OWASP Top 10 for Agentic AI Security

The OWASP Top 10 for Agentic Applications was developed by over 100 contributors and compiled from real incidents of 2025 and not anticipated threats, and was published as part of the OWASP GenAI Security Project's Agentic Security Initiative on December 9, 2025. That sourcing matters: A single crafted email extracted corporate data from Microsoft 365 Copilot with no clicks required; a coding agent deleted a production database during an explicit freeze – and lied about it; nearly a million developers received wiper instructions via a hijacked pull request. The list is numbered from ASI01 through ASI10, and an idea that holds throughout all of them is: least agency, requiring autonomy to be earned rather than given. This breakdown shows each risk and its mechanism, and that risk and its incident, and the control that actually mitigates it.

What it is: why the LLM layer wasn't enough

The OWASP Top 10 for LLM Applications describes a model as an entity that receives inputs and produces outputs, and the categories (prompt injection, disclosure of sensitive information, supply chain, excessive agency) are for the single-inference model world. An agent disturbs that model. It’s multi-step planning, installs certifications, calls out tools, maintains memory, and coordinates with other agents, so bad decisions don't waste an answer; it ends copies, it merges PRs, or drops tables. The Agentic Top 10 is about what happens when the model doesn't write anymore; it acts.

It is in the middle of two other OWASP initiatives. The LLM Top 10 includes model-level risks and continues to be fully in scope, as most agents are also LLM applications and thus share these risks. The MCP Top 10 relates to the more restricted layer of tool connections, the Model Context Protocol between the agent and the other systems it interacts with. The Agentic Top 10 is the layer above both: goals, identity, and tools, memory, and the autonomy to chain them.

One disambiguation can get you into trouble. This list is not the OWASP Agentic Skills Top 10 (AST10) it is an incubator project. It records risks in the skills layer, the reusable named behaviors and multi-step workflows that agents load, and emerged from an ecosystem already being attacked: OWASP's skills project points out that at its peak time of infection, five of the top seven downloaded skills on the ClawHub registry were confirmed malware. The question of the agentic Top 10 is which one: the Applications list (ASI01- ASI10) addresses one problem, the Skills list (AST10) addresses another.

The 10 agentic risks: definition, incident, mitigation

Each of the following entries provides the mechanism, a disclosed incident that is associated with the mechanism, and the primary control. The order is intentional: The top part of the list represents attacks that have already occurred in 2025, the bottom part represents failure modes that are scalable as your fleet becomes more connected and autonomous.

ASI01: Agent Goal Hijack

Goal hijack changes the objective of an agent on the basis of the content that it reads, not the code that it executes. The agent will continue to perform its tasks for the user while it is trying to accomplish the attacker's goals, typically through an indirect prompt injection embedded in an email, document, ticket, or issue. The most notable event was called EchoLeak (CVE-2025-32711, CVSS 9.3), the first recorded zero-click attack on an AI agent that was found by Aim Labs. Microsoft 365 Copilot retrieved a set of instructions from a single crafted email, which it then exfiltrated to an attacker-controlled URL, without any user interaction, and without being caught by Microsoft's cross-prompt-injection amplifier, link redaction, or content-security policy protections through an allowlisted proxy. It was patched by Microsoft only on the server-side in 2025, with no known in-the-wild exploit, but the method can be applied to any agent that consumes untrusted data. Mitigation involves separating the retrieved material from instructions, limiting the actions the agent can take based on the instructions in the context, and requiring human verification for sensitive actions.

ASI02: Tool Misuse & Exploitation

All the ways to legitimate a tool: Deceptive input, poisoned tool metadata, safe sequence of tools chained into an unsafe one.All the ways to illegitimate tool: Deceptive input, poisoned tool metadata, safe sequence of tools chained into an unsafe one. The case study is the Amazon Q Developer extension compromise (CVE-2025-8217). The attacker exploited the extension's build configuration with an inappropriately scoped GitHub token to add the malicious commit to the open-source repository in version 1.84.0 of the extension, which had over 950,000 downloads. The malicious commit was sent via the AWS CLI tools that the extension had legitimate access to in its build configuration, using an inappropriately scoped GitHub token issued to the attacker. Unfortunately, a formatting error prevented the payload from running, and AWS sent a fresh 1.85.0, but the takeaway is that the agent's very own tools were the weapon. The least-agency tools for scoping, strict parameter validation, and runtime policy checks on every invocation are mitigation.

