{"id":5099,"date":"2026-02-05T13:16:24","date_gmt":"2026-02-05T05:16:24","guid":{"rendered":"https:\/\/mayanknauni.com\/?p=5099"},"modified":"2026-02-05T13:16:24","modified_gmt":"2026-02-05T05:16:24","slug":"owasp-top-10-for-agentic-applications-2026","status":"publish","type":"post","link":"https:\/\/mayanknauni.com\/?p=5099","title":{"rendered":"OWASP Top 10 for Agentic Applications 2026"},"content":{"rendered":"

Why this list is very different from the LLM Top 10 and why most organizations are not ready<\/h2>\n

If you already run copilots, AI assistants or RAG systems in your organization, the OWASP LLM Top 10 probably felt familiar. The Agentic Top 10<\/strong> (https:\/\/genai.owasp.org\/resource\/owasp-top-10-for-agentic-applications-for-2026\/<\/a>) should feel uncomfortable. Because this is the first OWASP list that treats AI not as a chat interface, but as: a distributed, autonomous execution layer embedded into your business workflows.<\/strong><\/p>\n

Agents plan.<\/em>
\nAgents choose tools.<\/em>
\nAgents delegate to other agents.<\/em>
\nAgents carry identity.<\/em>
\nAgents persist memory.<\/em>
\nAgents act without a human looking at every step.<\/em><\/p>\n

OWASP makes one statement very clearly: \u201cAgents amplify existing vulnerabilities<\/strong>\u201d and unnecessary autonomy must be avoided through least-agency<\/em> and strong observability. That single sentence should already worry any security leader running automation in production.<\/p>\n

The uncomfortable shift: from \u201cprompt safety\u201d to \u201coperational safety\u201d<\/h2>\n

Traditional GenAI risk models assume:<\/p>\n

    \n
  • a human prompt<\/li>\n
  • a model response<\/li>\n
  • maybe a tool call<\/li>\n
  • then the loop ends<\/li>\n<\/ul>\n

    Agentic systems break this mental model. In agentic platforms (Auto-GPT style systems, LangGraph pipelines, Bedrock Agents, Copilot Studio, internal orchestration layers, MCP-based tool frameworks, etc.), the loop does not<\/strong> end.<\/p>\n

    You now have:<\/p>\n

      \n
    • long-lived goals<\/li>\n
    • planning graphs<\/li>\n
    • chained tool execution<\/li>\n
    • delegated execution<\/li>\n
    • persistent memory<\/li>\n
    • inter-agent messaging<\/li>\n<\/ul>\n

      This is no longer an AI problem. It is an autonomous distributed system security problem.<\/strong><\/p>\n

      The OWASP Agentic Top 10 at a glance<\/h2>\n

      The list is structured into ten classes of failure and abuse:<\/p>\n

        \n
      • ASI01 \u2013 Agent Goal Hijack<\/li>\n
      • ASI02 \u2013 Tool Misuse & Exploitation<\/li>\n
      • ASI03 \u2013 Identity & Privilege Abuse<\/li>\n
      • ASI04 \u2013 Agentic Supply Chain Vulnerabilities<\/li>\n
      • ASI05 \u2013 Unexpected Code Execution (RCE)<\/li>\n
      • ASI06 \u2013 Memory & Context Poisoning<\/li>\n
      • ASI07 \u2013 Insecure Inter-Agent Communication<\/li>\n
      • ASI08 \u2013 Cascading Failures<\/li>\n
      • ASI09 \u2013 Human\u2013Agent Trust Exploitation<\/li>\n
      • ASI10 \u2013 Rogue Agents<\/li>\n<\/ul>\n

        (overview extracted from the official document)<\/p>\n

        Instead of repeating the definitions, I want to focus on what really changes your threat model.<\/p>\n

        ASI01 \u2013 Agent Goal Hijack<\/h1>\n

        The real risk is not prompt injection. It is silent re-planning.<\/h3>\n

        Goal hijack is not about making a model say something wrong. It is about changing what the agent is trying to achieve.<\/strong><\/p>\n

        In practice, this happens through:<\/p>\n

          \n
        • RAG documents<\/li>\n
        • emails<\/li>\n
        • tickets<\/li>\n
        • calendar invites<\/li>\n
        • tool outputs<\/li>\n
        • other agents<\/li>\n<\/ul>\n

          Once an agent\u2019s planner accepts a poisoned objective, everything that follows is technically \u201ccorrect\u201d. In an enterprise automation context, this becomes extremely dangerous:<\/p>\n

