- Home
- AI agents
- Security threats to agents
- OWASP Top 10 for Agentic Applications
Govern and secure · Security threats to agents
What is the OWASP Top 10 for Agentic Applications?
The OWASP Top 10 for Agentic Applications for 2026 is a ranked list of ten security risks in systems where AI agents plan, call tools and act. The OWASP GenAI Security Project released it on 9 December 2025 with more than 100 contributors. Each item names a risk; this page pairs each with the control that addresses it.
In this guide: 83 pages
Key takeaways
- The ten items are ASI01 Agent Goal Hijack, ASI02 Tool Misuse, ASI03 Identity and Privilege Abuse, ASI04 Agentic Supply Chain Vulnerabilities, ASI05 Unexpected Code Execution, ASI06 Memory and Context Poisoning, ASI07 Insecure Inter-Agent Communication, ASI08 Cascading Failures, ASI09 Human-Agent Trust Exploitation and ASI10 Rogue Agents.
- The items overlap inside one incident: a hijack (ASI01) usually needs a privilege gap (ASI03) and an exit (ASI02) to do damage, and a review that stops at the single-agent items misses the multi-agent and human ones (ASI07 to ASI09).
- Most items map to one control family: identity (ASI03), a tool policy and pinned tool lists (ASI02, ASI04), input and memory hygiene (ASI01, ASI06), sandboxing (ASI05), signed inter-agent messages (ASI07), circuit breakers (ASI08), verifiable approvals (ASI09) and a kill switch (ASI10).
- It sits beside two other lists: the OWASP Top 10 for LLM Applications 2026, which moved Excessive Agency to third, and MITRE ATLAS 2026.10, which names the attacker techniques behind each item.
What is the OWASP Top 10 for Agentic Applications, and who is it for?
It is the OWASP GenAI Security Project's ranked list of the security risks specific to agentic systems, released on 9 December 2025 as the first agent-specific top 10, and it is written for the people who build, review and run agents: architects, security teams, auditors and the owners who sign for an agent's risk.
OWASP's Agentic Security Initiative had published "Agentic AI: Threats and Mitigations" in February 2025 as a first taxonomy. The December 2025 top 10 condensed that work into ten ranked items with the help of more than 100 security researchers, practitioners and user organizations, and shipped with a practical guide to securing agentic applications, a state-of-agentic-security report, a quarterly solutions landscape and a reference application for capture-the-flag practice. On 2 September 2026 OWASP announced an Agent Control Standard, donated to the project, to extend the guidance toward runtime enforcement.
Two naming details matter when you cite it. The document's title is "OWASP Top 10 for Agentic Applications for 2026", although it was released in December 2025. ASI02 appears as "Tool Misuse" in OWASP's list post and as "Tool Misuse and Exploitation" in its press release; this page uses the list post. The IDs run ASI01 to ASI10, and OWASP says its 2026 LLM Top 10 carries mappings to them.
The practical use is as a review checklist. Each item becomes a question about one agent: can content it reads change its goal, can it misuse a tool, does it hold more privilege than its task, and so on through the ten. The table below gives the question in plain language and the control that answers it.
What are the ten risks, and which control addresses each?
Each item below is OWASP's name, what it means in plain language, a 2025 or 2026 example where one is documented, and the control we put in place for it. The examples come from the researchers' own write-ups.
The ten items with the control that addresses each. Names follow OWASP's list post of 9 Dec 2025.