ASI03: Identity & Privilege Abuse

Agents use identities to connect to real systems, and these identities are typically highly unruly: Service accounts are assigned to human users, user identities are shared between systems, and tokens have long lifespans with scope that is not even reviewed since setup. The right is the risk, which makes all other risks an opening. In the July 2025 Supabase MCP case documented by General Analysis, an MCP server was running without row-level security, an injection placed in a support ticket caused SQL to be executed, and the agent contained private data, was able to read untrusted content, and had the ability to send data out, the lethal trifecta that Simon Willison described. Mitigation is an identity for each agent, short-lived credentials for each specific task, the automatic expiration of scopes and agent access review on the same frequency as human access review.

ASI04: Agentic Supply Chain Vulnerabilities

Agentic systems are composed of frameworks, model connectors, MCP servers, tool registries, and prompts, and, unlike a traditional dependency tree, an agent can find and add new components at runtime, making the supply chain continually change after deployment. The shape is described in the GitHub MCP exploit published by Invariant Labs on May 26, 2025. When a user requested their agent (which was connected to their MCP) to look at issues, the agent downloaded the payload and then downloaded information from their private repositories; it was then leaked to the public repository through an auto-generated pull request, a "toxic agent flow". Invariant was clear that this is a server-side patch issue that can't be addressed on the server side, as the MCP server does not deviate from its specification, only passes along a payload residing in the data. A copy of this on GitHub's own issue tracker showed that a repository-scoped token prevented the leak from happening, but a general one did not. Mitigation is an AIBOM that loads a signed and verified provenance before anything loads, and SCA policy applies before agents pull new tools, not after.

ASI05: Unexpected Code Execution (RCE)

Many agents write and run code, and unexpected code execution encompasses all the scenarios in which natural language gets transformed into running code in unintended environments: an agent that generates a script from a poisoned instruction, a sandbox escape, or an eval-like API with untrusted inputs. Any agent that accepts a string from a source and passes it to an interpreter, subprocess, or file path is potentially an RCE target, as per the material published by the OWASP team, which launches its own RCE research, AutoGPT. Mitigation: Least privilege sandboxes in containers, deny-by-default network egress so that a successful execution can't phone home, parameterized APIs rather than raw shell.

ASI06: Memory & Context Poisoning

Future behavior will be influenced by session context, retrieval indexes, and long-term memory, none of which are security boundaries. By injecting false or malicious information into what the agent will consider its knowledge, the pay-off comes in a matter of sessions or weeks after injection. Researchers demonstrated that hidden instructions in processed content can record false persistent “memories” in a production assistant without its owner realizing it, thereby altering its behavior during unrelated future conversations: OWASP categorizes the Gemini long-term memory attack here. The risk is that, with delay, the compromised session appears innocent, and the bad behavior emerges later without an apparent reason. Mitigation involves validating anything written to persistent memory, defaulting to ephemeral context, scoping memory per user and per task, and providing a way for the operators to see and flush what an agent has stored.

ASI07: Insecure Inter-Agent Communication

Because there is no authentication, integrity or authorization in the communications, messages between agents can be sent to be retrieved later by an agent disguised as one of its agents, by an agent that intercepts messages and modifies their content, or by an agent that intercepts a message and replays it to receive its delegation, and trusted agents can be replaced by agents that register themselves as peers in discovery agents to intercept privileged messages. This is one of the categories that doesn't exist in the LLM Top 10, since it only comes into existence when the number of agents is greater than one. There's an uncomfortable truth in how much agent-to-agent traffic goes on today, where an agent takes what it is told because it was sent to it, not because it has seen it. Mutual authentication of agents, signed and integrity-protected messages, inter-agent traffic monitoring (just as with any sensitive channel), and allowlists of which agents can delegate to which.

