If you've been following the OWASP Top 10 for LLM Applications, you already have a working mental model of how language models can be misused. The agentic version, released by the OWASP GenAI Security Project in December 2025, is not an update to that list. It's a different document addressing a different problem. Where the LLM Top 10 focuses on what can go wrong when a model generates bad output, the Agentic Top 10 focuses on what can go wrong when an AI system takes autonomous actions in the world. The distinction matters because the consequences are different in kind, not just in degree. A model that generates harmful text is a content problem. An agent that executes harmful code, escalates its own privileges, or operates unsupervised across your production infrastructure is an operational security problem — the kind that the runtime security layer is specifically designed to catch.
Why the agentic list is different from what came before
The OWASP framework was developed through collaboration with more than 100 security researchers and practitioners, and reviewed by a board that includes representatives from NIST, the Alan Turing Institute, and Microsoft's AI Red Team. The ten risks it identifies, coded ASI01 through ASI10, share a common theme: agents are not just language models with a chat interface. They are autonomous actors with tool access, persistent memory, and in many cases the ability to delegate to other agents. Every one of those properties introduces an attack surface that the LLM Top 10 was not designed to cover.
The framework also introduces a concept it calls least agency: the principle that agents should be granted only the minimum autonomy required to perform their intended task safely and within defined boundaries. This is the agentic analog to least privilege, and it is the through-line that connects every item on the list. Organizations applying this principle at design time will find it maps directly onto the pre-production guardrail requirements covered in Chapter 4.
The ten risks, and what they actually mean in practice
Agent Goal Hijack
The foundational risk that enables most of the others. Attackers manipulate an agent's objectives through prompt injection in user input, poisoned retrieval results, forged messages from other agents, or malicious artifacts the agent processes. The agent doesn't know it has been redirected.
Tool Misuse
Agents with access to real tools — databases, APIs, file systems, code execution — can be manipulated into using those tools in ways their designers never intended. The tools themselves work correctly. The problem is the agent using them with destructive or malicious parameters.
Identity & Privilege Abuse
Agents running under shared service account credentials, or with permissions far broader than their task requires, become high-value targets. Compromise an agent's identity and you inherit everything it could access — the agent-flavored lateral movement problem. This is why the organizational identity model matters.
Supply Chain Vulnerabilities
Agents depend on third-party tools, plugins, retrieval systems, and pre-built model components. Any of those dependencies can be tampered with at build time or at runtime. The agentic supply chain is still largely ungoverned compared to what organizations have built for software supply chains.
Unexpected Code Execution
Agents that can write and run code are particularly exposed. If an attacker can influence what an agent generates, and the agent can execute what it generates, the path from prompt injection to arbitrary code execution is short. Sandboxed environments are the primary mitigation.
Memory & Context Poisoning
Agents with persistent memory can be compromised in a way that outlasts any single session. Attackers poison the stored context an agent draws on for future reasoning, reshaping its behavior long after the initial interaction. The compromise becomes persistent and hard to detect.
Insecure Inter-Agent Communication
In multi-agent systems, agents exchange messages with other agents. Those messages typically lack authentication and integrity controls. An attacker who can spoof or inject into inter-agent communication can redirect entire clusters of agents.
Cascading Failures
Agentic systems are composed: one agent's output becomes another agent's input. A single misconfiguration or injection can cascade through an entire pipeline before any human sees the output. Circuit breakers and deep observability into inter-agent communication are the core defenses — the same observability capability described in Chapter 2's organizational governance model.
Human-Agent Trust Exploitation
The attack surface is the human in the loop. Agents produce polished, authoritative-sounding explanations. Humans tend to trust them. A compromised agent can generate a confident recommendation and the human approver rubber-stamps it without independent verification.
Rogue Agents
The most extreme manifestation: an agent that has fundamentally diverged from its intended behavior, through deliberate compromise, memory poisoning, or emergent misalignment. The defining characteristic is that it continues operating unsupervised, outside its original scope, without anyone noticing.
Where to actually start
Ten risks is a lot to address at once, and most organizations deploying agents today don't have the tooling or staffing to tackle the full list simultaneously. A reasonable starting sequence focuses on the risks that either enable all the others or are easiest to exploit with readily available techniques.
Agent Security Checklist: A practical sequencing guide for working through the OWASP Agentic Top 10 — organized by priority and mapped to the four organizational capabilities.
Download Free →Start with identity
ASI03 is the leverage point for nearly every other risk on the list. An agent running under a shared service account with inherited permissions is an agent that can be turned into a high-privilege attacker the moment goal hijack or tool misuse succeeds. Give every agent its own discrete identity, scope its permissions to exactly what it needs, and treat those identities with the same rigor you apply to privileged human accounts. NIST's AI Agent Standards Initiative provides a concrete framework for applying OAuth 2.0, OpenID Connect, and SPIFFE/SPIRE to agents as non-human identities — and Chapter 2 covers how this maps to the organizational governance layer.
