Docs

Appearance

OWASP Top 10 for Agentic Applications (2026) ​

OWASP Top 10 for Agentic Applications illustration

The OWASP Top 10 for Agentic Applications (the OWASP Agentic Top 10) gives security information from the OWASP GenAI Security Project for agentic applications. It identifies 10 risks, ASI01 to ASI10, and gives mitigations for each risk.

Disclaimer

This page gives general information. It is not legal advice. Modulos has no endorsement or certification from the OWASP Foundation, and Modulos is not part of the OWASP Foundation.

When to use the Agentic Top 10 ​

The OWASP Agentic Top 10 is for agents that "plan, decide, and act across multiple steps and systems, often on behalf of users and teams" (Letter from The Agentic Top 10 Leaders). OWASP writes that the Agentic Top 10 "equips builders, defenders, and decision-makers with a clear starting point for reducing agentic AI risks". In the Letter, the Agentic Top 10 is a "go-to reference for security leaders and practitioners".

OWASP connects agentic applications with LLM applications. In the Letter, OWASP writes that agentic applications "will not exist in isolation and will be part of developing an LLM App". Thus, the entries of the Agentic Top 10 refer to the OWASP Top 10 for LLM Applications.

In ASI06 and ASI09, OWASP does not make tool use or communication with other agents a condition:

  • Memory & Context Poisoning (ASI06) applies to information that an agent "retains, retrieves, or reuses", for example RAG stores. RAG is Retrieval-Augmented Generation.
  • Human-Agent Trust Exploitation (ASI09) applies when users "over-rely on autonomous recommendations or unverifiable rationales" from an agent.

Thus, make the scope decision from the operation and the risks of the system. A system that uses RAG is not always agentic.

OWASP recommends Least-Agency. In the Letter, OWASP gives "advice to organizations to avoid unnecessary autonomy". OWASP adds that "deploying agentic behavior where it is not needed expands the attack surface without adding value". OWASP also writes that "strong observability becomes non-negotiable".

Least-Agency is a limit on autonomy. Least privilege is a limit on permissions. In the mitigations for ASI02, OWASP uses Least-Agency and least privilege together.

Date and effect ​

The OWASP GenAI Security Project made the OWASP Agentic Top 10, Version 2026, available on December 9, 2025.

The OWASP Agentic Top 10 gives security information from the "global OWASP community". It is not law. The OWASP mitigations are not obligations. In the Agentic Top 10, OWASP writes: "All information is for general informational purposes only." Other laws and contracts can apply to an agent. Examine them independently.

The Agentic Security Initiative is part of the OWASP GenAI Security Project. Before the Agentic Top 10, the Agentic Security Initiative made other information available, for example the Agentic AI Threats and Mitigations. On December 9, 2025, OWASP also wrote that "the community elevated the early public draft" into the Agentic Top 10. In the Letter, OWASP writes that it "will continue to evolve". Version 2026 does not give a date for the next Agentic Top 10.

OWASP makes the Agentic Top 10 available with the license CC BY-SA 4.0.

The OWASP Agentic Top 10 refers to LLM risks by their 2025 codes, for example LLM01:2025 Prompt Injection. On August 4, 2026, OWASP made the OWASP Top 10 for LLM Applications 2026 available. The 2025 codes in the Agentic Top 10 do not change to 2026 codes.

Agentic risks ​

The OWASP Agentic Top 10 has these 10 risks:

CodeRisk
ASI01Agent Goal Hijack
ASI02Tool Misuse and Exploitation
ASI03Identity and Privilege Abuse
ASI04Agentic Supply Chain Vulnerabilities
ASI05Unexpected Code Execution (RCE)
ASI06Memory & Context Poisoning
ASI07Insecure Inter-Agent Communication
ASI08Cascading Failures
ASI09Human-Agent Trust Exploitation
ASI10Rogue Agents

Each entry has a Description, Common Examples of the Vulnerability, Example Attack Scenarios, and Prevention and Mitigation Guidelines. The examples show how attacks can occur. They do not include all possible attacks.

