---
title: "The OWASP Top 10 for Agentic Applications: Ten Risks, Ten Questions You Can Answer"
description: "A peer-reviewed list of agentic risks is only useful once it becomes a work plan. Here is each item turned into a question about your own stack, plus a faster triage test."
author: "Declan Osei"
category: "Attack Surface & Threat Modeling"
date: 2026-10-19T06:25:01.125Z
canonical: "https://agenticcyber.co/blog/owasp-top-10-agentic-applications-practical-guide"
---

# The OWASP Top 10 for Agentic Applications: Ten Risks, Ten Questions You Can Answer

![a person is writing on a paper with a pen](https://images.unsplash.com/photo-1631540700496-af53025473e8?crop=entropy&cs=tinysrgb&fit=max&fm=jpg&ixid=M3w4OTQwNjJ8MHwxfHNlYXJjaHwxfHxUaGUlMjBPV0FTUCUyMFRvcCUyMDEwJTIwZm9yJTIwQWdlbnRpYyUyMEFwcGxpY2F0aW9ucyUyQyUyMFR1cm5lZCUyMEludG8lMjBhJTIwTW9uZGF5JTIwQ2hlY2tsaXN0JTIwb3dhc3BzJTIwYWdlbnRpYyUyMHJpc2tzfGVufDF8MHx8fDE3OTE3OTU3MTd8MA&ixlib=rb-4.1.0&q=75&w=1200&auto=format)

> A peer-reviewed list of agentic risks is only useful once it becomes a work plan. Here is each item turned into a question about your own stack, plus a faster triage test.

Risk lists collect agreement and very little action. A security lead reads ten entries, recognises all ten, forwards the link to a channel, and nothing in the architecture moves. The useful conversion is narrower than a reading: per entry, what is the one question that settles whether this can happen in our deployment, and who can answer it with evidence today?

OWASP's GenAI Security Project maintains a dedicated list for agentic applications, separate from the one covering LLM applications generally. This guide converts each entry into that single question. The later sections cover where the list is thinner than it looks, and a faster triage for teams whose calendar will not support a full pass. Use it as a starting inventory, not as a verdict on your posture.

## What the List Covers

The project [presents it as a globally peer-reviewed framework](https://genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications-the-benchmark-for-agentic-security-in-the-age-of-autonomous-ai/) for the risks that matter most in autonomous systems, and credits Keren Katz, Ron F. Del Rosario and John Sotiropoulos among the authors on its announcement.

Here are the ten entries in published order, each with the one-line reading a defender needs:

- **ASI01 Agent Goal Hijack.** Planted prose redirects what the agent is trying to achieve.

- **ASI02 Tool Misuse.** Permitted capability, used toward an outcome nobody sanctioned.

- **ASI03 Identity and Privilege Abuse.** Authority held too broadly, or borrowed and never returned.

- **ASI04 Agentic Supply Chain Vulnerabilities.** Components and instructions that change behaviour from outside review.

- **ASI05 Unexpected Code Execution.** A path from generated text to a running process.

- **ASI06 Memory and Context Poisoning.** Durable state that carries an attacker's content into later sessions.

- **ASI07 Insecure Inter-Agent Communication.** Messages between agents trusted because they arrived.

- **ASI08 Cascading Failures.** One wrong result consumed downstream with no independent check.

- **ASI09 Human-Agent Trust Exploitation.** Oversight defeated by what the review screen chooses to show.

- **ASI10 Rogue Agents.** Autonomy running without an owner, an inventory entry or a stop control.

The distinction from the older LLM list is worth holding onto. [The project page for the agentic edition](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/) frames its scope around what becomes reachable once a model holds state, invokes tools and coordinates with other models, rather than only producing text for a person to read.

## Read the List for What It Is Really About

Notice the absence. Nothing here is titled poor output, nothing covers hallucination, nothing covers tone. Nearly every entry concerns authority: objectives, capability, credentials, execution, durable state, trusted messages, autonomy nobody signed off. Once output becomes action, the governing question stops being accuracy and becomes permission.

Simon Willison's framing of the dangerous combination is the sharpest single lens on the whole document. He [warns that three properties together hand an attacker a path to your data](https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/): reach into private data, exposure to content an outsider wrote, and some route by which information can leave. A majority of these entries describe one way of assembling that set.

