OWASP Top 10 for Agentic Applications (2026)

About the framework

The OWASP Top 10 for Agentic Applications 2026 identifies the most critical security risks facing autonomous and agentic AI systems. Developed through extensive collaboration with more than 100 industry experts, researchers, and practitioners, the list provides practical, actionable guidance to help organizations secure AI agents that plan, act, and make decisions across complex workflows.

By distilling a broad ecosystem of OWASP GenAI Security guidance into an accessible, operational format, the Top 10 equips builders, defenders, and decision-makers with a clear starting point for reducing agentic AI risks and supporting safe, trustworthy deployments. The framework was evaluated by the GenAI Security Project’s Agentic Security Initiative Expert Review Board, including input aligned with bodies such as NIST and the European Commission.

Read the release announcement for industry context and related resources (State of Agentic Security, solutions landscape, FinBot CTF, and more).

Two design principles

Before the individual risks, OWASP foregrounds two principles that underpin secure agentic design:

• Least agency — The agentic evolution of least privilege. Limit not only what an agent can access, but how much freedom it has to act without checking back. Autonomy should be earned, not granted by default.
• Strong observability — You must see what the agent is doing, why, and with whose identity. Least agency without observability is blind risk reduction; observability without least agency is surveillance of an unconstrained agent.

The ten risks (ASI01–ASI10)

Ordered as published in the 2026 edition. Each risk includes an ASI identifier for mapping to threat models, red teaming, and compliance crosswalks.

1. ASI01Agent goal hijack
2. ASI02Tool misuse & exploitation
3. ASI03Agent identity & privilege abuse
4. ASI04Agentic supply chain vulnerabilities
5. ASI05Unexpected code execution
6. ASI06Memory & context poisoning
7. ASI07Insecure inter-agent communication
8. ASI08Cascading failures
9. ASI09Human–agent trust exploitation
10. ASI10Rogue agents

ASI01:2026 Agent goal hijack

An attacker tricks the agent into changing its main goal or following new, hidden instructions—often via malicious content in documents, emails, web pages, or other untrusted input that reaches the planning loop. Unlike a rude chatbot reply, a hijacked agent can redirect an entire multi-step workflow while appearing to operate normally.

Mitigation themes: Treat external input as data, not instructions; validate plans against an allowlist of permitted actions; guardrails that reject scope drift; sandboxing so a hijacked goal cannot reach production systems. See also prompt injection and the Live Sandbox.

ASI02:2026 Tool misuse & exploitation

The agent applies legitimate tools in unsafe or unintended ways—ambiguous prompts, manipulated arguments, or tool chains nobody anticipated (for example: query sensitive records → write to file → email externally). Each tool may be authorized; the composition is not.

Mitigation themes: Tight tool scoping, schema validation on arguments, policy on every invocation, monitoring for anomalous tool chains, read-only access where writes are unnecessary.

ASI03:2026 Agent identity & privilege abuse

Agents inherit or escalate high-privilege credentials—shared service accounts, static API keys, or full user sessions—so a confused or compromised agent can act at machine speed across systems. Accountability collapses when you cannot answer “who executed this action?”

Mitigation themes: Dedicated agent identities with time-bound, least-privilege scopes; fine-grained authorization at the tool level; audit trails linking agent, user, and action. Core to the Lineation accountability manifesto.

ASI04:2026 Agentic supply chain vulnerabilities

Compromised or tampered third-party agents, MCP servers, plugins, prompt templates, and tool descriptors introduce runtime trust failures—supply chain attacks that target what the agent loads and delegates to, not only your build pipeline.

Mitigation themes: Pin and verify tool versions; authenticate MCP and plugin sources; integrity checks on templates; isolated sandboxes for third-party tools; audit transitive dependencies.

ASI05:2026 Unexpected code execution

The agent generates or runs code and commands unsafely—shell scripts, SQL, Python snippets—creating paths to remote code execution, sandbox escape, or data exfiltration under production credentials.

Mitigation themes: Never run generated code with production credentials; sandboxed runtimes with minimal permissions; allowlists before execution; output scanning for injection patterns.

ASI06:2026 Memory & context poisoning

Attackers corrupt long-term memory, RAG stores, or shared context so biased or malicious data influences future sessions—gradually or in a single planted interaction. In multi-agent systems, one poisoned memory can cascade to every consumer of that context.

Mitigation themes: Sanitize data before persistence; integrity checks on vector stores; scoped memory per agent; monitor anomalous writes; rollback corrupted state. Try memory-poisoning scenarios in the Live Sandbox.

ASI07:2026 Insecure inter-agent communication

Multi-agent workflows lack authentication, integrity, or freshness on messages—enabling spoofing, replay, tampering, or unauthorized delegation between agents.

Mitigation themes: Authenticate every inter-agent message; sign with agent-specific keys; nonces and timestamps; authorization on delegation chains; no privilege escalation across agents.

ASI08:2026 Cascading failures

Small errors amplify through planning and execution—hallucinated endpoints become failed calls, error handlers trigger worse calls, and multi-agent pipelines compound “confidently wrong” outputs.

Mitigation themes: Circuit breakers; validation between plan and execute; rollback mechanisms; limits on chain depth and runtime; monitoring for self-reinforcing error patterns.

ASI09:2026 Human–agent trust exploitation

Users over-trust fluent, confident agents—enabling social engineering via manipulated summaries, phishing recommendations, or altered financial details presented with the same authority as legitimate output.

Mitigation themes: UI that distinguishes agent content from verified data; human approval for high-stakes actions; provenance on recommendations; anomaly detection on outputs.

ASI10:2026 Rogue agents

Compromised or misaligned agents continue to appear legitimate—valid credentials, normal patterns, plausible outputs—while pursuing hidden goals, exfiltrating data, or corrupting peer agents in multi-agent workflows.

Mitigation themes: Behavioral baselines per agent identity; anomaly detection over time; kill switches; session isolation; drift monitoring. Detection requires lineage, not log fragments alone.

What most risks have in common

Across ASI01–ASI10, a pattern repeats: many failures are identity and authorization problems in disguise. Goal hijacking succeeds when agents cannot distinguish trusted orchestration from untrusted data. Tool misuse succeeds when authorization is checked only at the agent, not the tool. Rogue agents succeed when there is no behavioral baseline tied to a verified identity.

Three questions OWASP-aligned teams ask at every trust boundary:

1. Who is acting? A distinct agent identity—not a borrowed human session.
2. What are they authorized to do? Scoped, time-bound, revocable permissions.
3. Can we prove it later? Audit trails linking identity, policy decision, and outcome.