Agent Goal Hijack ​

In the OWASP Agentic Top 10, ASI01 is Agent Goal Hijack. In ASI01, an attacker directly changes the goals, instructions, or "decision pathways" of an agent. OWASP gives the cause: agents and their models "cannot reliably distinguish instructions from related content".

Attackers can use "prompt-based manipulation, deceptive tool outputs, malicious artefacts, forged agent-to-agent messages, or poisoned external data". ASI01 applies "regardless of whether the manipulation occurs interactively or through pre-positioned inputs such as documents, templates, or external data sources".

OWASP gives this difference between ASI01 and two other risks:

  • Memory & Context Poisoning (ASI06) is the "persistent corruption of stored context or long-term memory".
  • Rogue Agents (ASI10) is "autonomous misalignment that emerges without active attacker control".

OWASP compares ASI01 with LLM01:2025 Prompt Injection. In the Agentic Top 10, LLM01:2025 "focuses on altering a single model response". ASI01 includes "manipulated inputs" that change agent goals and "multi-step behavior". If the agent uses planning, these inputs also change its planning. The OWASP Top 10 for LLM Applications 2025 also gives these possible results of prompt injection:

  • "Providing unauthorized access to functions available to the LLM"
  • "Executing arbitrary commands in connected systems"
  • "Manipulating critical decision-making processes"

Thus, the possible results of LLM01:2025 also include "arbitrary commands" and decisions.

OWASP recommends these mitigations for ASI01:

  • Inputs: "Treat all natural-language inputs (e.g., user-provided text, uploaded documents, retrieved content) as untrusted." "Route them through the same input-validation and prompt-injection safeguards defined in LLM01:2025 before they can influence goal selection, planning, or tool calls."
  • Least privilege and human approval: least privilege for agent tools. Human approval for "high-impact or goal-changing actions".
  • System prompts: "Define and lock agent system prompts". Changes "in goals or reward definitions must go through configuration management and human approval".
  • Intent checks: at runtime, validation of user intent and agent intent before "executing goal-changing or high-impact actions". "Pause or block execution on any unexpected goal shift, surface the deviation for review, and record it for audit."
  • Connected data: "Sanitize and validate any connected data source - including RAG inputs, emails, calendar invites, uploaded files, external APIs, browsing output, and peer-agent messages".
  • Monitoring: "Maintain comprehensive logging and continuous monitoring of agent activity, establishing a behavioral baseline that includes goal state, tool-use patterns, and invariant properties". The monitoring also shows "unexpected goal changes".
  • Tests: "periodic red-team tests simulating goal override and verify rollback effectiveness".
  • The Insider Threat Program: include AI agents in the "established Insider Threat Program" of the organization.

Tool Misuse and Exploitation ​

In the OWASP Agentic Top 10, Tool Misuse and Exploitation (ASI02) is the risk that an agent "operates within its authorized privileges but applies a legitimate tool in an unsafe or unintended way". OWASP gives these examples: "deleting valuable data, over-invoking costly APIs, or exfiltrating information".

OWASP gives these causes of tool misuse: "prompt injection, misalignment, or unsafe delegation or ambiguous instruction". The results can be "data exfiltration, tool output manipulation or workflow hijacking".

OWASP uses these conditions to select between ASI02 and the related risks ASI03, ASI05, and ASI04:

  • When the incorrect tool use includes "privilege escalation or credential inheritance", the risk is Identity and Privilege Abuse (ASI03).
  • When the incorrect tool use causes "arbitrary or injected code execution", the risk is Unexpected Code Execution (RCE) (ASI05).
  • When an attacker "manipulates the interface of an otherwise legitimate tool at runtime", the risk is ASI02. When "the tool itself is malicious or compromised at the source", the risk is Agentic Supply Chain Vulnerabilities (ASI04).