| Item | Plain language | Example | Control that addresses it |
|---|---|---|---|
| ASI01 Agent Goal Hijack | Content the agent reads changes what it is trying to do | EchoLeak (one email), ForcedLeak (a form field), GitHub MCP (a public issue) | Document-attack classifiers on every channel, trust tagging, and a trifecta split so a hijacked agent cannot reach data and an exit together |
| ASI02 Tool Misuse | A legitimate tool is used for a harmful purpose or with harmful arguments | Replit's agent ran destructive commands on a production database | Tool allow list per agent; argument limits in a policy engine (AgentCore Policy, Foundry tool call point); approval on irreversible actions |
| ASI03 Identity and Privilege Abuse | The agent, or whoever holds its token, acts beyond its intended scope | Supabase demonstration ran with a service role; Drift tokens exported Salesforce data | One identity per agent, short-lived scoped tokens, no human or admin accounts, no token passthrough, Conditional Access for agents |
| ASI04 Agentic Supply Chain Vulnerabilities | A tool, MCP server, package or extension the agent depends on is malicious or compromised | postmark-mcp copied every email after 15 clean versions; AgentCore starter toolkit CVE-2026-105812 | Official servers only, pinned versions and tool lists, review on change, vendor bulletin subscriptions, a patch runbook |
| ASI05 Unexpected Code Execution | Natural language becomes code or commands the owner never intended to run | OpenClaw CVE-2026-25253; command injection in the AgentCore code interpreter (CVE-2026-12530) | Sandboxed execution with no credentials in reach, egress limits, patched SDKs, consent before local installs |
| ASI06 Memory and Context Poisoning | Planted instructions or false facts in memory or retrieved context steer later sessions | MITRE ATLAS AI Agent Context Poisoning (AML.T0080) since September 2025 | Write controls and provenance on memory, expiry, per-user namespaces, document-attack checks on retrieval |
| ASI07 Insecure Inter-Agent Communication | Messages between agents are spoofed, intercepted or trusted without verification | Moltbook exposed agent tokens and direct-message threads through a client-side key | Authenticated agent-to-agent calls, signed agent cards (A2A), one identity per agent, no shared secrets in clients |
| ASI08 Cascading Failures | One agent's bad output propagates through others with growing impact | Illustrative: a false signal in a pipeline repeated by downstream agents | Circuit breakers, rate and spend limits per agent, bounded retries, a human gate between stages that change state |
| ASI09 Human-Agent Trust Exploitation | A confident, polished explanation gets a person to approve a harmful action or believe a false report | Replit's agent said rollback was impossible when it was not | Approvals that show the exact action and arguments, verification from the trace rather than the agent's account, approval-rate caps |
| ASI10 Rogue Agents | An agent acts outside its mandate: concealment, self-directed action, running after it should have stopped | Replit's agent acted during a declared code freeze and misreported its actions (July 2025) | A kill switch per agent: disable identity, deny tool calls at the gateway, revoke tokens, disconnect integrations; registry with owner and retirement |
ASI08 has no documented incident attached yet, and that is a warning rather than a comfort: multi-agent systems were young in 2025, and the first documented cascades will arrive with scale.
How does it relate to the LLM Top 10 2026 and MITRE ATLAS?
The agentic list covers the agent; the LLM Top 10 covers the application around it; ATLAS covers the attacker. A review uses all three, and they changed within months of each other.
The OWASP Top 10 for LLM Applications 2026 was released in August 2026 (resource page 3 August, announcement 2 September). No entries were added or removed, but the order moved toward agents: Excessive Agency rose from sixth to third, Unbounded Consumption from tenth to sixth, and System Prompt Leakage became Hidden Context Exposure with a wider scope. OWASP's pages did not list the entries when we read them, so this order is taken from the Cloud Security Alliance's summary of 21 October 2026, which agrees with other secondary sources; confirm it against the OWASP document before you quote it in an audit.
MITRE ATLAS gives the techniques behind the items. Version 5.0.0 (30 September 2025) added the first agent techniques: AI Agent Context Poisoning (AML.T0080, behind ASI06), Modify AI Agent Configuration, Credentials from AI Agent Configuration (behind ASI03), Data from AI Agent Tools and Exfiltration via AI Agent Tool Invocation (AML.T0086, behind ASI01 and ASI02). AI Agent Tool Poisoning (AML.T0110) and AI Supply Chain Rug Pull (AML.T0109) arrived in March 2026 behind ASI04, and 2026.10 (28 October 2026) added Poison AI Agent Learning Environment and a conversation-context-and-memory sub-technique. ATLAS moved to calendar versions in May 2026.
For tool servers there is a fourth list, the OWASP MCP Top 10 (beta), with items such as tool poisoning, shadow MCP servers, token mismanagement and context injection. It is the MCP-specific expansion of ASI04 and ASI03.
How do you use it in an agent review?
Use it as ten questions per agent, answered in writing with the control named and the owner who signs, and keep the answers in the registry record so the next review starts from them. We run it in four steps.
- Describe the agent in one paragraph: its inputs and which are untrusted, its tools, its identity and what that identity can reach, its memory, the other agents it talks to, and the actions it can take that change state or leave the company.
- Walk the ten items against that paragraph. For each, write "not applicable" with a reason, or the control in place and where it is configured, or a gap with an owner and a date.
- Weight by the trifecta. ASI01, ASI02 and ASI03 together are the leak pattern of 2025; an agent that holds untrusted input, private data and an outbound channel at once gets a human gate before any other control is discussed.
- Retest on change. A new tool, a new MCP server, a model upgrade or a wider permission reopens the relevant items; the review is a living record, not a certificate.
Pair the review with the threat-model vocabulary of ATLAS when the security team writes detection rules, so the same incident is described the same way in the review and in the SOC.
How do Microsoft, AWS and Google implement it?
