OWASP Top 10 for Agentic Applications

As AI systems become more autonomous, security risks extend beyond the model and its outputs.

Agentic applications can pursue goals, make decisions, use tools, access data, maintain memory, interact with other agents, and take actions. These capabilities introduce new security risks that must be addressed across the agentic application lifecycle.

The OWASP Top 10 for Agentic Applications identifies ten key risks and provides prevention and mitigation guidance.

Agentic Top 10 at a Glance

The risks span the major components and interactions of an agentic system, including inputs, processing, memory, tools, policies, external agents, APIs, outputs, and human interaction.

ASI01. Agent Goal Hijack

Agent Goal Hijacking occurs when an attacker manipulates an agent’s intended objective through malicious instructions or untrusted content. This can include direct and indirect prompt injection, poisoned documents, web content, tool outputs, or messages from other agents.

A successful attack can cause an agent to deviate from its intended task and perform unauthorized actions.

Prevention and Mitigations

• Treat external content as untrusted.
• Validate intent before high-impact actions.
• Apply least privilege and least agency.
• Monitor goal deviation and test against prompt injection.

ASI02. Tool Misuse & Exploitation

Agents frequently rely on tools to interact with external systems. Tool Misuse occurs when an agent uses a legitimate tool in an unintended, unsafe, or unauthorized manner.

The risk can arise from excessive permissions, malicious inputs, unsafe tool chaining, or inadequate validation of tool calls.

Prevention and Mitigations

• Apply least privilege and restrict tool capabilities.
• Authenticate and authorize tool calls.
• Sandbox execution and control network egress.
• Log and monitor tool activity.

ASI03. Identity & Privilege Abuse

Agentic systems introduce new identities and delegation relationships. Agents may operate with their own identities or inherit credentials and permissions from users, applications, or other agents.

Identity and Privilege Abuse occurs when these identities or permissions are misused to obtain access beyond the agent’s intended authority.

Prevention and Mitigations

• Use distinct agent identities.
• Use task-scoped, short-lived credentials.
• Re-authorize privileged actions.
• Monitor delegated and transitive privilege escalation.

ASI04. Agentic Supply Chain Vulnerabilities

Agentic applications depend on a growing ecosystem of models, tools, agents, prompts, datasets, MCP/A2A components, libraries, and registries.

A compromised or malicious component can introduce unauthorized behavior or vulnerabilities into the agentic system.

Prevention and Mitigations

• Maintain component inventories and provenance.
• Use SBOMs/AIBOMs and verify signatures.
• Use trusted registries and pin dependencies.
• Scan and sandbox components; support revocation.

ASI05. Unexpected Code Execution

Agents may generate or execute code, commands, scripts, or packages as part of their tasks. Unexpected Code Execution occurs when attacker-controlled or unintended agent behavior results in code execution within the environment.

This can lead to compromise of the host, container, or connected systems.

Prevention and Mitigations

• Validate code before execution.
• Use isolated and sandboxed environments.
• Restrict privileges, filesystem, and network access.
• Separate code generation from execution.

ASI06. Memory & Context Poisoning

Agentic applications increasingly use persistent memory, RAG systems, vector databases, summaries, and shared context.

Memory and Context Poisoning occurs when attackers introduce malicious or misleading information into these sources, allowing the information to influence subsequent agent decisions and actions.

Prevention and Mitigations

• Validate information before storing it.
• Isolate memory by user, session, tenant, and domain.
• Maintain provenance and restrict memory writes.
• Use rollback, quarantine, and revalidation.

ASI07. Insecure Inter-Agent Communication

Multi-agent systems depend on communication between autonomous components. Weak authentication, authorization, integrity, or validation can allow attackers to spoof agents, modify messages, replay requests, or manipulate agent interactions.

Agent discovery and capability information can also become attack surfaces.

Prevention and Mitigations

• Authenticate agents and encrypt communications.
• Sign messages and validate integrity.
• Prevent replay with nonces, timestamps, and session binding.
• Verify agent identities, capabilities, and message semantics.

ASI08. Cascading Failures

Agentic systems can propagate failures across interconnected agents, tools, workflows, and external systems.

A compromised component or incorrect decision can therefore produce effects beyond the original failure, particularly where agents have broad permissions or tightly coupled workflows.

Prevention and Mitigations

• Establish trust boundaries and isolate agents.
• Apply least privilege and separate planning from execution.
• Enforce policies independently of the agent.
• Apply rate limits, circuit breakers, and monitor propagation.

ASI09. Human-Agent Trust Exploitation

Agents can influence users through authoritative responses, persuasive explanations, or human-like interaction.

Attackers can exploit this trust to cause users to approve unsafe actions, disclose information, or accept incorrect recommendations.

Prevention and Mitigations

• Require confirmation for sensitive actions.
• Provide provenance and risk information.
• Separate previews from state-changing actions.
• Monitor risky actions and train users on agent limitations.

ASI10. Rogue Agents

A Rogue Agent is an agent that deviates from its intended behavior or authorized scope.

This can include goal drift, workflow hijacking, collusion, self-replication, or reward hacking. The focus is on detecting and controlling behavior that has moved outside the agent’s intended boundaries.

Prevention and Mitigations

• Establish trust zones and execution boundaries.
• Restrict agent capabilities and communications.
• Continuously monitor behavior and use integrity checks.
• Implement kill switches, revocation, and quarantine.