OWASP recommends these mitigations for ASI02:

  • Least-Agency and least privilege for tools: "per-tool least-privilege profiles (scopes, maximum rate, and egress allowlists)".
  • Authentication and human approval: "explicit authentication for each tool invocation". Also "human confirmation for high-impact or destructive actions (delete, transfer, publish)".
  • Sandboxes: tool or code execution in "isolated sandboxes". "Enforce outbound allowlists and deny all non-approved network destinations."
  • Policy enforcement: before execution, a policy enforcement point "validates intent and arguments, enforces schemas and rate limits, issues short-lived credentials".
  • Temporary access: "temporary credentials or API tokens that expire immediately after use".
  • Tool names: "fully qualified tool names and version pins to avoid tool alias collisions or typo squatted tools".
  • Logs and monitoring: "immutable logs of all tool invocations and parameter changes". Monitoring for unusual execution rates and "unusual tool-chaining patterns".

Identity and Privilege Abuse ​

In the OWASP Agentic Top 10, Identity and Privilege Abuse (ASI03) "exploits dynamic trust and delegation in agents to escalate access and bypass controls". Attackers change "delegation chains, role inheritance, control flows, and agent context". OWASP adds that "context includes cached credentials or conversation history across interconnected systems".

In ASI03, identity "refers both to the agent’s defined persona and to any authentication material that represents it". Examples are "API keys, OAuth tokens, delegated user sessions". OWASP gives the cause: the "architectural mismatch between user-centric identity systems and agentic design".

OWASP gives this difference from ASI03: Tool Misuse and Exploitation (ASI02) is "an unintended or unsafe use of already granted privilege".

OWASP recommends these mitigations for ASI03:

  • Permissions for each task: "short-lived, narrowly scoped tokens per task", "using per-agent identities and short-lived credentials".
  • Isolated sessions: "Run per-session sandboxes with separated permissions and memory, wiping state between tasks".
  • Authorization for each step: "Re-verify each privileged step with a centralized policy engine".
  • Human approval: "Require human approval for high-privilege or irreversible actions".
  • Intent: "Bind OAuth tokens to a signed intent that includes subject, audience, purpose, and session. Reject any token use where the bound intent doesn’t match the current request."
  • Permissions through delegation: "Monitor when an agent gains new permissions indirectly through delegation chains."

Agentic Supply Chain Vulnerabilities ​

In the OWASP Agentic Top 10, Agentic Supply Chain Vulnerabilities (ASI04) occur when "agents, tools, and related artefacts they work with are provided by third parties and may be malicious, compromised, or tampered with in transit". These components include "models and model weights, tools, plug-ins, datasets, other agents", agentic registries, and "update channels". They also include Model Context Protocol (MCP) and Agent2Agent (A2A) interfaces.

OWASP compares ASI04 with LLM03:2025 Supply Chain. For LLM03:2025, OWASP writes that "its focus is on static dependencies". OWASP adds that "agentic ecosystems often compose capabilities at runtime", "thereby increasing the attack surface".

OWASP recommends these mitigations for ASI04:

  • Provenance: "Sign and attest manifests, prompts, and tool definitions". Use Software Bills of Materials (SBOMs) and AI Bills of Materials (AIBOMs) with "periodic attestations". Keep a record of AI components.
  • Dependency gatekeeping: Use allowlists and pin dependencies. Check their provenance before "install or activation". Automatically reject "unsigned or unverified" dependencies.
  • Validation at runtime: "Re-check signatures, hashes, and SBOMs (incl. AIBOMs) at runtime".
  • Pinning: "Pin prompts, tools, and configs by content hash and commit ID." OWASP also recommends a "staged rollout with differential tests and auto-rollback on hash drift or behavioral change".
  • Supply chain kill switch: "emergency revocation mechanisms that can instantly disable specific tools, prompts, or agent connections across all deployments when a compromise is detected".