            \n
          • approval bots<\/li>\n
          • procurement bots<\/li>\n
          • SOC response bots<\/li>\n
          • change automation agents<\/li>\n<\/ul>\n

            If the goal shifts, your controls remain blind because the actions still follow valid workflows.<\/p>\n

            Research angle that matters<\/strong><\/p>\n

            We need to start treating goals as first-class security objects.<\/p>\n

            OWASP hints at emerging ideas such as \u201cintent capsules\u201d and runtime intent validation.
            \nBut practically, most agent frameworks today do not sign, version or audit goals.<\/p>\n

            Do<\/h3>\n
              \n
            • Treat every external input as untrusted before it can influence planning.<\/li>\n
            • Bind every execution cycle to an explicit, auditable goal object.<\/li>\n<\/ul>\n

              Don\u2019t<\/h3>\n
                \n
              • Let agents infer or update their own objectives without change control.<\/li>\n<\/ul>\n

                ASI02 \u2013 Tool Misuse & Exploitation<\/h1>\n

                EDR will not save you here<\/h3>\n

                One of the most important scenarios in the document describes legitimate tools being chained to perform data exfiltration, while every single action is authorized and executed by trusted binaries.<\/p>\n

                This should immediately ring alarm bells for SOC and platform teams.<\/p>\n

                From a host point of view:<\/p>\n

                  \n
                • PowerShell is allowed<\/li>\n
                • API calls are allowed<\/li>\n
                • credentials are valid<\/li>\n
                • binaries are signed<\/li>\n<\/ul>\n

                  Nothing looks like malware. The attack is entirely in orchestration logic<\/strong>. This is one of the biggest blind spots in current security tooling.<\/p>\n

                  Do<\/h3>\n
                    \n
                  • Treat tool invocation as a policy-enforced operation, not a model decision.<\/li>\n
                  • Build an \u201cintent gate\u201d in front of tools.<\/li>\n<\/ul>\n

                    Don\u2019t<\/h3>\n
                      \n
                    • Give agents generic shells, admin APIs or multi-object data access just because it is convenient.<\/li>\n<\/ul>\n

                      ASI03 \u2013 Identity & Privilege Abuse<\/h1>\n

                      The agent identity problem no one solved yet<\/h3>\n

                      OWASP highlights something many teams are quietly struggling with:<\/p>\n

                      Our IAM systems are human-centric.
                      \nAgentic systems are delegation-centric.<\/p>\n

                      Agents:<\/p>\n

                        \n
                      • inherit credentials<\/li>\n
                      • reuse cached sessions<\/li>\n
                      • forward delegated context<\/li>\n
                      • trust other agents<\/li>\n<\/ul>\n

                        This produces a classic confused deputy problem<\/strong>, but now at machine speed and scale. OWASP explicitly frames agents as non-human identities and references the need to integrate them into identity systems such as Entra, Bedrock, Salesforce, Workday, etc. In large enterprises, this becomes a governance nightmare.<\/p>\n

                        Do<\/h3>\n
                          \n
                        • Issue per-agent, per-task identities with short-lived tokens.<\/li>\n
                        • Re-authorise at every privileged step.<\/li>\n<\/ul>\n

                          Don\u2019t<\/h3>\n
                            \n
                          • Reuse long-lived service credentials inside agent workflows.<\/li>\n<\/ul>\n

                            ASI04 \u2013 Agentic Supply Chain Vulnerabilities<\/h1>\n

                            Your runtime becomes your supply chain<\/h3>\n

                            This is where the agentic world diverges completely from classical SBOM thinking.<\/p>\n

                            Agents dynamically load:<\/p>\n

                              \n
                            • tools<\/li>\n
                            • MCP descriptors<\/li>\n
                            • prompt templates<\/li>\n
                            • agent cards<\/li>\n
                            • other agents<\/li>\n<\/ul>\n

                              And they do it at runtime<\/strong>.<\/p>\n

                              OWASP explicitly calls this a live supply chain.<\/p>\n

                              This is not just about poisoned libraries.<\/p>\n

                              It is about poisoned capabilities<\/em>.<\/p>\n

                              The exploit table in the appendix shows real incidents involving:<\/p>\n

                                \n
                              • malicious MCP servers<\/li>\n
                              • agent card spoofing<\/li>\n
                              • extension poisoning<\/li>\n
                              • dynamic prompt hubs<\/li>\n<\/ul>\n

