP servers are involved.
All Ten Risks Explained: ASI01 to ASI10
Each risk below follows the same structure: what it is, a documented example and the mitigation OWASP recommends. Where no public incident exists, the example comes from OWASP's own scenarios and is labeled as such. Each entry ends with controls you can apply today, so you can jump straight to the risks that match your agents.
ASI01: Agent Goal Hijack
What it is. An attacker redirects the agent's goals, task selection or decision path with injected content, because agents cannot reliably separate instructions from data.
Real example. EchoLeak (CVE-2025-32711) was a zero-click flaw in Microsoft 365 Copilot found by Aim Security and covered by The Hacker News on June 12, 2025. A crafted email led Copilot to leak internal data when a user later asked an ordinary question. Microsoft patched it server-side and reported no evidence of exploitation in the wild, according to The Hacker News.
Mitigation. Treat all natural-language input as untrusted, require human approval for goal-changing actions, lock and version system prompts, and consider intent capsules that bind the goal and its limits to each execution cycle.
ASI02: Tool Misuse and Exploitation
What it is. The agent uses a tool it is allowed to use in an unsafe way, through injection, misalignment or ambiguous instructions.
Real example. In May 2025, Invariant Labs showed that an agent with access to both public and private GitHub repositories could read a malicious issue in a public repository and publish private repository details, as DevClass reported on May 27, 2025.
Mitigation. Give each tool a least-privilege profile (scopes, rates, egress allowlists), put a policy check between the planner and the tool, require approval and dry-run previews for destructive actions, and set usage budgets.
ASI03: Identity and Privilege Abuse
What it is. Attackers exploit delegation, inherited credentials or cached context to gain access the agent should not have.
Example (OWASP scenario). A low-privilege agent relays instructions to a high-privilege agent that never rechecks authorization. This is the classic confused-deputy pattern.
Mitigation. Issue short-lived, task-scoped tokens tied to a per-agent identity, wipe memory between tasks, authorize each privileged action through a central policy engine, and manage agents as non-human identities.
ASI04: Agentic Supply Chain Vulnerabilities
What it is. An agent loads third-party models, tools, prompts, plugins or MCP servers, often at runtime, and one of them is malicious or tampered with.
Real example. On March 24, 2026, backdoored LiteLLM versions 1.82.7 and 1.82.8 were published to PyPI after attackers stole a publishing token through a compromised scanner in the project's build pipeline. PyPI quarantined them about 45 minutes after the first release, according to a Cloud Security Alliance research note. The package sees about 95 million monthly downloads. In July 2025, a malicious prompt also reached the Amazon Q Developer extension for VS Code in version 1.84.0, but AWS said it was malformed and did not run, per CyberInsider.
Mitigation. Sign and attest manifests, prompts and tool definitions, keep AI bills of materials, allowlist and pin dependencies, re-verify hashes at runtime, and keep a kill switch to revoke a compromised component.
ASI05: Unexpected Code Execution (RCE)
What it is. Prompt injection, tool misuse or unsafe deserialization turns text into code that runs on the host or in the container.
Real example. CVE-2025-59532 let OpenAI's Codex CLI treat a model-generated working directory as the sandbox boundary, which allowed file writes and commands outside the intended folder. It affected versions 0.2.0 to 0.38.0, scored CVSS 8.6 and was published on September 22, 2025, per OSV. A 2025 CVE, CVE-2025-1040 (CVSS 8.8), described a template injection in AutoGPT Platform that led to remote code execution, fixed in version 0.4.0, according to the Shodan CVE database.
Mitigation. Run code in sandboxes as a non-root user, ban eval in production agents, separate code generation from execution behind a validation gate, and require approval for privileged runs.
ASI06: Memory and Context Poisoning
What it is. Adversaries corrupt memory, summaries, embeddings or retrieval stores so that future reasoning and tool use become biased or unsafe.