Unexpected Code Execution (RCE) ​

In the OWASP Agentic Top 10, Unexpected Code Execution (RCE) (ASI05) is the risk of "unexpected or adversarial execution of code" through code generation or tool access. The code can be "scripts, binaries, JIT/WASM modules, deserialized objects, template engines, in memory evaluations".

The results include "host or container compromise, persistence, or sandbox escape". A sandbox escape is one possible result. It is not a condition for ASI05. In Example Attack Scenario 1, an agent "generates and executes unreviewed install or shell commands in its own workspace, deleting or overwriting production data".

ASI05 includes these examples in an agentic attack:

  • "Shell command invocation from reflected prompts"
  • "Unsafe function calls, object deserialization, or code evaluation"
  • path traversal in "a series of tools in sequence" (Example Attack Scenario 5)

Code execution in ASI05 can start through the same tool interfaces as Tool Misuse and Exploitation (ASI02). OWASP gives this difference: ASI05 has "outcomes that require host and runtime-specific mitigations beyond ordinary tool-use controls".

OWASP recommends these mitigations for ASI05:

  • Execution environment: "Never run as root." Execute code in sandboxed containers "with strict limits including network access". "Where possible, restrict filesystem access to a dedicated working directory".
  • Architecture: "Isolate per-session environments with permission boundaries", least privilege, and "separate code generation from execution with validation gates".
  • Human approval: "Require human approval for elevated runs". Keep an allowlist for automatic execution in version control.
  • No eval: "Ban eval in production agents".
  • Static scans and monitoring: static scans before execution, runtime monitoring, and monitoring for "prompt-injection patterns".

Memory & Context Poisoning ​

In the OWASP Agentic Top 10, the context of an agent "includes any information an agent retains, retrieves, or reuses, such as summaries, embeddings, and RAG stores". Context does not include one-time input prompts, which LLM01:2025 Prompt Injection includes.

Memory & Context Poisoning (ASI06) is the risk that adversaries "corrupt or seed this context with malicious or misleading data". As a result, "future reasoning, planning, or tool use" can "become biased, unsafe, or aid exfiltration".

OWASP gives this difference between ASI06 and two other risks:

  • Agent Goal Hijack (ASI01) is "direct goal manipulation". OWASP adds that "memory poisoning frequently leads to goal hijacking".
  • Cascading Failures (ASI08) is the "degradation after poisoning occurs".

ASI06 "builds on LLM01:2025 Prompt Injection, LLM04:2025 Data and Model Poisoning, and LLM08:2025 Vector and Embedding Weaknesses". ASI06 is about the "persistent corruption of agent memory and retrievable context that propagates across sessions".

LLM04:2025 is about "pre-training, fine-tuning, or embedding data" that "is manipulated to introduce vulnerabilities, backdoors, or biases". In LLM04:2025, a backdoor "may leave the model's behavior untouched until a certain trigger causes it to change". Thus, the effects of data poisoning can also occur when the model is in use. The time of the damage is not the difference between LLM04:2025 and ASI06.

OWASP recommends these mitigations for ASI06:

  • Validation of memory writes: "Scan all new memory writes and model outputs (rules + AI) for malicious or sensitive content before commit."
  • Memory segmentation: "Isolate user sessions and domain contexts".
  • Access: "Allow only authenticated, curated sources" and "minimize retention by data sensitivity".
  • Provenance: "Require source attribution and detect suspicious updates or frequencies."
  • Memory stores: "Where you operate shared vector or memory stores, use per-tenant namespaces and trust scores for entries, decaying or expiring unverified memory over time and supporting rollback/quarantine for suspected poisoning."
  • Outputs of the agent: "Prevent automatic re-ingestion of an agent’s own generated outputs into trusted memory".

