The question Which agent risks matter first?
What the list is
The OWASP GenAI Security Project published the Top 10 for Agentic Applications on 9 December 2025, as its 2026 edition. Its Agentic Security Initiative wrote it, drawing on contributors from industry, academia and government. Each entry gives a description, common examples, attack scenarios and mitigations you can start on now.
The list rests on a longer OWASP taxonomy, the Agentic AI Threats and Mitigations guide. It also adds an idea worth adopting early: least agency. Don't give an agent more autonomy than its task needs, because unneeded autonomy widens the attack surface without adding value. OWASP also calls strong observability non-negotiable: you need to see what agents do, why, and which tools they call.
The ten risks
Here is each item as OWASP names it, with a one-line meaning and the first control to put in place. The controls come from OWASP's own mitigations for each entry.
| Item | What it means | First control |
|---|---|---|
| ASI01 Agent Goal Hijack | Text the agent reads, such as a web page, issue, email or file, redirects what it is trying to do. | Treat all outside text as untrusted. Require approval for actions that change the goal or carry high impact. |
| ASI02 Tool Misuse and Exploitation | The agent misuses a tool it is allowed to use: deleting data, calling costly APIs in a loop, or sending data out. | Give each tool a least-privilege profile: scopes, rate limits and an outbound allow list. |
| ASI03 Identity and Privilege Abuse | The agent uses inherited credentials, cached secrets or delegated rights beyond what the task needs. | Issue short-lived, task-scoped credentials to each agent, instead of letting it inherit a person's keys. |
| ASI04 Agentic Supply Chain Vulnerabilities | A third-party tool, MCP server, model, prompt or agent that the agent loads is malicious or tampered with. | Keep an inventory of AI components. Allow list and pin them, and block untrusted sources. |
| ASI05 Unexpected Code Execution (RCE) | Text becomes code that runs: generated scripts, shell commands, unsafe evaluation or hostile package installs. | Run agent-generated code in a sandbox with network limits, and never as root. |
| ASI06 Memory & Context Poisoning | Bad data written into the agent's memory or retrieval store shapes its later decisions, across sessions. | Scan memory writes, keep memory separate per user and session, and accept only authenticated sources. |
| ASI07 Insecure Inter-Agent Communication | Messages between agents are intercepted, spoofed, replayed or tampered with. | Encrypt agent channels with mutual authentication, and sign messages. |
| ASI08 Cascading Failures | One fault, such as a hallucination or a poisoned input, spreads across agents and workflows into wider harm. | Put an independent policy check between planning and execution, with quotas and circuit breakers. |
| ASI09 Human-Agent Trust Exploitation | A fluent, confident agent persuades a person to approve something harmful. | Require explicit confirmation for sensitive actions, with a plain risk summary the model didn't write. |
| ASI10 Rogue Agents | An agent drifts from its intended function and keeps acting outside its scope, even after the trigger is gone. | Keep signed, tamper-evident logs of agent actions, and a kill switch that revokes the agent's credentials. |
How it relates to the LLM Top 10 2025
OWASP released the Top 10 for LLM Applications 2025 on 17 November 2024. It covers the model and the application around it. Its ten items run from LLM01:2025 Prompt Injection to LLM10:2025 Unbounded Consumption.
The agentic list builds on it rather than replacing it. Its Appendix A maps every ASI item to the LLM items underneath. Four links matter most:
- ASI01 combines LLM01:2025 Prompt Injection with LLM06:2025 Excessive Agency. LLM01 covers one manipulated response; ASI01 covers redirected goals and multi-step behaviour.
- ASI02 and ASI03 build on LLM06:2025 Excessive Agency. OWASP calls ASI03 the agentic evolution of Excessive Agency.
- ASI04 extends LLM03:2025 Supply Chain from static dependencies to tools and agents loaded at run time, such as MCP servers.
- ASI05 builds on LLM01 and LLM05:2025 Improper Output Handling. ASI06 builds on LLM01, LLM04:2025 Data and Model Poisoning and LLM08:2025 Vector and Embedding Weaknesses.
Use both. The LLM list covers what can go wrong in the model and its outputs. The agentic list covers what happens when those outputs become actions.