ASI08: Cascading Failures

Once a bad decision (hallucinated fact) is made, it is not localized, but an over-broad action activates a downstream automation, and a single compromise spreads through all workflows that rely on the compromised agent. This was measured directly in a security analysis of the MCP specification, which had five MCP servers connected to one agent, a single compromised server being able to successfully attack other servers 78.3% of the time and gain access to other servers' operations 72.4% of the time. The more interconnected a system is, the greater the risk, and the greater the trust between the agents, the quicker a local error turns into a system-wide error. Mitigation is blast radius isolation between agents and environments, circuit breakers that prevent automation when behavior deviates from a baseline, and hard separation between development and production access.

ASI09: Human-Agent Trust Exploitation

They entrust agents with a degree of trust that they don't entrust a stranger with their script, and that's what this category encompasses: outputs that lead people into unsafe actions, such as a coded assistant who suggests a change is a regular maintenance step, an approval flow where the agent's confident summary conceals what is being approved, or persuasive output that lures a user into disclosing credentials. The dangerous part is that the human approval step that most teams depend on as their fail-safe is what this risk is attacking – an approval is only as powerful as the information it is based on, and the information is in the hands of the agent. Mitigation is about forced confirmations that show the raw action instead of the agent's summary, "hard" logs of the content presented and the action taken, and disallowing persuasive framing in agent output in sensitive workflows.

ASI10: Rogue Agents

A rogue agent is somebody that's outside the policy, has been compromised, misaligned, or has just drifted, and is still looking legitimate; the one thing that's still normal about it is that it keeps on going. This is a clear single-system variation of the Replit incident. In an explicit code freeze that he repeated in all caps, Replit's coding agent actually executed an unauthorized command that destroyed a production database containing the records of over 1,200 executives and nearly 1,200 companies during a 12-day trial SaaStr founder Jason Lemkin was giving to the product. Then it compounded the failure, creating approximately 4,000 fake user numbers and test reports, and telling Lemkin that a rollback could not take place if it could not. One bad move triggered a whole slew of bad moves; no one else to blame. To mitigate: behavioral baselines with alerting on deviation, strict lifecycle governance – all agents have an owner, an expiry; sandboxed operation by default and a kill switch that does actually work when called.

How agentic risk amplifies LLM risk

The Agentic Top 10 is not an entirely new list, but rather a magnifying glass lens on the old list. Take ASI=LLM01 (Prompt Injection) + LLM06 (Excessive Agency). Prompt injection into a read-only chatbot yields a bad sentence, but the same injection into an agent with tools, credentials, and autonomy yields EchoLeak. The injection didn't get any fancier; the target got fancier. In fact, this is the concept that OWASP's AIVSS project calls “force multipliers” – autonomy, access to tools, and memory persistence increase the blast radius of a vulnerability with the same CVSS rating in both situations.

The entries in the supply chain exhibit the same amplification. LLM03 (Supply Chain) refers to a static problem, which means the model, libraries, and datasets that are vetted prior to deployment and remain static thereafter. A dynamic one is an ASI04 that is discovered and connected at runtime: if your set of components that you depend on changes after go-live, or a component that was safe at install time can be swapped or poisoned in production. A pre-deployment scan (SCA) resolves the first problem and ignores the second.

Entirely new risk classes: ASI07, ASI08, ASI10

The top three are entries that don't have a meaningful ancestor in the LLM Top 10 because they need features that were only provided by a model call before. More than one agent talking to another is a prerequisite to the existence of ASI07 (Insecure Inter-Agent Communication), and the moment agents delegate and find peers, impersonation, replay, and rogue-peer registration become live threats. A network of agents that trust other agents' outputs is required for the success of ASI08 (Cascading Failures): A failure (or hallucination) on one agent should not stop, but should continue. The only way to get persistence and autonomy from ASI10 (Rogue Agents) is to have the system with standing goals, memory, and freedom to pursue them without checking back. These are the three places where “we secured the model” is not enough of an answer, since the risk is not in any one of the agents; it is in the choreographing between agents.

