Key Takeaways
- OWASP has published its first-ever Top 10 for Agentic Applications, identifying the most critical security risks for AI agents that plan, decide, and act autonomously.
- Agentic AI systems amplify traditional LLM vulnerabilities through multi-step reasoning, tool access, and inter-agent communication.
- Organisations deploying AI agents must implement least-agency principles, human-in-the-loop controls, and comprehensive observability to mitigate these risks.
- The framework maps directly to the existing OWASP LLM Top 10 and introduces new threat categories specific to autonomous AI systems.
Why Agentic AI Security Matters Now
AI agents are rapidly moving from experimental pilots to production systems across finance, healthcare, defence, and critical infrastructure. Unlike simple chatbots or task-specific automations, agentic AI systems can plan, decide, and act across multiple steps and systems, often on behalf of users and entire teams.
This autonomy brings extraordinary productivity gains, but also introduces security risks that traditional application security frameworks were never designed to handle. Recognising this gap, the OWASP GenAI Security Project launched its Agentic Security Initiative and published the first OWASP Top 10 for Agentic Applications in December 2025.
The OWASP Agentic Top 10 at a Glance
ASI01: Agent Goal Hijack
Attackers manipulate an agent’s objectives through prompt injection, deceptive tool outputs, or poisoned external data. Unlike simple prompt injection against a single model response, goal hijacking redirects the agent’s entire planning and multi-step behaviour. Real-world examples include the EchoLeak zero-click attack on Microsoft 365 Copilot and inception attacks on ChatGPT users.
ASI02: Tool Misuse and Exploitation
Agents can misuse legitimate tools due to prompt injection, misalignment, or unsafe delegation. Risks include data exfiltration through tool chaining, privilege escalation via over-privileged API access, and bill spikes from loop amplification. The entry highlights emerging risks from MCP (Model Context Protocol) tool descriptor poisoning and tool name impersonation.
ASI03: Identity and Privilege Abuse
Dynamic trust and delegation chains in multi-agent systems create opportunities for privilege escalation. Agents may inherit excessive permissions, cache credentials across sessions, or exploit cross-agent trust relationships. The classic confused deputy problem takes on new dimensions when AI agents can impersonate internal services.
ASI04: Agentic Supply Chain Vulnerabilities
Unlike traditional software supply chains, agentic ecosystems compose capabilities at runtime, loading external tools and agent personas dynamically. This creates a live supply chain vulnerable to poisoned prompt templates, tool descriptor injection, MCP server compromise, and typosquatting attacks. The first in-the-wild malicious MCP server was already discovered on npm in September 2025.
ASI05: Unexpected Code Execution (RCE)
Agentic systems, including popular vibe coding tools, often generate and execute code in real time, bypassing traditional security controls. Attack scenarios include shell injection through prompts, code hallucination with hidden backdoors, and multi-tool chain exploitation. The Replit “vibe coding” meltdown, where an agent deleted a production database, is a cautionary example.
ASI06: Memory and Context Poisoning
Adversaries corrupt stored context, embeddings, or RAG stores with malicious data, causing future reasoning to become biased or unsafe. This persistent corruption propagates across sessions and workflows, making it particularly dangerous. Attacks against Gemini’s long-term memory and ChatGPT’s persistent context have already been demonstrated.
ASI07: Insecure Inter-Agent Communication
Multi-agent systems depend on continuous communication that significantly expands the attack surface. Without proper authentication, integrity verification, and semantic validation, attackers can intercept, spoof, or manipulate agent messages. Threats span transport, routing, discovery, and even covert side-channels where agents leak data through timing or behavioural cues.
ASI08: Cascading Failures
A single fault in one agent can propagate across autonomous agents, compounding into system-wide harm. Because agents plan, persist, and delegate autonomously, errors bypass human checks and persist in saved state. The document provides sobering scenarios including financial trading cascades, healthcare protocol propagation, and auto-remediation feedback loops.
ASI09: Human-Agent Trust Exploitation
AI agents can establish strong trust through natural language fluency and perceived expertise. Adversaries exploit this trust to influence decisions, extract sensitive information, or steer outcomes. The agent acts as an untraceable “bad influence”, manipulating humans into performing audited actions that make the agent’s role invisible to forensics.
ASI10: Rogue Agents
Rogue agents deviate from their intended function, acting harmfully or deceptively within multi-agent ecosystems. Their individual actions may appear legitimate, but emergent behaviour becomes harmful, creating a containment gap for traditional rule-based security systems. Scenarios include autonomous data exfiltration, self-replication via provisioning APIs, and reward hacking that leads to critical data loss.
Key Principles for Securing Agentic AI
Three overarching principles emerge from the OWASP Agentic Top 10:
1. Least Agency
Go beyond least privilege. Avoid deploying agentic behaviour where it is not needed. Unnecessary autonomy expands the attack surface without adding value. Every tool, permission, and delegation chain should be justified by a clear business requirement.
2. Human-in-the-Loop Controls
Require human approval for high-impact, irreversible, or privilege-escalating actions. Implement adaptive trust calibration that adjusts agent autonomy based on contextual risk scoring. Never allow agents to approve their own escalation requests.
3. Comprehensive Observability
Without clear visibility into what agents are doing, why they are doing it, and which tools they are invoking, minor issues can quietly expand into system-wide failures. Maintain immutable, signed audit logs of all agent actions, tool calls, and inter-agent communications.
How This Connects to EU AI Act Compliance
The OWASP Agentic Top 10 has direct implications for organisations subject to the EU AI Act. High-risk AI systems must demonstrate robust risk management, human oversight, and transparency requirements that align closely with the mitigation guidelines in this framework. Organisations deploying agentic AI in regulated sectors should map these risks to their existing compliance frameworks, including the EU AI Act, DORA, and NIS2.
What Should You Do Next?
- Assess your agentic AI deployments against the OWASP Agentic Top 10
- Implement least-agency principles across all AI agent architectures
- Establish human-in-the-loop controls for high-impact agent actions
- Deploy comprehensive monitoring for agent behaviour, tool usage, and inter-agent communication
- Map agentic risks to your compliance framework (EU AI Act, ISO 42001, NIST AI RMF)
Ready to take control of your AI risk?
LittleData.ai provides real-time risk scoring, compliance tracking across 6 frameworks, and 56 training materials for your team. Explore the platform →