Insecure Inter-Agent Communication ​

In the OWASP Agentic Top 10, Insecure Inter-Agent Communication (ASI07) occurs when inter-agent communication does not have "proper authentication, integrity, or semantic validation". The result is "interception, spoofing, or manipulation of agent messages and intents". OWASP writes: "The threat spans transport, routing, discovery, and semantic layers".

An instruction does not always give the same result for each agent. In Example Attack Scenario 7, "A single instruction is parsed into divergent intents by different agents".

OWASP gives this difference between ASI07 and two other risks:

OWASP recommends these mitigations for ASI07:

  • Authentication: "Use end-to-end encryption with per-agent credentials and mutual authentication."
  • Message integrity: "Digitally sign messages, hash both payload and context, and validate for hidden or modified natural-language instructions."
  • Replay protection: "Protect all exchanges with nonces, session identifiers, and timestamps tied to task windows."
  • Discovery and routing: "Authenticate all discovery and coordination messages using cryptographic identity."
  • Message schemas: "versioned, typed message schemas". OWASP writes that "Typed contracts help with structure, but semantic divergence across agents remains an inherent challenge".

Cascading Failures ​

In the OWASP Agentic Top 10, Cascading Failures (ASI08) "describes the propagation and amplification of an initial fault" across agents, tools, and workflows. A "fault" can be a "hallucination, malicious input, corrupted tool, or poisoned memory". The "fault" can "compromise confidentiality, integrity, availability".

For an "initial fault" that is a "direct compromise", OWASP uses Agentic Supply Chain Vulnerabilities (ASI04), Memory & Context Poisoning (ASI06), or Insecure Inter-Agent Communication (ASI07). OWASP applies ASI08 "only when that defect spreads across agents, sessions, or workflows, causing measurable fan-out or systemic impact beyond the original breach".

OWASP writes about a "potential discrepancy in the speed and scale of fault propagation in a multi-agent system and the ability of humans to keep up with them". OWASP adds: "This leaves some unmitigated risks that the enterprise must evaluate carefully". Speed is not a condition for ASI08.

OWASP recommends these mitigations for ASI08:

  • Trust boundaries: "Sandbox agents, least privilege, network segmentation, scoped APIs, and mutual auth."
  • Policy enforcement: "Separate planning and execution via an external policy engine".
  • Output validation and human review: "Checkpoints, governance agents, or human review for high risk before agent outputs are propagated downstream."
  • Rate limiting and monitoring: "Detect fast-spreading commands and throttle or pause on anomalies."
  • Blast-radius guardrails: "quotas, progress caps, circuit breakers between planner and executor".
  • Logs: "tamper-evident, time-stamped logs bound to cryptographic agent identities".

Human-Agent Trust Exploitation ​

In the OWASP Agentic Top 10, agents "can establish strong trust with human users". Human-Agent Trust Exploitation (ASI09) is the risk that "Adversaries or misaligned designs may exploit this trust to influence user decisions, extract sensitive information, or steer outcomes for malicious purposes". OWASP writes that the risk is "amplified when humans over-rely on autonomous recommendations or unverifiable rationales, approving actions without independent validation".

In ASI09, OWASP writes about an agent "manipulating the human into performing the final, audited action, making the agent's role in the compromise invisible to forensics".

OWASP gives this difference between ASI09 and Rogue Agents (ASI10): "This entry is about human misperception or over-reliance whereas ASI10 is agent intent deviation."

OWASP recommends these mitigations for ASI09:

  • Human approval: approval in more than one step, or human in the loop, "before accessing extra sensitive data or performing risky actions".
  • Reports from users: "In user-interactive systems, provide plain-language risk summary (not model-generated rationales) and a clear option for users to flag suspicious or manipulative agent behavior".
  • Human oversight: "Continuously adjust the level of agent autonomy and required human oversight based on contextual risk scoring." OWASP also recommends "confidence weighted cues", for example "low-certainty" or "unverified source", that "visually prompt users to question high-impact actions".
  • Personnel: "appropriate training of human personnel involved in the evolving human oversight of autonomous agentic systems".
  • Provenance: "Attach verifiable metadata-source identifiers, timestamps, and integrity hashes-to all recommendations and external data."
  • Preview: "Block any network or state-changing calls during preview context".