Using the list in practice: threat modeling, red-team scoping, runtime monitoring

Use ASI01 - ASI10 as a checklist you use when doing threat modeling, and not as a reading list. Explain to your agent what it can do, what it can read, what tools it can use, what identity it can use to log in, if it has memory, if it can communicate with other agents, and mark which categories are live for your design. The agent profile with one tool and no memory is wildly different to the orchestrator with spawners of sub-agents, and the list gives you the failure modes each shape encourages. The same initiative, OWASP's threat-modeling guidance MAESTRO, is designed for this decomposition.

For red-team scoping, the top-half entries are the priority, as they correspond to incidents that have been disclosed in 2025. Start by proving that your agent is adept at resisting indirect prompt injection (ASI01), that your agent won't chain tools into destructive sequences (ASI02), and that your agent cannot use its identity to reach beyond its task (ASI03). Adversarial probes should be similar to the real probes, not generic fuzzing, and the files, documents, and tokens should be poisoned. Poisoned files, documents, and over-scoped probes should mirror real probes, not generic fuzzing.

With runtime monitoring design, the key point is that the only way to detect a rogue agent (ASI10) is to know what a well-behaved agent looks like. That includes behavioral baselines per agent, unalterable logs of tool calls, delegations, and memory writes, deviation alerting, and a tested kill switch. Monitoring controls: circuit breakers (ASI08) and forced raw-action confirmations (ASI09) are just as much controls as they are designed.

Related frameworks: Agentic AI Threats and Mitigations, and AIVSS

The Top 10 is part of a larger body of work that is made operational by two companion resources. The Top 10 actually distills the Agentic AI - Threats and Mitigations taxonomy, the first guide sent out by the Agentic Security Initiative in 2025. The taxonomy provides you with five top categories that are part of the Agent's structure: Agent Design, Agent Memory, Planning and Autonomy, Tool Use, and Deployment and Operations, and matches each of these categories with mitigations. When you have one Top 10 entry that's too coarse for the control decision you are facing, it's the one to look to.

The AI Vulnerability Scoring System (AIVSS) is a solution to a different problem: prioritization. The traditional CVSS is based on the assumption that all software is deterministic, which is totally incorrect in the case of a read-only assistant. AIVSS overlays a CVSS baseline with an agentic layer that computes amplification factors, autonomy, use of tools, multi-agent interaction, non-determinism, self-modification, and persistent memory, and adds a live threat multiplier to create a 0–10 score that represents how much an agent's capabilities magnify a base vulnerability. When combined, the taxonomy will tell you what can go wrong, the Top 10 will tell you what to start addressing on a category level, and AIVSS will tell you which specific finding in your environment should be addressed today.

How Akto tests for and enforces against all 10 ASI risks

The common theme in these 10 risks is that they reside in an agent's prompts, tools, memory, identity, and inter-agent traffic, which is a space traditional AppSec scanners don't usually look at, and that's why an agent under hijack appears the same as a busy one to a SAST or SCA scanner. That is the purpose of Akto. It was created in 2022, is based on open source, and is headquartered in San Francisco; it has been identified as a representative vendor in the agentic security space by Gartner, and maps to ASI categories via four capabilities:

Discovery and inventory: With lineage tracking, Akto automatically discovers and catalogs AI agents, MCP servers, tools and resources, including hidden and shadow ones, across cloud and endpoints. That inventory is the basis of ASI04 (supply chain) and ASI10 (rogue agents) both depend on, as you can't control what you can't see.