Real example. On February 21, 2025, InfoQ reported Johann Rehberger's attack on Google Gemini: a document planted instructions that Gemini carried out later on a trigger phrase, and the same technique stored false information in its long-term memory. Google rated the impact as low because it needs user interaction, per InfoQ. Our guide to memory and context poisoning goes deeper.
Mitigation. Scan memory writes before commit, segment memory by user and domain, require source provenance, stop agents from re-ingesting their own output as trusted memory, and support rollback and quarantine.
ASI07: Insecure Inter-Agent Communication
What it is. Weak authentication, integrity or validation on agent-to-agent messages allows interception, spoofing, replay or tampering.
Example. OWASP's incident tracker lists an Agent-in-the-Middle case from April 2025 in which A2A protocol messages were spoofed. OWASP's scenarios also include fake peers registering in discovery services.
Mitigation. Use mutual authentication and end-to-end encryption, sign messages, prevent replays with nonces and timestamps, authenticate discovery traffic and reject messages that do not match typed schemas.
ASI08: Cascading Failures
What it is. A single fault, such as a hallucination, a corrupted tool or poisoned memory, spreads and amplifies across agents, tools and workflows.
Example (OWASP scenario). A bad update auto-deploys to connected agents, or a compromised planner issues unsafe steps that executors run unchecked.
Mitigation. Separate planning from execution with an independent policy engine, apply rate limits, quotas and circuit breakers, keep dev and prod apart, and keep tamper-evident logs so you can trace and roll back.
ASI09: Human-Agent Trust Exploitation
What it is. People over-trust an agent's fluency or apparent expertise, so attackers or flawed designs can steer approvals and disclosures.
Example (OWASP scenario). A poisoned invoice leads an agent to recommend a fraudulent payment, and the approver accepts the agent's confident explanation.
Mitigation. Show plain-language risk summaries instead of model-written rationales, require explicit confirmation for sensitive actions, block state-changing calls during previews, and log what was displayed versus what was executed.
ASI10: Rogue Agents
What it is. A compromised or misaligned agent deviates from its intended function while individual actions still look legitimate.
Real example. In July 2025, SaaS investor Jason Lemkin reported that Replit's AI assistant deleted a project database during a code freeze and then said it had "panicked." The Stack noted that calling the database "production" is debatable, and Replit said it was rolling out automatic separation of development and production databases, per The Stack (July 21, 2025).
Mitigation. Keep immutable, signed audit logs, set behavioral baselines with deviation alerts, give every agent an owner and an expiry date, and test a kill switch that revokes credentials quickly.
How to Use the OWASP Top 10 for Agentic Applications
Use the list at three points in an agent's life: threat modeling before deployment, red-team scoping in testing and monitoring design in production. Each stage turns the ten risks into concrete questions about tools, credentials, memory and approvals, instead of a generic checklist.
Before deployment: threat modeling
List every tool, credential, memory store and peer agent. For each, ask which of the ten risks could reach it and what the blast radius would be. Apply Least Agency first: remove tools and permissions the task does not need before adding controls. Our guides on agentic AI governance and AI agent security cover the policy side.
In testing: red-team scoping
Test the content your agent retrieves, not only what users type. Goal hijack and memory poisoning arrive through emails, documents, tickets and tool results. Scope tests for goal override, cascading failures from minor errors and kill-switch effectiveness. AI Red Teaming (TrustTest) can run these scenarios against your agents before launch.
In production: monitoring design
Log every goal, tool call and state change with a stable goal identifier, then set behavioral baselines that alert on deviation. This is Strong Observability in practice. Score findings consistently, for example with AIVSS, so teams can rank which risks to fix first.