                                Do<\/h3>\n
                                  \n
                                • Pin tools, prompts and agent descriptors by hash.<\/li>\n
                                • Maintain an AIBOM, not only an SBOM.<\/li>\n<\/ul>\n

                                  Don\u2019t<\/h3>\n
                                    \n
                                  • Allow open discovery of tools or agents in internal networks.<\/li>\n<\/ul>\n

                                    ASI05 \u2013 Unexpected Code Execution (RCE)<\/h1>\n

                                    Vibe coding meets production<\/h3>\n

                                    The danger is not that agents can write code.The danger is that many systems now execute what agents generate<\/strong>.<\/p>\n

                                    OWASP explicitly covers:<\/p>\n

                                      \n
                                    • shell invocation<\/li>\n
                                    • deserialisation attacks<\/li>\n
                                    • unsafe eval in memory systems<\/li>\n
                                    • multi-tool chains leading to RCE<\/li>\n<\/ul>\n

                                      In internal developer platforms, this is already happening.<\/p>\n

                                      Do<\/h3>\n
                                        \n
                                      • Separate code generation and code execution.<\/li>\n
                                      • Enforce pre-execution scanning and approval.<\/li>\n<\/ul>\n

                                        Don\u2019t<\/h3>\n
                                          \n
                                        • Allow auto-run in shared or production environments.<\/li>\n<\/ul>\n

                                          ASI06 \u2013 Memory & Context Poisoning<\/h1>\n

                                          This is your new persistence mechanism<\/h3>\n

                                          This is one of the most underestimated risks.<\/p>\n

                                          Agent memory is:<\/p>\n

                                            \n
                                          • vector databases<\/li>\n
                                          • summaries<\/li>\n
                                          • embeddings<\/li>\n
                                          • cross-session state<\/li>\n<\/ul>\n

                                            Once poisoned, the agent becomes a self-propagating insider threat. OWASP explicitly differentiates this from simple prompt injection and focuses on persistent corruption across sessions.<\/p>\n

                                            Do<\/h3>\n
                                              \n
                                            • Version and snapshot memory stores.<\/li>\n
                                            • Track provenance and trust scores for memory entries.<\/li>\n<\/ul>\n

                                              Don\u2019t<\/h3>\n
                                                \n
                                              • Automatically ingest the agent\u2019s own outputs into trusted memory.<\/li>\n<\/ul>\n

                                                ASI07 \u2013 Insecure Inter-Agent Communication<\/h1>\n

                                                East-west traffic is now natural language<\/h3>\n

                                                The document makes an important observation:<\/p>\n

                                                Inter-agent traffic is not only transport risk. It is also semantic risk<\/strong>.<\/p>\n

                                                A message can be syntactically valid and cryptographically signed and still manipulate another agent\u2019s intent.<\/p>\n

                                                Do<\/h3>\n
                                                  \n
                                                • Sign and encrypt messages.<\/li>\n
                                                • Perform semantic validation and intent diffing.<\/li>\n<\/ul>\n

                                                  Don\u2019t<\/h3>\n
                                                    \n
                                                  • Assume mTLS alone solves inter-agent security.<\/li>\n<\/ul>\n

                                                    ASI08 \u2013 Cascading Failures<\/h1>\n

                                                    This is why agentic systems scare SREs<\/h3>\n

                                                    OWASP treats cascading failures as a first-class threat, not as an operational nuisance.<\/p>\n

                                                    Because in agentic systems:<\/p>\n

                                                      \n
                                                    • planners feed executors<\/li>\n
                                                    • executors feed memory<\/li>\n
                                                    • memory feeds new plans<\/li>\n
                                                    • plans spawn new agents<\/li>\n<\/ul>\n

                                                      One fault becomes many faults. This is described explicitly as fan-out, feedback loops and cross-tenant spread.<\/p>\n

                                                      Do<\/h3>\n
                                                        \n
                                                      • Insert policy gates between planning and execution.<\/li>\n
                                                      • Apply blast-radius controls and circuit breakers.<\/li>\n<\/ul>\n

                                                        Don\u2019t<\/h3>\n
                                                          \n
                                                        • Allow bulk automation without replay and rollback capability.<\/li>\n<\/ul>\n

                                                          ASI09 \u2013 Human\u2013Agent Trust Exploitation<\/h1>\n

                                                          Social engineering is now embedded in your automation<\/h3>\n

                                                          This entry is deeply uncomfortable for leadership teams. The agent becomes an untraceable social engineer.<\/p>\n