## The First Three Entries as Questions

- **Goal hijack.** Which text reaches this agent that nobody on your payroll authored: inbound mail, portal tickets, scraped pages, externally shared documents? How much of it lands in a position to redirect the objective rather than merely inform an answer? The mechanism is in our analysis of [adversarial instructions crossing agent boundaries](/how-adversarial-instructions-cross-agent-boundaries).

- **Tool misuse.** Per registered tool, name the most damaging entirely legitimate invocation. Not a bug: the worst thing the tool is designed to do. Then ask whether any argument is validated by code sitting outside the model. See [detecting malicious tool calls](/detecting-malicious-tool-calls-in-agentic-ai-systems).

- **Identity and privilege abuse.** Whose authority does this agent carry, for how long, and will a downstream log name both the agent and the person behind a given call? Compare with [privilege escalation in agentic systems](/privilege-escalation-in-agentic-systems).

## Entries Four Through Seven as Questions

- **Agentic supply chain.** Which packages, connectors, tool servers and skill files are able to alter behaviour here, and who signs off on an update to each? Start from [where trust breaks down in agentic pipelines](/supply-chain-risk-in-agentic-pipelines-where-trust-breaks-down).

- **Unexpected code execution.** Is there any route from the agent to a shell or an interpreter, whether declared or offered quietly by a tool? Inside which isolation boundary, and which credentials sit in that environment?

- **Memory and context poisoning.** What survives between sessions, who holds write access to that store, and does anything review an entry before it becomes durable?

- **Inter-agent communication.** When one agent messages a second, is the sender authenticated, or is arrival itself the authorisation? Unauthenticated internal traffic is an escalation path with a friendly name.

## The Last Three Entries as Questions

- **Cascading failures.** Where the first agent returns a confidently wrong result, does a second consume it unchecked? Name your circuit breaker, or accept in writing that there is none.

- **Human-agent trust exploitation.** Does an approval screen render the actual parameters, or a summary the model composed about itself? Approval fatigue is a control failure with an interface cause, and it is measurable: count the approvals granted inside two seconds.

- **Rogue agents.** Is there a current register of everything running against company data, and a tested route to halting one of them within minutes?

## Where a Ranked List Helps Less Than It Looks

Ranking flattens whatever it ranks. This document does not know your architecture, cannot order risks for your deployment, and says nothing about which of your controls are mature rather than merely present. Two cautions matter in practice.

The entries overlap heavily, so one incident can satisfy four of them at once and a count of covered boxes carries no information. And a taxonomy is not a threat model: use this to find holes in a model your team built, in that sequence, never as a replacement for building one.

## A Half-Day Exercise

- Lay the ten entries into a table, then add a column naming which of your agents is exposed to each.

- Per exposed agent, record the worst plausible outcome as one sentence a non-specialist could repeat in a meeting.

- Note which control already caps that outcome: isolation, a scoped credential, an approval gate, a detection.

- Pull the two rows where that last column is blank. Those are the next sprint, and the document has earned its keep.

## The Faster Triage: Count Three Properties Per Agent

Where a pass through ten entries exceeds what the calendar allows, run a single test per agent instead. Does it reach private data? Does it consume content an outsider can author? Does it have any route out, through mail, an outbound request, a rendered image or a link?

Meta hardens that count into a design constraint it calls the Agents Rule of Two. [Its guidance holds that a session should carry at most two of those three properties](https://ai.meta.com/blog/practical-ai-agent-security/) while injection remains something no detector reliably refuses, the properties being untrustworthy input, reach into sensitive data or systems, and the ability to change state or communicate outward. Where all three are genuinely required, the run belongs in a fresh context or under live supervision.

The test replaces nothing on the list. Its job is to tell you which agents earn the full treatment first, which is usually the decision blocking the work. Whichever agent holds all three properties is where the first three entries converge, and that is where the half day goes.

## Three Documents Now, Not One

Anyone who read the list when it appeared and filed it has missed what happened since. The OWASP GenAI Security Project published two companion resources on 1 September 2026, and they change what the ten entries are good for. The first is the [Agent Control Standard, an open standard describing how agent platforms expose middleware hooks and how safety policies get enforced through them](https://genai.owasp.org/resource/agent-control-standard-acs/), which its page frames as declarative controls that stay portable across agent frameworks and run at execution time. That is a different kind of artefact from a risk list: it is the enforcement layer the list implies but never specifies.