Rogue Agents ​

In the OWASP Agentic Top 10, Rogue Agents (ASI10) "are malicious or compromised AI Agents that deviate from their intended function or authorized scope". They are agents "acting harmfully, deceptively, or parasitically within multi-agent or human-agent ecosystems". OWASP writes that the agent’s "actions may individually appear legitimate, but its emergent behavior becomes harmful".

An external compromise "can initiate the divergence", for example prompt injection, Agent Goal Hijack (ASI01), or "Supply Chain tampering". ASI10 is about "the loss of behavioral integrity and governance once the drift begins, not the initial intrusion itself".

OWASP recommends these mitigations for ASI10:

  • Audit logs: "immutable and signed audit logs of all agent actions, tool calls, and inter-agent communication".
  • Monitoring: "watchdog agents to validate peer behavior and outputs".
  • Behavioral integrity: "per-agent cryptographic identity attestation" and "behavioral integrity baselines throughout the agent lifecycle".
  • Containment: "rapid mechanisms like kill-switches and credential revocation to instantly disable rogue agents". Also "Quarantine suspicious agents in sandboxed environments for forensic review."
  • Protection: "Keys must never be directly available to agents". OWASP adds that "orchestrators should mediate signing operations so that a compromised agent cannot simply exfiltrate or misuse long-lived keys".
  • After quarantine: "Establish trusted baselines for restoring quarantined or remediated agents. Require fresh attestation, dependency verification, and human approval before reintegration into production networks."

The OWASP mitigations for ASI10 do not give a time limit for containment. The organization makes the decision about who can use a kill switch.

Other frameworks ​

The OWASP Agentic Top 10 gives the relation of its entries to other OWASP work:

  • the OWASP Top 10 for LLM Applications (2025), the Agentic AI Threats and Mitigations, and the AIVSS Core Risks, in Appendix A
  • OWASP CycloneDX and AIBOM, in Appendix B
  • the OWASP Non-Human Identities Top 10 (2025), in Appendix C

The OWASP Agentic Top 10 does not give a mapping to NIST AI RMF, ISO/IEC 42001, or the EU AI Act.

The OWASP GenAI Crosswalk is different from the Agentic Top 10. It gives mappings from OWASP risks to "industry frameworks", for example NIST AI RMF, ISO/IEC 42001, and the EU AI Act. These mappings include the Agentic Top 10. In the Crosswalk, OWASP writes: "Every mapping in this project is unreviewed until a named reviewer signs it." Thus, a Crosswalk mapping does not show that two frameworks are equivalent.

NIST AI RMF 1.0 "is intended to be voluntary" and does not give a mapping to the ASI risks.

For ISO/IEC 42001, see ISO/IEC 42001. For the EU AI Act, see EU AI Act.

Use in Modulos ​

Modulos gives the OWASP Agentic Top 10 as the Framework MFF-14 (OWASP - Top 10 for Agentic Applications) at AI System level. To add the Framework to an AI System and use its Requirements, see Use OWASP Top 10 for Agentic Applications in Modulos.

FAQ ​

For the FAQ about the OWASP Agentic Top 10, see OWASP Agentic Top 10 FAQ.

Use OWASP Top 10 for Agentic Applications in Modulos

MFF-14, the Requirement mapping, and the recommended steps

Frequently asked questions about OWASP Top 10 for Agentic Applications

When to use the Agentic Top 10 and how its risks are different

OWASP Top 10 for LLM Applications

The OWASP risks of LLM applications, to which the Agentic Top 10 refers

OWASP for AI security

The OWASP Top 10 for LLM applications and for agentic applications

Control overlap

Control overlap between Frameworks

Sources ​