Where to start with coding agents on laptops
If your agents are mainly coding agents on developers' laptops, start with three items. Each has a first control you can put in place this quarter. Together they decide what a hijacked agent can reach and do.
1. ASI03 Identity and Privilege Abuse
A coding agent runs as the developer and inherits the keys on the laptop: SSH keys, cloud credentials, tokens in files. GIRD's 19-day case study covered one company's engineering laptops. Agents' own processes opened credential files 19 times in week one and 29 times in week two. Four named keys went out inside ordinary agent requests. First control: find keys sitting in plain text, then swap standing keys for short-lived, scoped ones. See where AI agents leak your keys.
2. ASI02 Tool Misuse and Exploitation
The shell is a tool. So are git, cloud command-line tools and every MCP tool. ASI02 covers legitimate tools used the wrong way: a delete, a force push, an upload to the wrong place. In the same study, agent runs fell from 385 in week one to 306 in week two. Yet recorded actions rose from 12.7 million to 20.1 million. Actions matching a rule GIRD ships with rose from 914 to 4,028. Each run did more, and more of it matched a rule. First control: require approval for destructive commands, and set an outbound allow list.
3. ASI04 Agentic Supply Chain Vulnerabilities
Developers add MCP servers, extensions and packages in minutes. OWASP's own example is postmark-mcp, a malicious MCP server on npm that blind-copied emails to the attacker. In the study, MCP connector entries went from 20 to 22 across 9 services. And 8 of 14 installed coding agents recorded no session at all, yet stayed installed. First control: an inventory, an allow list and pinned versions. See what MCP is and how MCP servers create risk.
Why ASI01 is not first
ASI01 Agent Goal Hijack tops OWASP's list, and you should assume it will happen. The UK's National Cyber Security Centre says prompt injection may never be properly mitigated the way SQL injection was. OWASP's own guidance for ASI01 includes limiting the impact with least privilege and human approval. Those are ASI02 and ASI03 controls. More in prompt injection and agent goal hijack.
ASI05 comes next. Coding agents run code by design, so run it in a sandbox. For what has already gone wrong, GIRD's incident dossier collects 38 publicly reported coding-agent incidents from 2023 to August 2026, each with its source.
FAQs
Is the OWASP Agentic Top 10 a certification?
No. It is guidance from the OWASP GenAI Security Project, which calls it a compass and a go-to reference for security leaders. Use it to structure risk assessments and to show auditors your coverage, alongside frameworks such as NIST AI RMF and ISO/IEC 42001.
Do we still need the OWASP Top 10 for LLM Applications?
Yes. The agentic list builds on it and maps each ASI item to the LLM items underneath. The LLM list covers the model and its outputs. The agentic list covers what happens when those outputs become actions.
Why not start with ASI01, the top item?
Assume it will happen. No filter reliably stops it, and OWASP's guidance for ASI01 includes limiting its impact with least privilege and human approval for high-impact actions. Those controls sit under ASI02 and ASI03, which is why they come first.
What does least agency mean?
OWASP's term for giving an agent no more autonomy than its task needs. Agentic behaviour where it isn't needed widens the attack surface without adding value.
How current is the list?
The current edition is the 2026 version, published on 9 December 2025. Its appendix links an exploits and incidents tracker that OWASP says it updates weekly.
Sources
- OWASP Top 10 for Agentic Applications for 2026, OWASP GenAI Security Project, 9 Dec 2025. Read 26 Oct 2026.
- OWASP Top 10 for LLM Applications 2025, OWASP GenAI Security Project, 17 Nov 2024. Read 26 Oct 2026.
- 2025 Top 10 Risk & Mitigations for LLMs and Gen AI Apps, OWASP GenAI Security Project. Read 26 Oct 2026.
- LLM06:2025 Excessive Agency, OWASP GenAI Security Project. Read 26 Oct 2026.
- Agentic AI Threats and Mitigations, OWASP GenAI Security Project, 17 Feb 2025. Read 26 Oct 2026.
- Prompt injection is not SQL injection (it may be worse), National Cyber Security Centre, 8 Dec 2025. Read 26 Oct 2026.
- Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST, Jan 2023. Read 26 Oct 2026.