                                                          OWASP explicitly highlights:<\/p>\n

                                                            \n
                                                          • authority bias<\/li>\n
                                                          • fake explainability<\/li>\n
                                                          • emotional manipulation<\/li>\n<\/ul>\n

                                                            This is not theoretical. The incidents table includes real cases of payment fraud and operational sabotage driven by compromised assistants.<\/p>\n

                                                            Do<\/h3>\n
                                                              \n
                                                            • Separate preview from execution.<\/li>\n
                                                            • Show provenance, not model-generated explanations.<\/li>\n<\/ul>\n

                                                              Don\u2019t<\/h3>\n
                                                                \n
                                                              • Let agents justify their own high-risk actions.<\/li>\n<\/ul>\n

                                                                ASI10 \u2013 Rogue Agents<\/h1>\n

                                                                The \u201cinsider threat\u201d of autonomous systems<\/h3>\n

                                                                This is the hardest class to detect. A rogue agent:<\/p>\n

                                                                  \n
                                                                • behaves within policy boundaries<\/li>\n
                                                                • executes valid workflows<\/li>\n
                                                                • slowly drifts<\/li>\n<\/ul>\n

                                                                  OWASP explicitly frames this as behavioural integrity loss.<\/p>\n

                                                                  This is extremely relevant for long-running optimisation agents and self-improving automation.<\/p>\n

                                                                  Do<\/h3>\n
                                                                    \n
                                                                  • Track behavioural baselines.<\/li>\n
                                                                  • Monitor objective drift and reward manipulation.<\/li>\n<\/ul>\n

                                                                    Don\u2019t<\/h3>\n
                                                                      \n
                                                                    • Rely on static rule-based detection.<\/li>\n<\/ul>\n

                                                                      What this means for real enterprise platforms<\/h1>\n

                                                                      In environments, where:<\/p>\n

                                                                        \n
                                                                      • automation touches infrastructure<\/li>\n
                                                                      • identity systems are complex<\/li>\n
                                                                      • change processes are regulated<\/li>\n
                                                                      • incident response is partially automated<\/li>\n<\/ul>\n

                                                                        the most dangerous misconception is: \u201cWe already have security controls around the tools.\u201d<\/p>\n

                                                                        Agentic risk is not tool risk. It is decision and delegation risk.<\/strong><\/p>\n

                                                                        A practical checklist you can take to your architecture review<\/h1>\n

                                                                        If you are building or approving an agentic platform, ask only five questions:<\/h3>\n
                                                                          \n
                                                                        1. Where are agent goals stored, versioned and audited?<\/li>\n
                                                                        2. Who enforces tool usage policies, the model or a policy engine?<\/li>\n
                                                                        3. How are agent identities issued, scoped and revoked?<\/li>\n
                                                                        4. How is memory governed, segmented and rolled back?<\/li>\n
                                                                        5. What stops a bad plan from reaching execution?<\/li>\n<\/ol>\n

                                                                          If you cannot answer all five clearly, you already have multiple OWASP ASI risks.<\/p>\n

                                                                          The biggest mistake teams will make<\/h1>\n

                                                                          They will treat this as another awareness document.<\/p>\n

                                                                          The OWASP Agentic Top 10 is not a developer checklist.<\/p>\n

                                                                          It is a platform and governance architecture blueprint<\/strong>.<\/p>\n

                                                                          If you try to bolt these controls onto existing agent frameworks after rollout, you will end up rebuilding the orchestration layer anyway.<\/p>\n

                                                                          Final thought<\/h2>\n

                                                                          The most important concept introduced in this document is not any single ASI category.<\/p>\n

                                                                          It is the idea of least agency<\/strong>.<\/p>\n

                                                                          Not least privilege.<\/p>\n

                                                                          Least agency.<\/p>\n

                                                                          Because in agentic systems, autonomy itself becomes your attack surface.<\/p>\n","protected":false},"excerpt":{"rendered":"

                                                                          Why this list is very different from the LLM Top 10 and why most organizations are not ready If you already run copilots, AI assistants or RAG systems in your organization, the OWASP LLM Top 10 probably felt familiar. The...<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[79,53],"tags":[173,91,126],"class_list":["post-5099","post","type-post","status-publish","format-standard","hentry","category-artificial-intelligence","category-cyber-security","tag-agentic-ai","tag-generative-ai","tag-owasp-top-10"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t