OWASP Top 10 for Agentic Applications

This content was generated with the assistance of AI and should be verified against the official documentation of each tool and framework before being relied on in production.

This section’s bibliography lists the reference material consulted while preparing these pages.

Written on 2026-10-01 against the OWASP Top 10 for Agentic Applications, 2026 edition, published by the OWASP GenAI Security Project in December 2025 ("Version 2026"). The ten names below were checked on 2026-10-01 against the official PDF linked in the references; the descriptions are paraphrased and the examples are the author’s own, not OWASP’s. They are cross-referenced with the OWASP Top 10 for LLM Applications 2026 (see that page) and with MITRE ATLAS.

An agent here is an LLM application that plans, remembers and acts through tools, possibly with other agents, over several steps (see Agent Loop and Architectures). The LLM list describes weaknesses of an application that calls a model; the agentic list describes what changes when the model is given a goal, memory and the ability to act. Every item below can be reached through a prompt injection, but each also occurs without one.

The ten risks

ID Risk DocsAssistant example (author’s own) Defence page

ASI01

Agent Goal Hijack

A paragraph in an uploaded document redirects the agent from answering the question to opening tickets that contain the user’s conversation.

Prompt Injection

ASI02

Tool Misuse and Exploitation

The agent uses search_docs with a crafted query pattern to enumerate documents, or passes unvalidated arguments to open_issue, doing something legitimate tools allow but the task never intended.

Excessive Agency and Tool Security

ASI03

Identity and Privilege Abuse

The agent calls the ticketing API with a shared service account, so a low-privilege user obtains the account’s authority; or a token is passed through to a downstream service.

Excessive Agency and Tool Security and Scopes, Claims and Permissions

ASI04

Agentic Supply Chain Vulnerabilities

A third-party MCP server or plugin the agent loads changes its tool descriptions after approval, or a dependency is replaced with a look-alike.

Supply Chain Security

ASI05

Unexpected Code Execution (RCE)

An agent feature that runs generated code or shell commands for data analysis is steered into running attacker-chosen commands on the host.

Excessive Agency and Tool Security

ASI06

Memory and Context Poisoning

An instruction planted in one conversation is saved to long-term memory and silently shapes later sessions, possibly for other users.

RAG and Vector Security

ASI07

Insecure Inter-Agent Communication

A sub-agent that summarises web pages returns text that the supervisor treats as trusted instruction; messages between agents are unauthenticated.

Excessive Agency and Tool Security and Agent-to-Agent Protocol

ASI08

Cascading Failures

One poisoned or erroneous result is accepted by the next step, then the next agent, and an error multiplies through a long plan, or a retry loop amplifies load.

Unbounded Consumption and Denial of Wallet

ASI09

Human-Agent Trust Exploitation

The agent’s fluent, confident explanation persuades a human reviewer to approve a harmful action, or an attacker uses the agent as a convincing intermediary.

Misinformation and Hallucination Risk and Responsible AI Practices

ASI10

Rogue Agents

A misconfigured or compromised agent keeps acting outside its intended behaviour, for example a forgotten scheduled agent that continues to write tickets.

LLMSecOps and Guardrails

The defence column points to the pages of this sub-section that carry the controls; the sibling sub-sections hold the engineering detail, namely Agent Guardrails and Safety, Human in the Loop, Tool Design and MCP security.

Relationship to the LLM list

Agentic risk Closest LLM 2026 risks

ASI01 Agent Goal Hijack

LLM01 Prompt Injection

ASI02 Tool Misuse and Exploitation

LLM03 Excessive Agency

ASI03 Identity and Privilege Abuse

LLM03 Excessive Agency, LLM02 Sensitive Information Disclosure

ASI04 Agentic Supply Chain Vulnerabilities

LLM04 Supply Chain

ASI05 Unexpected Code Execution (RCE)

LLM10 Improper Output Handling, LLM03 Excessive Agency

ASI06 Memory and Context Poisoning

LLM05 Data and Model Poisoning, LLM09 Vector and Embedding Weaknesses

ASI07 Insecure Inter-Agent Communication

LLM01 Prompt Injection, LLM03 Excessive Agency

ASI08 Cascading Failures

LLM06 Unbounded Consumption, LLM07 Misinformation

ASI09 Human-Agent Trust Exploitation

LLM07 Misinformation

ASI10 Rogue Agents

LLM03 Excessive Agency

The pairing is the author’s reading of the two lists, not an official OWASP mapping. The practical rule is that the LLM list is the baseline for any application that calls a model, and the agentic list is added when the system has tools with side effects, persistent memory or several cooperating agents. An agent that fixes every LLM-list risk can still fail on ASI07 to ASI10, because those arise from the interaction between steps and agents rather than from a single model call. In a design review (see the routine on the LLM page) ask the agentic questions after the LLM ones: who can write to this agent’s memory, which identity does each tool call carry, what happens when a step returns something wrong, and how would we notice an agent that has stopped behaving as designed.

For threat modelling, the MAESTRO layers on Trust Boundaries and Threat Modeling give the structure within which these ten items are looked up, and the MITRE ATLAS technique AML.T0053 (AI Agent Tool Invocation) is the most direct counterpart of the tool-related items.

References