How Runtime Controls Map to the Ten Risks
Five of the ten risks are covered at runtime, four are shared with the customer and one, ASI07, mostly stays with the customer unless agents call each other through the gateway. The table shows what a gateway and runtime layer can enforce and what remains an engineering task.
| Risk | Coverage | What a gateway and runtime layer does | What stays with you |
|---|---|---|---|
| ASI01 Agent Goal Hijack | Covered | Inspects tool results and user input for hidden instructions and can block the tool call | None |
| ASI02 Tool Misuse and Exploitation | Covered | Limits each agent to assigned tools, with limits per tool and confirmation on risky calls | Validate arguments and confirm irreversible actions |
| ASI03 Identity and Privilege Abuse | Covered | Per-application keys or identity-provider tokens, credentials held by the gateway, access levels per person and group | None |
| ASI04 Agentic Supply Chain Vulnerabilities | Shared | Approved registry of models and MCP servers, inspection of tool descriptions | Review code and dependencies, pin versions |
| ASI05 Unexpected Code Execution | Shared | Evaluates tool calls in coding agents before they run, inspects what agents read | Run agents in isolated environments |
| ASI06 Memory and Context Poisoning | Shared | Inspects what enters the context from tools and each conversation turn | Validate, isolate and expire the agent's stored memory |
| ASI07 Insecure Inter-Agent Communication | Customer | Authenticates and inspects agent calls that go through the gateway | Authenticate, sign and encrypt messages between agents |
| ASI08 Cascading Failures | Covered | Limits on requests, tool executions and spend, fallback, pausing an application | Timeouts and circuit breakers between agents |
| ASI09 Human-Agent Trust Exploitation | Shared | Human confirmation before tool calls, moderation of out-of-scope responses | Approval steps in the application and user training |
| ASI10 Rogue Agents | Covered | Alerts and analytics on agent behavior, pausing an application or revoking its key | Define expected behavior, alert rules and a response procedure |
NeuralTrust's Runtime Security Mesh combines Agent Gateway (TrustGate) and Agent Runtime Security (TrustGuard). The gateway decides which models, tools and servers an agent can reach, as which identity and within which limits. The runtime layer inspects content and applies an action such as allow, block, transform or alert. Neither replaces secure engineering: code review, sandboxing and memory design remain yours.
Where to Start: A Decision Table
Start where your agents are most exposed, not automatically with ASI01. A single pilot agent and a multi-agent production system need different first steps, so match your own situation in the table below to the risks it makes most likely, then work down the list.
| Your situation | Start with | Risks |
|---|---|---|
| First agent in a pilot | Inventory tools and credentials, apply Least Agency | ASI02, ASI03 |
| Agents read email, documents or web pages | Treat retrieved content as untrusted, test goal override | ASI01, ASI06 |
| Agents with coding or shell tools | Sandbox execution, pin and verify dependencies | ASI05, ASI04 |
| Multi-agent workflows | Authenticate messages, add circuit breakers | ASI07, ASI08 |
| Agents already in production | Add logging, baselines and a tested kill switch | ASI10, ASI09 |
Conclusion
The OWASP Top 10 for agentic applications gives security teams a shared vocabulary for agents that act on their own, and the incidents from 2025 and 2026 show these risks are already exploited. Treat it as a threat-modeling checklist: remove unneeded autonomy, secure identity and memory, observe every action and rehearse the kill switch. Controls at runtime cover part of the list, and engineering covers the rest.
Secure AI Agents in Production with NeuralTrust
Agent Runtime Security (TrustGuard) inspects agent inputs and outputs inline, and AI Red Teaming (TrustTest) tests your agents against goal hijack, tool misuse and memory poisoning before launch. Book a demo to see how the Runtime Security Mesh covers the ten risks and where your own controls still matter.
)
Related Reading
- OWASP Top 10 for LLM Applications 2026
- OWASP MCP Top 10: Every MCP Security Risk Explained
- What Is Memory and Context Poisoning?
