# OWASP Top 10 for Agentic Applications 2026, explained

> The ten OWASP risks for AI agents (ASI01 to ASI10) in plain words, a map of where each sits in an agent, which ones showed up most in real incidents, and four controls to start with.

- Published: 2026-11-14
- Topics: AI security, OWASP, AI agents
- Canonical page: https://thesecguy.com/notes/owasp-top-10-agentic-applications-2026/
- Publisher: The Sec Guy (https://thesecguy.com)

**Short answer:** OWASP's Top 10 for Agentic Applications for 2026 lists the ten main risks of AI agents, numbered ASI01 to ASI10: Agent Goal Hijack, Tool Misuse, Identity and Privilege Abuse, Agentic Supply Chain Vulnerabilities, Unexpected Code Execution, Memory and Context Poisoning, Insecure Inter-Agent Communication, Cascading Failures, Human-Agent Trust Exploitation and Rogue Agents. It was published on 9 December 2025. Start with the agent's identity and tools: in OWASP's exploit roundup for July to September 2026, Identity and Privilege Abuse appeared in 7 of 9 entries.

---

A chatbot answers. An agent acts: it reads your email, calls tools, writes code and talks to other agents. That is a different risk, and OWASP gave it its own list.

The OWASP Top 10 for Agentic Applications for 2026 was published on 9 December 2025 by the GenAI Security Project, the same group behind the Top 10 for LLM Applications. OWASP says more than 100 industry experts, researchers and practitioners worked on it. The entries are numbered ASI01 to ASI10.

## The list

<figure class="fig">
<p class="fig-k">The ten risks</p>
<div class="rank">
<div class="rk"><b>1</b><span>Agent Goal Hijack<small>ASI01</small></span></div>
<div class="rk"><b>2</b><span>Tool Misuse<small>ASI02</small></span></div>
<div class="rk"><b>3</b><span>Identity &amp; Privilege Abuse<small>ASI03</small></span></div>
<div class="rk"><b>4</b><span>Agentic Supply Chain Vulnerabilities<small>ASI04</small></span></div>
<div class="rk"><b>5</b><span>Unexpected Code Execution<small>ASI05</small></span></div>
<div class="rk"><b>6</b><span>Memory &amp; Context Poisoning<small>ASI06</small></span></div>
<div class="rk"><b>7</b><span>Insecure Inter-Agent Communication<small>ASI07</small></span></div>
<div class="rk"><b>8</b><span>Cascading Failures<small>ASI08</small></span></div>
<div class="rk"><b>9</b><span>Human-Agent Trust Exploitation<small>ASI09</small></span></div>
<div class="rk"><b>10</b><span>Rogue Agents<small>ASI10</small></span></div>
</div>
<figcaption>Source: OWASP Top 10 for Agentic Applications for 2026, published 9 December 2025.</figcaption>
</figure>

| ID | Risk | In plain words | Example OWASP names |
|---|---|---|---|
| ASI01 | Agent Goal Hijack | Content the agent reads changes what it is trying to do | EchoLeak |
| ASI02 | Tool Misuse | The agent uses a legitimate tool in a harmful way | Amazon Q |
| ASI03 | Identity & Privilege Abuse | The agent acts with credentials or rights beyond its job | none named |
| ASI04 | Agentic Supply Chain Vulnerabilities | An MCP server, plugin or other agent it loads at run time is hostile | GitHub MCP exploit |
| ASI05 | Unexpected Code Execution | Text ends up being run as code | AutoGPT RCE |
| ASI06 | Memory & Context Poisoning | Bad data saved in memory keeps steering later sessions | Gemini Memory Attack |
| ASI07 | Insecure Inter-Agent Communication | Agents trust messages from other agents that can be spoofed | none named |
| ASI08 | Cascading Failures | One wrong signal spreads through automated steps | none named |
| ASI09 | Human-Agent Trust Exploitation | A confident explanation gets a person to approve something harmful | none named |
| ASI10 | Rogue Agents | An agent acts outside its scope, or hides what it did | Replit meltdown |

The names are OWASP's. The plain-words column is ours. The examples are the ones OWASP gave in its launch post.

## How it differs from the LLM Top 10

The LLM list is about an app that talks. This list is about software that acts for you, often with nobody watching each step.

Some entries are an LLM risk grown up. Prompt injection (LLM01) becomes Agent Goal Hijack when the injected text changes the agent's whole objective. Excessive Agency (LLM03:2026) is close to what this list covers in more detail as Tool Misuse and Identity and Privilege Abuse.

Others have no chatbot version at all. A plain chatbot has no long-term memory to poison, no other agents to be fooled by, and no chain of automated steps for one bad signal to travel down. ASI06, ASI07 and ASI08 exist because agents have those things.

If you already use the LLM list, keep it. Read [what changed in the 2026 edition](https://thesecguy.com/notes/owasp-llm-top-10-2026-vs-2025/), then add this one for anything that takes actions.

## Where each risk sits

Review an agent part by part and the list gets easier to use.

