Research · AI security · OWASP · AI agents
OWASP Top 10 for Agentic Applications 2026, explained
The ten OWASP risks for AI agents (ASI01 to ASI10) in plain words, a map of where each sits in an agent, which ones showed up most in real incidents, and four controls to start with.
Short answer
OWASP's Top 10 for Agentic Applications for 2026 lists the ten main risks of AI agents, numbered ASI01 to ASI10: Agent Goal Hijack, Tool Misuse, Identity and Privilege Abuse, Agentic Supply Chain Vulnerabilities, Unexpected Code Execution, Memory and Context Poisoning, Insecure Inter-Agent Communication, Cascading Failures, Human-Agent Trust Exploitation and Rogue Agents. It was published on 9 December 2025. Start with the agent's identity and tools: in OWASP's exploit roundup for July to September 2026, Identity and Privilege Abuse appeared in 7 of 9 entries.
A chatbot answers. An agent acts: it reads your email, calls tools, writes code and talks to other agents. That is a different risk, and OWASP gave it its own list.
The OWASP Top 10 for Agentic Applications for 2026 was published on 9 December 2025 by the GenAI Security Project, the same group behind the Top 10 for LLM Applications. OWASP says more than 100 industry experts, researchers and practitioners worked on it. The entries are numbered ASI01 to ASI10.
The list
The ten risks
| ID | Risk | In plain words | Example OWASP names |
|---|---|---|---|
| ASI01 | Agent Goal Hijack | Content the agent reads changes what it is trying to do | EchoLeak |
| ASI02 | Tool Misuse | The agent uses a legitimate tool in a harmful way | Amazon Q |
| ASI03 | Identity & Privilege Abuse | The agent acts with credentials or rights beyond its job | none named |
| ASI04 | Agentic Supply Chain Vulnerabilities | An MCP server, plugin or other agent it loads at run time is hostile | GitHub MCP exploit |
| ASI05 | Unexpected Code Execution | Text ends up being run as code | AutoGPT RCE |
| ASI06 | Memory & Context Poisoning | Bad data saved in memory keeps steering later sessions | Gemini Memory Attack |
| ASI07 | Insecure Inter-Agent Communication | Agents trust messages from other agents that can be spoofed | none named |
| ASI08 | Cascading Failures | One wrong signal spreads through automated steps | none named |
| ASI09 | Human-Agent Trust Exploitation | A confident explanation gets a person to approve something harmful | none named |
| ASI10 | Rogue Agents | An agent acts outside its scope, or hides what it did | Replit meltdown |
The names are OWASP’s. The plain-words column is ours. The examples are the ones OWASP gave in its launch post.
How it differs from the LLM Top 10
The LLM list is about an app that talks. This list is about software that acts for you, often with nobody watching each step.
Some entries are an LLM risk grown up. Prompt injection (LLM01) becomes Agent Goal Hijack when the injected text changes the agent’s whole objective. Excessive Agency (LLM03:2026) is close to what this list covers in more detail as Tool Misuse and Identity and Privilege Abuse.
Others have no chatbot version at all. A plain chatbot has no long-term memory to poison, no other agents to be fooled by, and no chain of automated steps for one bad signal to travel down. ASI06, ASI07 and ASI08 exist because agents have those things.
If you already use the LLM list, keep it. Read what changed in the 2026 edition, then add this one for anything that takes actions.
Where each risk sits
Review an agent part by part and the list gets easier to use.
Where each risk sits in an agent
Which ones show up in real incidents
OWASP publishes a quarterly roundup of AI exploits and maps each one to its lists. The edition for July to September 2026 has nine entries. We counted how often each agentic risk was tagged.
How often each risk showed up, July to September 2026
Identity and Privilege Abuse was tagged in seven of the nine. In plain terms, the agent had credentials that reached further than its task needed, and that is what turned a mistake into an incident.
Two entries show the range. Both come with qualifiers, and we keep them:
- CoSnitch. A crafted link ran a prompt in a Copilot user’s session, and a web page could write lasting instructions into the assistant’s memory. OWASP lists it as a research demonstration, tracked as CVE-2026-24301 and patched, with no exploitation in the wild reported. Mapped to ASI01, ASI02, ASI03 and ASI06.
- Deadbugz. A malicious MCP server submitted 23 pull requests, then changed its tool metadata to point connected agents at local credentials. OWASP’s note: “No pull requests were merged, so there is no confirmed downstream compromise.” Mapped to ASI04, ASI06 and ASI09.
What to do first
Four controls that cover most of the list
Fewer tools, narrower tokens. OWASP’s cheat sheet puts it in one line: “Grant agents the minimum tools required for their specific task.” Give each agent its own identity, scope tokens to one repo, one mailbox or one project, and make them expire in hours.
Approval before anything that can’t be undone. The cheat sheet again: “Require explicit approval for high-impact or irreversible actions.” Show the person the exact action, not the agent’s summary of it. ASI09 is about people approving what a confident explanation told them was fine.
Review what the agent loads and remembers. Treat an MCP server like any third-party dependency: pin the version, read what its tools claim to do, and re-check when they change. For memory, the cheat sheet says to “Validate and sanitize data before storing in agent memory.”
Log every decision and tool call. You can’t investigate a rogue agent or a cascade without a record of what it did and why. For multi-agent systems, the cheat sheet’s rule is “Implement trust boundaries between agents.”
Want to try these attacks on your own laptop? The free labs on GitHub include agent containment (M7), MCP tool poisoning (M8) and agent identity (M20). They belong to our course, AI Security Engineer, and work without it.
Sources
Checked on 14 November 2026.
- OWASP GenAI Security Project, OWASP Top 10 for Agentic Applications for 2026, 9 December 2025.
- OWASP GenAI Security Project, launch post, 9 December 2025: the ten names and the examples.
- OWASP GenAI Security Project, GenAI and Agentic AI Exploit Roundup Q3 2026, 8 October 2026: incident mappings.
- OWASP Cheat Sheet Series, AI Agent Security Cheat Sheet: the quoted practices.