Where the three clouds hold the controls that the top 10 calls for, with statuses as the vendor pages showed on 2 Nov 2026.
Capability, Microsoft, AWS, Google
| Capability | Microsoft | AWS | |
|---|---|---|---|
| ASI01 and ASI02: hijack and tool misuse | Prompt Shields document attacks; Foundry tool call and tool response points (preview); Task Adherence (preview); Copilot Studio external threat detection (preview) | Bedrock Guardrails on text; AgentCore Policy on tool calls (generally available 3 Mar 2026) | Model Armor on Agent Gateway (generally available 24 Jun 2026) and on Google-managed MCP servers |
| ASI03: identity and privilege | Microsoft Entra Agent ID, Conditional Access and ID Protection for agents (generally available) | AgentCore Identity workload identities and scoped outbound credentials | SPIFFE-based Agent Identity; API in preview since 18 Jun 2026 |
| ASI04 and ASI05: supply chain and code execution | Defender real-time protection; Foundry guidance to treat tool descriptions as untrusted; computer use on isolated VMs | AgentCore Gateway static tool schemas; AgentCore Code Interpreter sandbox; security bulletins for SDK CVEs | Agent Registry with Agent Gateway enforcement; Computer Use sandbox (generally available 9 Sep 2026) |
| ASI10: rogue agents | Block, quarantine and 30-day soft delete in the Agent 365 registry; disable the Entra identity | Deny in AgentCore Policy; deprecate the registry record; revoke the workload identity | Block at Agent Gateway; unregister; remove IAM bindings |
Conditional Access and ID Protection for agents need Microsoft 365 E7, or Agent 365 with Entra P1 or Microsoft 365 E3 (Microsoft Learn, 2 Nov 2026).
Frequently asked questions
Is the OWASP agentic top 10 a standard we can be audited against?
No. It is an awareness and review document, like the other OWASP top 10 lists, with no certification attached. Auditors use it as a checklist, and OWASP announced an Agent Control Standard in September 2026 to carry its guidance toward runtime enforcement.
What is the difference between agent goal hijack and prompt injection?
Prompt injection is the technique; agent goal hijack (ASI01) is the outcome OWASP names when the injected instruction changes what the agent is trying to achieve. The prompt-injection sub-page covers the technique, the channels it uses and the defenses.
Which of the ten should an enterprise fix first?
ASI03, identity and privilege abuse, because an agent with its own scoped identity bounds the damage of every other item, then ASI01 and ASI02 together through the trifecta rule and a tool policy. ASI04 follows as soon as the agent uses any tool server you did not build.
Does the OWASP LLM Top 10 2026 replace the agentic list?
No. The LLM list covers the application around the model (prompt injection, disclosure, supply chain, poisoning, output handling) and in 2026 moved Excessive Agency to third. The agentic list covers what an agent does with tools, identity, memory and other agents. OWASP maps the two to each other.
More in Security threats to agents
Sources
Each source was read on 2 November 2026. The date shown is the date on the page, or the page’s ms.date for Microsoft Learn; an undated page shows the date it was read.
- OWASP Top 10 for Agentic Applications for 2026
- OWASP Top 10 for Agentic Applications: the benchmark for agent security
- OWASP GenAI Security Project releases Top 10 risks and mitigations for agentic AI security
- Agentic AI: Threats and Mitigations
- OWASP GenAI LLM Top 10 2026
- OWASP GenAI Security Project unveils 2026 Top 10 for LLM Applications and new Agent Control Standard
- The OWASP Top 10 for LLM Applications 2026: what changed and why it matters
- OWASP MCP Top 10 (beta)
- MITRE ATLAS data changelog
- CVE-2025-32711 (EchoLeak)
- ForcedLeak: agent risks exposed in Salesforce Agentforce
- GitHub MCP exploited: accessing private repositories via MCP
- Supabase MCP can leak your entire SQL database
- AI coding tool Replit wiped a database and called it a catastrophic failure
- Widespread data theft targets Salesforce instances via Salesloft Drift
- First malicious MCP server found in the wild (postmark-mcp)
- CVE-2026-25253 (OpenClaw)
- CVE-2026-12530 (AgentCore Python SDK code interpreter)
- CVE-2026-105812 (AgentCore Starter Toolkit)
- Exposed Moltbook database reveals millions of API keys
- Conditional Access for agents (Microsoft Entra Agent ID)
- Policy in Amazon Bedrock AgentCore is now generally available
- Gemini Enterprise Agent Platform release notes
Planning an AI program?
Talk to the team that builds it and runs it after launch.
- Built to SOC 2, HIPAA and GDPR standards
- EU AI Act-aligned delivery
- Microsoft Solutions Partner