The OWASP Top 10 for Agentic Applications is a 2026 OWASP GenAI Security Project framework for explaining and managing ten major security risks in autonomous AI-agent systems.
It covers agents that can plan, use tools, chain workflows, delegate tasks, retain context, and take real-world actions. The framework supports risk identification and security guidance; it is not a certification or a guarantee that an agent is secure.
What makes an application agentic?
A traditional chatbot or model-only application mainly turns an input into generated text. An agentic application can decide how to complete a task, call APIs, access data or file systems, delegate work, preserve context, and continue a workflow with limited human oversight.
That capability expands the security boundary beyond the model. It includes the agent’s tools, identities, memory, runtime, workflow connections, communications, and human approval points. A security failure may therefore involve an unsafe tool action, excessive permission, poisoned context, or a bad result passed from one workflow stage to another.
The ten OWASP agentic risks
| ASI ID | Risk | Plain-English explanation | Defensive focus |
|---|---|---|---|
| ASI01 | Agent Goal Hijack | Untrusted content, messages, or tool results redirect the agent’s objective or plan. | Separate instructions from data and validate goals, plans, and tool requests. |
| ASI02 | Tool Misuse and Exploitation | The agent uses a legitimate tool, API, or parameter unsafely. | Constrain tools, validate inputs and outputs, and limit destructive actions. |
| ASI03 | Identity and Privilege Abuse | Delegation or credential weaknesses let an agent act beyond its intended authority. | Govern agent identities, permissions, delegated access, and attribution. |
| ASI04 | Agentic Supply Chain Vulnerabilities | A compromised or untrusted model, plugin, tool, dataset, or runtime component enters the workflow. | Validate components and review their trust boundaries and permissions. |
| ASI05 | Unexpected Code Execution | Generated commands, embedded tools, or chained actions execute code unexpectedly. | Use sandboxing, isolation, execution controls, and monitoring. |
| ASI06 | Memory and Context Poisoning | False or malicious information corrupts memory, retrieval stores, summaries, or shared context. | Protect, validate, monitor, and audit stored agent information. |
| ASI07 | Insecure Inter-Agent Communication | Messages between agents are spoofed, replayed, intercepted, or altered. | Authenticate messages and validate their integrity and provenance. |
| ASI08 | Cascading Failures | An error, poisoned result, or faulty decision spreads across workflows or sessions. | Use validation gates, isolation, monitoring, and intervention points. |
| ASI09 | Human-Agent Trust Exploitation | Confident agent output causes people to approve harmful actions without sufficient validation. | Require meaningful review and evidence for high-impact decisions. |
| ASI10 | Rogue Agents | Optimization drift, reward hacking, self-replication, or other harmful behavior emerges. | Constrain autonomy, monitor behavior, and maintain intervention procedures. |
ASI01–ASI10 explained
ASI01: Agent Goal Hijack
Agent Goal Hijack occurs when malicious or misleading input changes an agent’s objective, task selection, or execution path. Hidden instructions in retrieved content, indirect prompt injection, deceptive tool results, or forged messages can make untrusted data appear authoritative. Validate goals and planned actions, and maintain a clear boundary between content and control signals.
ASI02: Tool Misuse and Exploitation
Tool Misuse and Exploitation concerns the unsafe use of legitimate APIs, databases, file systems, or other capabilities. An agent may choose the wrong tool, combine tools in an unsafe sequence, or submit overly broad parameters. Narrow tool scopes, constrained parameters, validated outputs, limits on destructive actions, and tool-use logging reduce this risk.
ASI03: Identity and Privilege Abuse
Identity and Privilege Abuse involves delegated access, inherited credentials, confused-deputy behavior, weak attribution, or dynamic trust that lets an agent exceed its authority. Treat agents as governed non-human identities with scoped, revocable permissions. Record which agent acted, on whose behalf, with what authority, and through which workflow step.
ASI04: Agentic Supply Chain Vulnerabilities
Agentic Supply Chain Vulnerabilities arise when a compromised or untrusted model, plugin, tool, dataset, skill, or runtime component enters an agent workflow. Inventory components, validate their provenance and behavior, review requested permissions, and do not treat dynamically discovered components as trusted by default.
ASI05: Unexpected Code Execution
Unexpected Code Execution covers generated commands, unsafe deserialization, embedded tools, or chained actions that execute code unexpectedly. Execution-capable actions should run in sandboxed, isolated environments with restricted resources and connections. Validate execution requests and monitor the runtime for unexpected behavior.
ASI06: Memory and Context Poisoning
Memory and Context Poisoning occurs when false or malicious information corrupts persistent memory, summaries, embeddings, retrieval stores, or shared context. That information can influence later planning, decisions, and tool use. Control what agents can write, record the source of stored information, validate high-impact facts, and monitor changes to memory and retrieval results.
