OWASP Top 10 for Agentic Applications

In ASI01: Agent Goal Hijack, attackers manipulate an agent's goals, task selection, or decision paths – for example via indirect Prompt Injection in web pages, documents, or emails – because models cannot reliably distinguish instructions from content. ASI06: Memory & Context Poisoning, by contrast, describes the persistent corruption of the context window and long-term memory, which influences decisions even after the original session ends and can spread across cooperating agents.

ASI02: Tool Misuse and Exploitation covers the abuse of legitimate tools within authorized privileges – for example data exfiltration by chaining internal and external tools, over-privileged APIs, or poisoned tool descriptions (Tool Poisoning). If the manipulation leads to unexpected or injected code execution, ASI05: Unexpected Code Execution (RCE) applies – for instance when an agent executes shell commands hidden in inputs or runs self-generated code without review.

ASI03: Identity and Privilege Abuse covers inherited permissions during delegation, cached credentials, and Confused Deputy attacks in which a compromised agent gets a higher-privileged agent to act on its behalf. ASI04: Agentic Supply Chain Vulnerabilities addresses the supply chain of agentic systems – from compromised MCP and registry servers and manipulated tool descriptors to vulnerable third-party agents.

ASI07: Insecure Inter-Agent Communication deals with unencrypted or unauthenticated agent-to-agent communication that enables manipulation, replay, and spoofing; ASI08: Cascading Failures describes how individual faults amplify system-wide across coupled agents. ASI09: Human-Agent Trust Exploitation exploits people's trust in agents – for example through fabricated justifications – while ASI10: Rogue Agents covers agents that permanently deviate from their intended behavior without active attacker control.

The publication extends Least Privilege and the LLM risk concept of Excessive Agency with the principle of Least Agency: unnecessary autonomy enlarges the attack surface without adding value and should be consistently avoided. In addition, OWASP recommends human-in-the-loop approvals for critical actions as well as regular red team exercises that simulate, among other things, goal-override scenarios.

Without visibility into what agents do, why they do it, and which tools they call, deviations go undetected – OWASP therefore describes strong observability as non-negotiable and calls for immutable, signed audit logs of all agent actions, tool calls, and agent communication. For a systematic approach, the Agentic AI Threat Navigator (guiding questions for threat identification) and the Securing Agentic Applications Guide (protection across design, build, deployment, and operations) provide the matching companion documents.