<figure class="fig">
<p class="fig-k">Where each risk sits in an agent</p>
<div class="flow">
<div class="node"><b>What it reads</b><span>Web pages, email, tickets, files, tool results</span><div class="chips"><i class="chip">ASI01</i></div></div>
<div class="node"><b>Its identity</b><span>The tokens, roles and keys it acts with</span><div class="chips"><i class="chip">ASI03</i></div></div>
<div class="node"><b>Its tools</b><span>APIs, shells, browsers, code runners</span><div class="chips"><i class="chip">ASI02</i><i class="chip">ASI05</i></div></div>
<div class="node"><b>What it loads</b><span>MCP servers, plugins, packages, other agents</span><div class="chips"><i class="chip">ASI04</i></div></div>
<div class="node"><b>Its memory</b><span>Notes and context kept between sessions</span><div class="chips"><i class="chip">ASI06</i></div></div>
<div class="node"><b>Other agents</b><span>Messages and hand-offs in a multi-agent system</span><div class="chips"><i class="chip">ASI07</i><i class="chip">ASI08</i></div></div>
<div class="node"><b>The human</b><span>The person who reads its summary and clicks approve</span><div class="chips"><i class="chip">ASI09</i></div></div>
<div class="node"><b>The agent itself</b><span>What it does when nobody is checking</span><div class="chips"><i class="chip">ASI10</i></div></div>
</div>
<figcaption>Our mapping, to help you review a design part by part. OWASP publishes the list, not this layout.</figcaption>
</figure>

## Which ones show up in real incidents

OWASP publishes a quarterly roundup of AI exploits and maps each one to its lists. The edition for July to September 2026 has nine entries. We counted how often each agentic risk was tagged.

<figure class="fig">
<p class="fig-k">How often each risk showed up, July to September 2026</p>
<div class="hbars">
<div class="hbar hot"><em>ASI03 Identity &amp; Privilege Abuse</em><div class="track"><i style="width:100%"></i></div><b>7 of 9</b></div>
<div class="hbar"><em>ASI02 Tool Misuse</em><div class="track"><i style="width:86%"></i></div><b>6 of 9</b></div>
<div class="hbar"><em>ASI10 Rogue Agents</em><div class="track"><i style="width:86%"></i></div><b>6 of 9</b></div>
<div class="hbar"><em>ASI04 Agentic Supply Chain</em><div class="track"><i style="width:43%"></i></div><b>3 of 9</b></div>
<div class="hbar"><em>ASI05 Unexpected Code Execution</em><div class="track"><i style="width:43%"></i></div><b>3 of 9</b></div>
<div class="hbar"><em>ASI06 Memory &amp; Context Poisoning</em><div class="track"><i style="width:43%"></i></div><b>3 of 9</b></div>
<div class="hbar"><em>ASI01, ASI07, ASI08, ASI09</em><div class="track"><i style="width:14%"></i></div><b>1 each</b></div>
</div>
<figcaption>Our count from the mappings in OWASP's "GenAI and Agentic AI Exploit Roundup Q3 2026" (9 entries, 8 October 2026). One quarter is a small sample.</figcaption>
</figure>

Identity and Privilege Abuse was tagged in seven of the nine. In plain terms, the agent had credentials that reached further than its task needed, and that is what turned a mistake into an incident.

Two entries show the range. Both come with qualifiers, and we keep them:

- **CoSnitch.** A crafted link ran a prompt in a Copilot user's session, and a web page could write lasting instructions into the assistant's memory. OWASP lists it as a research demonstration, tracked as CVE-2026-24301 and patched, with no exploitation in the wild reported. Mapped to ASI01, ASI02, ASI03 and ASI06.
- **Deadbugz.** A malicious MCP server submitted 23 pull requests, then changed its tool metadata to point connected agents at local credentials. OWASP's note: "No pull requests were merged, so there is no confirmed downstream compromise." Mapped to ASI04, ASI06 and ASI09.

## What to do first

<figure class="fig">
<p class="fig-k">Four controls that cover most of the list</p>
<div class="tiles">
<div class="tile hot"><b>1</b><span>Fewer tools, narrower tokens</span><small>ASI02, ASI03</small></div>
<div class="tile"><b>2</b><span>Approval before anything that can't be undone</span><small>ASI01, ASI09, ASI10</small></div>
<div class="tile"><b>3</b><span>Review what the agent loads and remembers</span><small>ASI04, ASI06</small></div>
<div class="tile"><b>4</b><span>Log every decision and tool call</span><small>ASI08, ASI10</small></div>
</div>
<figcaption>The practices behind each one are from OWASP's AI Agent Security Cheat Sheet.</figcaption>
</figure>

**Fewer tools, narrower tokens.** OWASP's cheat sheet puts it in one line: "Grant agents the minimum tools required for their specific task." Give each agent its own identity, scope tokens to one repo, one mailbox or one project, and make them expire in hours.

**Approval before anything that can't be undone.** The cheat sheet again: "Require explicit approval for high-impact or irreversible actions." Show the person the exact action, not the agent's summary of it. ASI09 is about people approving what a confident explanation told them was fine.

**Review what the agent loads and remembers.** Treat an MCP server like any third-party dependency: pin the version, read what its tools claim to do, and re-check when they change. For memory, the cheat sheet says to "Validate and sanitize data before storing in agent memory."

**Log every decision and tool call.** You can't investigate a rogue agent or a cascade without a record of what it did and why. For multi-agent systems, the cheat sheet's rule is "Implement trust boundaries between agents."

Want to try these attacks on your own laptop? The free labs on [GitHub](https://github.com/thesecguyofficial/ai-security-course-labs) include agent containment (M7), MCP tool poisoning (M8) and agent identity (M20). They belong to our course, [AI Security Engineer](https://thesecguy.com/course/), and work without it.

## Sources

Checked on 14 November 2026.

- OWASP GenAI Security Project, [OWASP Top 10 for Agentic Applications for 2026](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/), 9 December 2025.
- OWASP GenAI Security Project, [launch post](https://genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications-the-benchmark-for-agentic-security-in-the-age-of-autonomous-ai/), 9 December 2025: the ten names and the examples.
- OWASP GenAI Security Project, [GenAI and Agentic AI Exploit Roundup Q3 2026](https://genai.owasp.org/2026/10/08/genai-and-agentic-ai-exploit-roundup-q3-2026/), 8 October 2026: incident mappings.
- OWASP Cheat Sheet Series, [AI Agent Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/AI_Agent_Security_Cheat_Sheet.html): the quoted practices.