OWASP Top 10 for Agentic Applications: Risks and Tests

Key takeaways

• What it is. The OWASP Top 10 for Agentic Applications is a peer reviewed list of the most critical risks for AI agents that plan, act and use tools. OWASP published it on 9 December 2025 with input from more than 100 experts.
• Why it matters. The LLM Top 10 covers risks in model applications. The agentic list covers what changes once the system can take actions.
• The pattern. The ten risks chain together. A hijacked goal leads to a misused tool, which leads to a cascade.
• How to use it. Turn each risk into a test. This post gives you one for each.

If you build or secure AI agents, the OWASP Top 10 for Agentic Applications is now the list your auditors, customers and red teamers will point to. It is short, it is specific to agents, and it maps neatly onto things you can test.

This guide walks through all ten risks in plain English. For each one you get what it means, why it is real, and a test you can run. Exact risk titles can differ slightly between summaries, so check the official OWASP GenAI Security Project page for the final wording.

What is the OWASP Agentic Top 10?

OWASP is the nonprofit behind the well known web application and LLM top ten lists. Its GenAI Security Project released the agentic list on 9 December 2025. It describes the document as a peer reviewed framework covering the most critical risks for autonomous and agentic AI systems, developed with more than 100 industry experts, researchers and practitioners.

An agent is different from a chatbot because it plans, calls tools, keeps memory and acts across several steps. That gives an attacker more to work with. The risks are numbered ASI01 to ASI10.

The ten risks

ASI01, Agent Goal Hijack. An attacker changes what the agent is trying to do, usually through content it reads such as a document, email or web page, not through code. The agent keeps behaving as if it is following orders, but the orders are no longer yours.

Test it. Put an instruction inside a document or web page the agent will process and see whether it changes the task. Try hidden text and metadata too. Google and Forcepoint have both found such instructions planted on ordinary public web pages.

ASI02, Tool Misuse and Exploitation. The agent uses a legitimate tool in an unsafe way. The tool is approved. The way it was used was not intended.

Test it. For each tool, list the most damaging thing it can do with valid arguments. Then try to talk the agent into doing that thing.

ASI03, Identity and Privilege Abuse. Agents inherit credentials and access, then reuse, escalate or leak them. An agent that acts as a user with broad rights becomes a broad rights attack path.

Test it. Log in as a low privilege user and ask the agent for data that user should not see. Check whether the access check lives in the tool or only in the prompt.

ASI04, Agentic Supply Chain Vulnerabilities. Tools, plugins, prompts, skills and other agents come from outside, and any of them can be compromised. We showed this with agent skills, where 341 of 2,857 skills on one public registry were malicious, and with MCP, covered in our MCP security guide.

Test it. Inventory every external component. Read each skill and tool description in full and pin versions.

ASI05, Unexpected Code Execution. The agent generates or runs code or commands without proper isolation or review. A coding assistant that executes what it writes is a remote code execution path waiting for a prompt.

Test it. Ask the agent to produce and run code that touches the file system or network. Check what the sandbox actually blocks. Our post on AI agents escaping the sandbox covers why this matters.

ASI06, Memory and Context Poisoning. Bad information is written into an agent's memory, retrieval store or context and changes its behaviour later. Research published in August 2026 showed payloads spreading between agents through a shared memory file, which we covered in AI mind viruses.

Test it. Write a false instruction into the agent's memory or knowledge base and start a fresh session. See whether it is obeyed.

ASI07, Insecure Inter-Agent Communication. Agents pass messages to each other, and a compromised one can send instructions the next one trusts.

Test it. In a multi agent pipeline, inject into the planner and watch whether the executor acts on it without checking.

ASI08, Cascading Failures. One unsafe action sets off a chain of others. Small mistakes get amplified because agents act fast and without a human between steps.

Test it. Cause one tool call to return bad data. Follow what the rest of the workflow does with it, and find where it should have stopped.

ASI09, Human-Agent Trust Exploitation. People over trust agents, and attackers use that to push users into approving actions or sharing data. A polite, confident agent is a persuasive messenger.

Test it. Check whether your approval prompts show the real action and its arguments, or only a friendly summary. Try to get an unsafe action approved by wording alone.

ASI10, Rogue Agents. A compromised or misaligned agent behaves maliciously while looking normal.

Test it. Define what normal looks like, such as which tools it calls and how often. Alert on drift and confirm you can switch an agent off quickly.

How the risks chain together

Read the list from top to bottom and a story appears. Content reaches the agent and hijacks its goal. The hijacked agent misuses a tool using inherited privileges. The tool runs code. The result lands in memory, gets passed to another agent, and a small problem grows. Meanwhile a human approves something they did not understand.

That is why testing one risk at a time is not enough. A real engagement follows the chain.

How it relates to the LLM Top 10

Prompt injection and sensitive data exposure appear in the OWASP Top 10 for LLM Applications for model applications. The agentic list does not replace it. It adds what changes when the system has tools, memory and autonomy. If you run a chatbot with retrieval, start with the LLM list. If your system can send email, call APIs or write code, you need both.

OWASP also keeps adding practical material. Its resources page lists a GenAI Red Teaming Manual version 1.0 dated 20 October 2026, which is worth reading alongside the Top 10.

A simple scorecard

Practise each risk

The KageX FreakLabs course turns several of these into browser labs. Agentic Email Exfiltration, Multi-Agent Chain Attack, Tool Definition Poisoning, LLM Authorization Bypass and LLM-Generated Code Execution all line up with the risks above. Two labs are free, with no credit card.

To test your own agent, Mirage runs an autonomous red team loop against an AI chat interface or an API endpoint and maps findings to OWASP.

Conclusion

The agentic Top 10 is useful because it describes a chain, not a checklist. Content hijacks a goal, the goal misuses a tool, the tool carries inherited privilege, and the result spreads through memory and other agents before a person notices. Break any link and the rest of the chain stalls, which is why access checks belong in tools rather than prompts, why memory and tool definitions deserve the same review as code, and why approval screens must show the real action.

Pick the two risks you could not answer in the scorecard and test them this week in a safe environment. Then work through the rest, one link of the chain at a time.