Address input validation at every boundary
ASI01 happens because agents trust content they retrieve, tools they call, and messages they receive from other agents. Building input validation into the agent's reasoning pipeline — not just its user-facing interface — is the structural change that makes goal hijack harder to execute. The OWASP framework specifically calls out indirect prompt injection, where the malicious instruction arrives through a retrieved document rather than directly from a user. The pre-production guardrail layer in Chapter 4 covers the technical implementation in detail.
Build logging before you need it
ASI08 and ASI10 are nearly impossible to detect without comprehensive observability into what agents are actually doing. Every tool call, every decision, every inter-agent message should be logged and auditable. The EU AI Act's requirements for demonstrating that autonomous systems operate within enforced boundaries take effect in August 2026, creating an additional compliance reason to prioritize this now. See how Chapter 1 describes the continuous audit logging requirement for production agents.
Design human oversight as a real control
ASI09 exists because human approval, when it becomes routine, becomes automatic. Structuring oversight so that high-impact actions require meaningful review — and training operators on automation bias rather than assuming they will catch problems on their own — is what separates an effective oversight layer from a compliance checkbox. That is a process design question as much as a technical one. Chapter 4 covers the three-tier oversight model (low/medium/high impact) in detail.
Framework Context
The OWASP Top 10 for Agentic Applications is the right place to anchor a security program for AI agents. It is peer-reviewed, practically grounded, and directly actionable. The risks it identifies are not hypothetical. They are the attack patterns that emerge when organizations deploy agents at scale without the governance structures to match. The question is not whether to take the list seriously. It is whether to do the work now or after the first incident. The complete series — runtime security, organizational governance, pre-production guardrails, and stopping prompt injection — provides a structured path from this list to working controls.
See how Skyrelis addresses the OWASP Agentic Top 10
Skyrelis gives you runtime visibility, identity governance, and policy enforcement across every agent in your environment.
Frequently Asked Questions
The OWASP Top 10 for Agentic Applications is a security framework published by the OWASP GenAI Security Project in December 2025. It identifies the ten most critical security risks that arise when AI systems operate as autonomous agents — taking actions, calling tools, managing memory, and delegating to other agents — rather than simply generating text responses. The ten risks are coded ASI01 through ASI10 and were developed by more than 100 security researchers and practitioners. You can map your current controls against all ten using the Skyrelis Agent Security Checklist.
They address different problem spaces. The LLM Top 10 focuses on risks that arise from what a language model generates — hallucination, toxic output, data leakage through prompts. The Agentic Top 10 focuses on risks that arise from what an AI system does — executing code, calling APIs, escalating privileges, communicating with other agents, and persisting memory across sessions. An agent can be fully compliant with every LLM security control and still be vulnerable to all ten agentic risks, because those risks live in the agent's behavior and its environment, not in its outputs alone. The runtime security layer is specifically designed to close this gap.
Least agency is the principle that an AI agent should be granted only the minimum level of autonomy, tool access, and scope required to safely perform its intended task — nothing more. It is the agentic equivalent of least privilege in traditional access management. The OWASP framework treats it as the foundational design principle that connects all ten risks: an overprivileged agent is more dangerous when goal-hijacked (ASI01), can do more damage through tool misuse (ASI02), has more lateral movement potential when its identity is abused (ASI03), and is harder to contain when it goes rogue (ASI10). Applying least agency at the design stage reduces the blast radius of every other risk on the list, and it maps directly onto the centralized identity and scoped permissions model covered in Chapter 2.
The OWASP framework (ASI01) identifies several layers of defense. At the input level: treat all external content — retrieved documents, tool outputs, inter-agent messages — as untrusted input and validate it before the agent acts on it. At the architecture level: constrain what the agent is allowed to do even if its reasoning is compromised, using tool-level authorization controls rather than relying on the model to make the right decision. At the observability level: log every action and flag deviations from expected behavior. The framework specifically calls out indirect prompt injection — where the malicious instruction arrives through a retrieved document rather than a user prompt — as an easy-to-overlook vector that bypasses perimeter-only validation. See the full technical implementation in Chapter 4: AI Agent Guardrails Before Production and the dedicated treatment in Chapter 5: Stop Prompt Injection.
Yes, and multi-agent architectures introduce risks that single-agent systems do not face. ASI07 (Insecure Inter-Agent Communication) and ASI08 (Cascading Failures) exist specifically because of composed agent systems. When one agent's output becomes another agent's input — and neither agent authenticates or validates the messages it receives — a single injected instruction can propagate through an entire pipeline before any human sees the result. The framework recommends treating agent-to-agent communication with the same level of suspicion applied to external user input: signed payloads, mutual authentication, and explicit validation at every handoff. This connects directly to the cross-agent observability capability described in Chapter 2, which is the organizational precondition for detecting cascading failures before they become incidents.