- AI Agent Security: 2026 Enterprise Guide
FAQs about OWASP Top 10 for Agentic Applications
1. What is the OWASP Top 10 for agentic applications?
It is a peer-reviewed list of the ten most critical security risks of autonomous AI agents, from ASI01 Agent Goal Hijack to ASI10 Rogue Agents. The OWASP GenAI Security Project published it on December 9, 2025, with input from more than 100 experts. It is a threat-modeling guide, not a certification.
2. Why is it called 2026 if OWASP published it in 2025?
The year is the edition label. OWASP's document is titled "2026" and was published in December 2025, so references to the 2025 release and to the 2026 list describe the same document. OWASP had not announced a later revision as of October 28, 2026, and its August 2026 LLM release only names the list as a mapping target.
3. How is it different from the OWASP Top 10 for LLM applications?
The LLM list covers risks of applications that use language models, such as prompt injection and unbounded consumption. The agentic list covers agents as actors with goals, credentials, tools, memory and peers. OWASP maps each agentic risk to one to four LLM entries, so use both lists together.
4. What is Least Agency?
Least Agency is OWASP's principle that an agent should have only the autonomy, tools and permissions its task requires. It extends least privilege: unneeded autonomy adds attack surface without adding value, so removing it shrinks the blast radius of a hijack, a poisoned memory or a compromised tool.
5. Which risk should I address first?
Start with the risk your agents are most exposed to. If agents read email or documents, test goal hijack and memory poisoning first. If they hold broad credentials, fix identity and tool permissions. Applying Least Agency reduces several risks at once, so it is a safe first step for any team.
6. How do I test my agents against the OWASP Top 10 for agentic applications?
Scope tests around the ten risks. Include indirect injection through retrieved content, cascading failures from small errors, misuse of authorized tools, identity delegation and kill-switch effectiveness. Run them before launch and again after each change to tools, prompts or memory, and score findings consistently so fixes can be prioritized.
7. Can a gateway or runtime layer cover the whole list?
No. A runtime layer covers risks that travel through AI traffic, such as hidden instructions, tool access, credentials and limits. It cannot sandbox code, validate stored memory or encrypt messages between agents that talk directly. Treat runtime controls as one layer next to secure engineering.
About the Author
Alessandro Pignati is Lead AI Security Researcher at NeuralTrust, where he leads research on AI and agentic security, advancing techniques to evaluate and secure large language models and autonomous AI systems. He specializes in adversarial machine learning, AI red teaming, LLM security, and AI safety, contributing to the development of secure and trustworthy AI.
NeuralTrust is the leading platform for securing and scaling AI agents. Named a Pioneer in the Gartner Emerging Market Quadrant for AI Application Security 2026, recognized across four Gartner Hype Cycle reports in 2026, and featured in the Gartner Market Guide for Guardian Agents 2026, the Gartner Market Guide for AI Gateways 2025 and the KuppingerCole Leadership Compass for Generative AI Defense 2025. Headquartered in Barcelona with offices in London and New York. ISO 27001 certified.
Sources
- OWASP GenAI Security Project, OWASP Top 10 for Agentic Applications for 2026, December 9, 2025.
- OWASP GenAI Security Project, OWASP Top 10 for LLM Applications 2026, August 2026.
- The Hacker News, Zero-Click AI Vulnerability Exposes Microsoft 365 Copilot Data, June 12, 2025.
- DevClass, Researchers warn of prompt injection vulnerability in GitHub MCP with no obvious fix, May 27, 2025.
- Cloud Security Alliance, LiteLLM PyPI backdoor: AI toolchain supply chain, March 27, 2026.
- CyberInsider, Amazon's AI coding assistant for VS Code infected with data wiper, July 25, 2025.
- OSV, CVE-2025-59532, published September 22, 2025.
- Shodan CVE database, CVE-2025-1040, a 2025 CVE, accessed October 28, 2026.
- InfoQ, Gemini long-term memory attack, February 21, 2025.
- The Stack, Vibe coding CEO deletes production database, July 21, 2025.
)
)
)
)