ASI07: Insecure Inter-Agent Communication
Insecure Inter-Agent Communication affects workflows in which agents exchange messages without adequate authentication or integrity protection. Messages may be spoofed, replayed, intercepted, or altered. Authenticate communicating agents and validate message integrity, provenance, and freshness where applicable. Define which messages can authorize actions or change workflow state.
ASI08: Cascading Failures
Cascading Failures occur when an error, poisoned result, or faulty decision propagates across agents, sessions, or connected workflows before a person can intervene. Use validation and approval boundaries, workflow isolation, propagation monitoring, and intervention points to limit the spread.
ASI09: Human-Agent Trust Exploitation
Human-Agent Trust Exploitation occurs when confident, fluent, or authoritative output causes a person to approve a harmful action without sufficient validation. For harmful, high-impact, irreversible, or high-privilege actions, reviewers should see what the agent intends to do and the relevant supporting evidence. Meaningful confirmation is more than a passive approval click.
ASI10: Rogue Agents
Rogue Agents describes harmful aggregate behavior such as optimization drift, reward hacking, self-replication, or other behavior that diverges from the agent’s intended purpose. Long-running or highly autonomous systems need behavioral monitoring, restricted access, intervention points, audit records, and a way for operators to suspend activity.
How the risks can combine
The ten categories can interact, but they are not a mandatory pipeline. For example, malicious content may contribute to ASI01 Agent Goal Hijack. The altered goal may lead to ASI02 Tool Misuse and Exploitation or ASI03 Identity and Privilege Abuse. The resulting action may spread through connected workflows as ASI08 Cascading Failures, while a confident explanation may trigger ASI09 Human-Agent Trust Exploitation.
ASI06 Memory and Context Poisoning and ASI07 Insecure Inter-Agent Communication can also influence later decisions. Threat modeling should examine how goals, tools, identities, memory, communication, workflow stages, and approvals interact—not only whether each component works in isolation.
Agentic applications versus LLM applications
This framework concerns the OWASP Top 10 for Agentic Applications, not the older OWASP Top 10 for LLM Applications. The perspectives are complementary:
| Dimension | LLM applications | Agentic applications |
|---|---|---|
| Primary focus | Model-layer and application-interaction risks. | System-level risks in applications that plan and act. |
| Capabilities in scope | Prompts, model output, retrieval, data, and application integration. | Planning, tools, memory, delegation, workflow coordination, and actions. |
| Security boundary | Often centered on the model, prompts, data, and application. | Extends across identities, tools, components, communications, runtime behavior, and human approval. |
The Agentic Top 10 does not replace analysis of model-layer risks. Organizations deploying agents may need both perspectives.
Core controls for agentic applications
- Use least agency and least privilege: Give each agent only the tools, data, permissions, and scope required for its task.
- Govern agent identities: Treat agents as non-human identities with scoped, short-lived or otherwise limited credentials, attribution, delegated-access records, and revocation.
- Sandbox and isolate execution: Run generated code and execution-capable actions in restricted environments separated from sensitive systems.
- Authenticate communications: Validate inter-agent messages, tool calls, integrity, provenance, and authorization before they change workflow state or trigger actions.
- Protect memory and context: Control writes, validate important information, and monitor changes to stored context and retrieval results.
- Monitor and audit behavior: Track agent behavior, tool use, data access, permissions, memory changes, and workflow propagation.
- Require human approval: Use meaningful review for irreversible, high-impact, harmful, or high-privilege actions.
These controls are practical security themes, not a universal OWASP-mandated checklist. The right boundaries depend on the agent’s tools, data, autonomy, workflow, and potential impact.
Using the framework in security work
Apply the categories to the deployed system, including its actual tools, permissions, workflow connections, and memory state. For each relevant ASI category, identify the threat, map it to existing identity, access, isolation, monitoring, governance, and incident-response controls, and define evidence that those controls operate as intended.
Testing should use multi-step scenarios rather than checklist review alone. Examples include checking whether untrusted content can influence a tool request, whether poisoned memory affects a later task, whether a forged message changes workflow state, and whether a reviewer receives enough evidence to challenge an unsafe recommendation. Use deployment-specific pass/fail signals instead of assuming universal thresholds. For a practical testing workflow, use our AI agent red-teaming checklist.
Framework status and limitations
The OWASP Top 10 for Agentic Applications is identified as a 2026 framework associated with the OWASP GenAI Security Project. The 2026 designation and details such as the official title, version, ordering, authorship, and finalized publication status remain qualified pending confirmation through OWASP.
The framework organizes major risks across agent goals, tools, identities, supply chains, code execution, memory, communication, workflow propagation, human trust, and rogue behavior. It does not make an agent secure by itself and is not a compliance certification. Its practical value is to give teams a focused way to identify agentic risks and connect them to least agency, least privilege, governed access, sandboxing, isolation, monitoring, authenticated communication, and human approval.
