01Goal and context manipulation
In ASI01: Agent Goal Hijack, attackers manipulate an agent's goals, task selection, or decision paths – for example via indirect Prompt Injection in web pages, documents, or emails – because models cannot reliably distinguish instructions from content. ASI06: Memory & Context Poisoning, by contrast, describes the persistent corruption of the context window and long-term memory, which influences decisions even after the original session ends and can spread across cooperating agents.
02Tool misuse and code execution
ASI02: Tool Misuse and Exploitation covers the abuse of legitimate tools within authorized privileges – for example data exfiltration by chaining internal and external tools, over-privileged APIs, or poisoned tool descriptions (Tool Poisoning). If the manipulation leads to unexpected or injected code execution, ASI05: Unexpected Code Execution (RCE) applies – for instance when an agent executes shell commands hidden in inputs or runs self-generated code without review.
03Identities, privileges, and the supply chain
ASI03: Identity and Privilege Abuse covers inherited permissions during delegation, cached credentials, and Confused Deputy attacks in which a compromised agent gets a higher-privileged agent to act on its behalf. ASI04: Agentic Supply Chain Vulnerabilities addresses the supply chain of agentic systems – from compromised MCP and registry servers and manipulated tool descriptors to vulnerable third-party agents.
04Multi-agent and trust risks
ASI07: Insecure Inter-Agent Communication deals with unencrypted or unauthenticated agent-to-agent communication that enables manipulation, replay, and spoofing; ASI08: Cascading Failures describes how individual faults amplify system-wide across coupled agents. ASI09: Human-Agent Trust Exploitation exploits people's trust in agents – for example through fabricated justifications – while ASI10: Rogue Agents covers agents that permanently deviate from their intended behavior without active attacker control.
05Least Agency as a guiding principle
The publication extends Least Privilege and the LLM risk concept of Excessive Agency with the principle of Least Agency: unnecessary autonomy enlarges the attack surface without adding value and should be consistently avoided. In addition, OWASP recommends human-in-the-loop approvals for critical actions as well as regular red team exercises that simulate, among other things, goal-override scenarios.
06Observability, logging, and lifecycle
Without visibility into what agents do, why they do it, and which tools they call, deviations go undetected – OWASP therefore describes strong observability as non-negotiable and calls for immutable, signed audit logs of all agent actions, tool calls, and agent communication. For a systematic approach, the Agentic AI Threat Navigator (guiding questions for threat identification) and the Securing Agentic Applications Guide (protection across design, build, deployment, and operations) provide the matching companion documents.