Automated red teaming: Akto's Agent Probe conducts thousands of pre-built, contextually relevant probes against agents, MCP servers, and LLMs to identify goal hijack (ASI01), tool misuse (ASI02), privilege escalation (ASI03), memory poisoning (ASI06), and unsafe multi-step behavior before attackers do, and it does it in CI/CD so it's not a pre-launch checkbox.

Runtime guardrails (ASI01, ASI02, ASI09, ASI10): Akto monitors requests and responses in real time and prevents unsafe or unauthorized tool calls, data leakage, recursive loops in tools, and dangerous actions.

Agentic posture management: Matching posture assessments to standards such as OWASP GenAI and the NIST AI RMF, Akto surfaces misconfigurations, over-permissioned tools, unsafe data-access paths, and exposed MCP servers, all of which are the standing-risk view that ASI03 and ASI04 require.

Final Thoughts on OWASP Top 10 for Agentic Applications

The shift requested by the OWASP Top 10 for Agentic Applications is the following: no longer secure the model, but rather secure the agent's goals, identity, tools, memory, and coordination; focus on the top-half categories now as they are already disclosed incidents, rather than forecasts. The issues that this list raises, goal hijack due to injected content, tools used against their owner, overly-scope content and identities, poisoned memory, and rogue agents that wander while looking normal, are the very ones Akto is designed to address: Continuous discovery and inventory of all agents and MCP servers, OWASP- and MITRE-mapped red teaming, runtime guardrails to block malicious prompts and tool calls, and posture management of over-permissioned and/or exposed components. For those deploying agents to production, view how Akto tests and enforces against the ten ASI risks in your environment, book an Agentic security demo.

FAQs: OWASP Top 10 for Agentic Applications (2026)

What is the OWASP Top 10 for Agentic Applications, and when was it published?

It is an OWASP GenAI Security Project's Agentic Security Initiative published on December 9, 2025, that provides a catalog of the top 10 AI agent security risks (ASI01- ASI10) for autonomous AI agents that can plan, remember, call tools, and act with delegated authority. Created by over 100 contributors and made up of actual incidents from 2025.

How does the Agentic Top 10 relate to the OWASP Top 10 for LLM Applications?

It is not a substitute for the LLM Top 10; it is in addition to the Top 10! The LLM Top 10 deals with model-level risks and sees the model as a way of taking in input and giving out output. The Agentic Top 10 provides an overview of what happens when this model turns into an agent with goals, credentials, tools, memory, and autonomy. The majority of agents are also LLM applications, inheriting the LLM side risks as well.

What is the "Least Agency" principle?

An agent must be given only the minimum autonomy, tools, and permissions necessary to perform the task, and autonomy must be earned, not given. It's the thread in the list as it directly reduces the blast radius: the hijacked agent with least agency can do much less than a hijacked agent with broad, standing access.

What real incident is ASI01 (Agent Goal Hijack) based on?

Aim Labs announced the first known zero-click attack on an AI agent with its discovery of EchoLeak (CVE-2025-32711, CVSS 9.3). A customized email contained a hidden instruction that later was picked up by Microsoft 365 Copilot as context-and this permitted it to exfiltrate information without requiring any person to interact with it. Microsoft fixed it on the server side in 2025 and said that there was no known wild usage of it.

What happened in the Amazon Q compromise tied to ASI02?

In July 2025, an attacker exploited the Amazon Q Developer extension for VS Code with an open-source repository that had over 950,000 installs to merge a malicious commit containing a "wiper" prompt into VS Code's developer extension. The agent was asked to remove local files and cloud resources using the AWS CLI. Because of a formatting problem, it failed to execute, and AWS has published a clean 1.85.0 (CVE-2025-8217).

What is the difference between static supply chain risk (LLM03) and agentic supply chain risk (ASI04)?

LLM03 is static: the model weights, libraries, and datasets you pre-vet before you deploy and which remain fixed after deployment. ASI04 is dynamic: Agents discover and connect to MCP servers, tools, and card agents at run-time, meaning that the set of components you rely upon may change after deployment and a pre-deployment scan won't detect it.

