Frequently asked questions about OWASP Top 10 for Agentic Applications

This FAQ gives information about OWASP Agentic Top 10 scope, security risks, the LLM Top 10, and use in Modulos.

Disclaimer

This page gives general information. It is not legal advice.

What is the OWASP Top 10 for Agentic Applications 2026?

The OWASP Top 10 for Agentic Applications (OWASP Agentic Top 10) gives security information about risks in systems that use AI agents. The OWASP GenAI Security Project made Version 2026 available on December 9, 2025.

• OWASP wrote the Agentic Top 10 for "builders, defenders, and decision-makers", and as a "go-to reference for security leaders and practitioners".
• The Agentic Top 10 has ten sections about security risks, ASI01 to ASI10. Each section has a "Description", "Common Examples of the Vulnerability", "Example Attack Scenarios", and "Prevention and Mitigation Guidelines".
• These sections identify security risks. They are not obligations in law.

See Date and effect and Agentic risks.

How is the OWASP Agentic Top 10 different from the LLM Top 10?

The OWASP LLM Top 10 is about security risks in LLM applications. The Agentic Top 10 is about agents that "plan, decide, and act across multiple steps and systems". OWASP connects the Agentic risks to the LLM Top 10. OWASP does not make tools or communication between agents a condition for ASI06 (memory poisoning) or ASI09 ("human misperception or over-reliance").

The Agentic Top 10 uses LLM 2025 codes. OWASP made the LLM Top 10 2026 available on August 4, 2026. This does not change those 2025 codes.

See When to use the Agentic Top 10 and Date and effect. For the LLM Top 10, see OWASP Top 10 for LLM Applications.

Is the OWASP Top 10 for Agentic Applications mandatory?

No. The OWASP Agentic Top 10 is security information from the OWASP GenAI Security Project. It does not make obligations in law. OWASP identifies its information as "for general informational purposes only".

OWASP writes some of its security information as instructions, for example "Use end-to-end encryption with per-agent credentials". These instructions do not make the Agentic Top 10 a law. If a law applies to an AI system, the obligations of that law apply. It is necessary to examine those obligations independently of the Agentic Top 10.

See Date and effect.

How does the Agentic Top 10 relate to NIST AI RMF and ISO/IEC 42001?

The Agentic Top 10 gives no mapping to NIST AI RMF or ISO/IEC 42001. OWASP's GenAI Crosswalk gives mappings from OWASP risks to "industry frameworks". The risks include the Agentic Top 10. The frameworks include NIST AI RMF and ISO/IEC 42001. Its mappings stay "unreviewed until a named reviewer signs" them.

NIST identifies the AI RMF as "intended to be voluntary". The AI RMF does not tell organizations to examine the ASI risks. A Crosswalk row does not show compliance with a standard or give certification.

See Other frameworks, NIST AI RMF, and ISO/IEC 42001.

Why does prompt injection appear in both the LLM and Agentic Top 10s?

OWASP includes prompt injection in each Top 10 because it can change a "single model response" (LLM01:2025) or agent goals and "multi-step behavior" (ASI01). LLM01:2025 can also cause "unauthorized access to functions", "arbitrary commands", and changes to decisions, not only incorrect model output. ASI01 includes methods other than prompt injection. ASI06 (Memory & Context Poisoning) is about "the persistent corruption of stored context or long-term memory".

See Agent Goal Hijack and Memory & Context Poisoning.

Is OWASP Top 10 for Agentic Applications stable enough to base controls on?

The Agentic Top 10 can change. OWASP identifies it as "a clear starting point for reducing agentic AI risks".

• Other OWASP Agentic Security Initiative work, and an "early public draft", came before Version 2026.
• In the Agentic Top 10, OWASP writes that it "will continue to evolve". The OWASP sources do not give a date for the next Agentic Top 10.
• The applicable risks and mitigations change with the tasks of your agents and with the risks of your system.

See Date and effect.

Does tool misuse require an agent to exceed its permissions?

No. In OWASP's Agentic Top 10, ASI02 (Tool Misuse and Exploitation) includes tool misuse where the agent "operates within its authorized privileges but applies a legitimate tool in an unsafe or unintended way".

Two different entries apply in these conditions:

• If the tool misuse "involves privilege escalation or credential inheritance", the entry is ASI03 (Identity and Privilege Abuse).
• If the tool misuse causes "arbitrary or injected code execution", the entry is ASI05 (Unexpected Code Execution (RCE)).

See Tool Misuse and Exploitation.

Does ASI05 require a sandbox escape?

No. In OWASP's Agentic Top 10, ASI05 (Unexpected Code Execution (RCE)) is about "unexpected or adversarial execution of code". Attackers use "code-generation features or embedded tool access". A sandbox escape is one possible result. OWASP identifies "host or container compromise, persistence, or sandbox escape" as results.

• ASI05 includes damage from code execution in the agent's workspace, for example "deleting or overwriting production data" (ASI05 Attack Scenario 1).

See Unexpected Code Execution (RCE) and the difference from tool misuse.

Can memory poisoning affect a RAG system?

Yes. OWASP's Agentic Top 10 includes poisoning of an agent's "RAG stores" in ASI06 (Memory & Context Poisoning). In ASI06, context is "any information an agent retains, retrieves, or reuses, such as summaries, embeddings, and RAG stores".

• In ASI06, adversaries "corrupt or seed this context with malicious or misleading data". This can cause the "future reasoning, planning, or tool use" of the agent to "become biased, unsafe, or aid exfiltration".
• ASI06 does not include "one-time input prompts". LLM01:2025 (Prompt Injection) applies to them.
• ASI06 is about agentic systems. It does not make each RAG system an agentic system.

See Memory & Context Poisoning.

Does encryption prevent all inter-agent communication risks?

No. In OWASP's Agentic Top 10, ASI07 (Insecure Inter-Agent Communication) also includes "manipulation of agent messages and intents". ASI07 occurs when the communication between agents does not have "proper authentication, integrity, or semantic validation". The risk "spans transport, routing, discovery, and semantic layers".

OWASP recommends "versioned, typed message schemas". These schemas give messages a specified structure. But OWASP writes that "semantic divergence across agents remains an inherent challenge". The message structure does not remove this risk.

See Insecure Inter-Agent Communication.

Which Modulos Framework covers the OWASP Agentic Top 10?

MFF-14 is the Modulos Framework for the OWASP Top 10 for Agentic Applications at AI System level. The Framework gives you the Requirements for the OWASP risks. The use of MFF-14 does not show that an AI System is safe or that it obeys a law.

See Use in Modulos, Add the Framework, and Review the Requirements.