The second matters more if anyone outside engineering reads your output. The [GenAI Security Industry Framework Crosswalk maps 51 GenAI vulnerabilities drawn from four OWASP lists onto controls in 25 frameworks](https://genai.owasp.org/resource/genai-security-industry-framework-crosswalk/), naming NIST, ISO, MITRE ATLAS and the EU AI Act among them. The practical effect is that an ASI entry stops being an OWASP-only reference and becomes something you can hand to a risk function that has never heard of ASI06. Note the direction of travel: the project is building the bridges, not asking you to build them.

The LLM list moved too. There is now an [OWASP GenAI LLM Top 10 for 2026](https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/) sitting alongside the agentic edition, so if your reference is the 2025 version of the older list, you are working from superseded material. Check the project's resource pages for the current edition before you quote an entry number in a design review, because the numbering is where these revisions bite.

One caution on the Agent Control Standard. Portable declarative controls are only as portable as the hooks underneath them, so the first question is whether the framework you already run exposes anything an external policy can attach to. Where it does not, the standard describes a shape you will be implementing yourself, which is still useful as a specification and considerably more work than adopting a library.

## The Ranking Is the Least Useful Thing in the Document

Most teams respond to a ten-entry list by running a ten-entry pass. A matrix gets built, every row gets a colour, the matrix is presented, and the architecture does not change. We would skip it. Run the three-property count from the previous section across every agent you own, fix identity and tool scope on whichever agents hold all three, and treat the list as shared vocabulary for the design review rather than as a workplan. The reasoning is in the structure of the document itself: the entries overlap so heavily that one incident lands in four of them, the ordering reflects community consensus about agentic systems in general rather than anything about your deployment, and the two entries covering authority cap the plausible impact of most of the rest. Ten units of effort spread evenly over ten entries buys less than four units spent on the second and third.

Someone outside your team needing to see coverage changes the picture. If an enterprise customer's security questionnaire, an auditor or a regulator wants your posture expressed against a named framework, the full pass stops being theatre and becomes the deliverable, because the crosswalk published in September makes each entry legible to NIST, ISO and the EU AI Act without you inventing the mapping. In that case build the matrix properly and budget for it as compliance work, which is what it is. What we would not do is build it first, for yourselves, and mistake a completed grid for a reduced blast radius.

## Before an Agent Goes Near Anything Serious

Any agent able to move money, alter production configuration or read regulated records deserves review by qualified security staff ahead of launch. Treat this article as analysis rather than an audit.

Expect the list itself to move as the field accumulates real incident data. Its most durable value is a shared vocabulary inside a design review, so keep your own incident history filed beside it.

A final word on how to present this internally. A list of ten risks read aloud in a steering meeting produces agreement and no budget. The same list, rendered as a table with your own agent names in the second column and blank cells in the fourth, produces an argument about which blank cell gets filled first. That argument is the point. The document's value is not in its taxonomy, which will be revised, but in its capacity to turn a vague unease about autonomy into two named pieces of work with an owner against each.

## Questions about the agentic risk list

### Is this the same document as the OWASP list for LLM applications?

No. That one centres on a model and the application wrapped around it. This one covers what opens up once models act, retain state and coordinate with each other.

### Which entry should a team address first?

Identity and tool scope, the third and second entries. Narrow authority caps the realistic impact of most of the remaining eight, and neither requires a purchase.

### Does the list ship mitigations with it?

The project publishes supporting material alongside the entries. Read the current project pages rather than a cached summary, because the guidance is still under revision.

### Can a compliance function use it?

It serves as a risk taxonomy inside an assessment. It is not something you certify against, and presenting it that way will not survive a reviewer's scrutiny.

## FAQ

### Is this the same as the OWASP Top 10 for LLM Applications?

No. The LLM list centres on a model and the application around it. The agentic list covers what becomes reachable once models take actions, retain state and coordinate with each other.

### Which entry should a team address first?

Identity and tool scope, the third and second entries. Narrow authority reduces the realistic impact of most of the other eight, and both are design decisions rather than purchases.

### Does the list ship mitigations?

Not inside the ten entries. The project's answer to that question is a separate document, the Agent Control Standard, published in September 2026, which specifies how a platform exposes hooks for policy enforcement at runtime. Read the current project resource pages rather than a cached summary.

### Can a compliance function use it?

As a risk taxonomy inside an assessment, yes, and the project's Framework Crosswalk now maps its entries onto controls in established frameworks including NIST, ISO, MITRE ATLAS and the EU AI Act. It is still not something you certify against.


---
Source: https://agenticcyber.co/blog/owasp-top-10-agentic-applications-practical-guide