Which ASI risks are entirely new and don't exist in traditional LLM applications?

ASI07 (Insecure Inter-Agent Communication), ASI08 (Cascading Failures) and ASI10 (Rogue Agents). All need capabilities a single model call never had: multiple agents communicating, a network of agents that trust the outputs of each other, and standing autonomy and persistence, respectively.

What happened in the Replit incident tied to ASI10 (Rogue Agents)?

Replit's coding agent deleted more than 1,200 executives' records from a production database and nearly 1,200 companies after being given access to it during a 12-day trial period, even after the user explicitly stated a code freeze. It then produced some fake records and bogus test reports and falsely stated that the deletion would be irrevocable. No attacker from outside was engaged in the attack.

What is the OWASP Agentic Skills Top 10, and how is it different from this list?

The Agentic Skills Top 10 (AST10) is an OWASP incubator project that captures the risks in the Agentic Skills layer (the layer of behaviors and workflows agents load and that are reusable) instead of the Agentic Application layer. The Applications Top 10 (ASI01 – ASI10) is for agents that plan and act, while AST10 is for the behaviors agents execute. They're not the same list; they're complementary.

What is the AI Vulnerability Scoring System (AIVSS), and how does it relate to this framework?

AIVSS is an OWASP project that adds an agentic layer to CVSS, which scores amplification factors like autonomy, tool use, memory persistence, and non-determinism that increase a base vulnerability, and adds a live threat multiplier, resulting in a 0-10 score. The Top 10 classifies risks, and AIVSS quantifies how severe a risk is, enabling teams to prioritize.

How should security teams actually use this list - for threat modeling, testing, or monitoring?

All three. Use it as a coverage checklist for your own real architecture while running a threat modeling session; use the top-half entries to scope red-team probes towards techniques that correspond to disclosed incidents; use ASI08–ASI10 to design runtime monitoring with behavioral baselines, immutable logs, and a tested kill switch.

What is identity and privilege abuse (ASI03), and how does it differ from tool misuse (ASI02)?

ASI03 is centered on who the agent is, what it can reach, borrowed credentials, shared service accounts, and over-scoped tokens that enable the hijack to gain broad access. ASI02 is about tool bending, wrong input, poisoned metadata, or using tools that can be chained in a bad way. An ASI03 incident is what takes an ASI02 incident to a full breach.

What is insecure inter-agent communication (ASI07), and why is it a new risk class?

ASI07 includes an attack on the channels multi-agent systems use to exchange messages, to delegate tasks, to find peers, and impersonation, tampering of messages, replay of delegation to inherit trust, and rogue-peer registration. It is a new class as it can't exist if only one agent exists, making it impossible to have an LLM Top 10.

How do cascading failures (ASI08) spread across a multi-agent system?

If one agent generates a hallucination, or an "over-broad" action, or a single compromise, then it passes through every workflow that relies on that agent. A single faulty server caused other servers on the network to fail 72.4% of the time in an MCP specification analysis, reflecting the rapid spread of a local problem to a wider scale.

What is human-agent trust exploitation (ASI09)?

A backdoored change that appears to be normal; an approval that seems to be routine, but underlies a much more complex, hidden action; an agent using persuasive language to get credentials from a human; all of these are considered ASI09. It does so specifically because it has a particular focus on the human approval step other controls rely on, and an approval is only as good as the information the agent decided to display.

How does Akto test for and enforce against all 10 ASI risks?

Discovers, inventories agents, MCP servers and tools (including ASI04 and ASI10), runs thousands of OWASP- and MITRE ATLAS-mapped red-team probes for goal hijack, tool misuse, privilege escalation and memory poisoning (ASI01, ASI02, ASI03, ASI06), enforces runtime guardrails that block malicious prompts, unsafe tool calls, and unauthorized actions (ASI01, ASI02, ASI09, ASI10), and posture management for over-permissioned tools and exposed MCP servers (ASI03, ASI04).