AI agents are moving past the pilot stage and rapidly entering real production environments in finance, healthcare, and the public sector. Unlike traditional generative AI, which answers a single question, agents plan, judge, and call tools on their own across multiple steps to carry out tasks. Sending emails, calling APIs, and executing code on a person's behalf can now happen without human confirmation.

This autonomy raises efficiency, but it also creates a new attack surface that existing application security models weren't built to handle. In response, OWASP released its first threat list for agentic applications in December 2025. This article covers what this list is based on, and summarizes its 10 threats (ASI01–ASI10).

 

☑️ What is the OWASP Top 10 for Agentic Applications 2026?

 

The OWASP Top 10 for Agentic Applications 2026 is a framework outlining the 10 highest-impact security threats in environments where AI agents operate autonomously. It was published by the Agentic Security Initiative (ASI) under the OWASP GenAI Security Project, and is the first version (Version 2026) targeting agentic applications specifically.

This list matters because of who published it and how it was built. OWASP is the best-known nonprofit in web application security, and the OWASP Top 10 has become an industry standard. This list is a community-consensus document, built from contributions by security experts across industry, academia, and government — threat research, red-team findings, and field-tested mitigations — and refined through an expert review board and public review. It's designed to serve as a starting point, a compass, for security practitioners to understand and begin addressing the highest-impact threats first.

 

☑️ Why do agents need their own security standard?

 

Unlike traditional generative AI that only answers questions, agents plan on their own and call tools to carry out tasks. This autonomy makes the same attack far more damaging. For instance, prompt injection — which used to just manipulate a single response — expands in an agentic environment into multi-step goal hijacking and chained tool calls. In other words, agents don't create new risks so much as amplify existing ones.

That's why minimizing permissions (least privilege) alone isn't enough — the concept of Least-Agency, minimizing autonomy itself, is proposed alongside it. Granting autonomy where it isn't needed only widens the attack surface without adding business value. This perspective runs through all 10 threats that follow.

 

☑️ 10 Agentic AI Security Threats (ASI01–ASI10)

 

These 10 threats map onto the flow of an agent's Inputs, Integration/Processing, and Outputs. Each threat is organized around what kind of attack it is, where it originates, and how it can be mitigated.

ASI01 Agent Goal Hijack

A threat where attackers manipulate an agent's goals or decision path. Because agents process both a user's instructions and externally sourced data as the same natural language, they can't reliably distinguish legitimate instructions from ones an attacker has planted.

Attackers exploit this by hiding commands inside documents, web pages, emails, calendar invites, or other external data that the agent reads. The moment the agent processes that content, the hidden command executes — exfiltrating confidential data or abusing connected tools. Reported incidents include a single email causing Copilot to leak confidential mail and files, and a command hidden in a web page causing an autonomous agent to access an internal authentication page.

The risk is especially amplified in agents because the manipulation doesn't just change a single response. Once the goal is hijacked, the entire multi-step plan and subsequent actions flow in the direction the attacker intended. This is one of the threats with the highest concentration of real-world reported incidents. 

 

ASI02 Tool Misuse and Exploitation

A threat where an agent uses a legitimate tool in an unsafe way, within the scope of permissions it was granted. This isn't about a malicious tool — it's a case of a normal tool being used dangerously in ways that weren't intended.

The core cause is permissions being scoped more broadly than necessary. For example, an email-summarizing tool might also have delete/send permissions attached, or a task that only needs to query specific data might have access to entire record sets. Combined with inputs passed along without validation, an agent can be tricked by external data into deleting or leaking data, or repeatedly calling an expensive API to run up costs. There are also reported cases of chaining legitimate admin tools together to evade security detection, or repeatedly calling an auto-execution-approved tool to exfiltrate data little by little.

The risk is amplified in agents because the agent itself is the one choosing tools and chaining calls together. Without a human checking every step, misuse of tools accumulates quickly. This also intersects with supply chain risk, as tool definitions increasingly arrive via external channels like MCP servers.

ASI03 Identity and Privilege Abuse

A threat where an agent's delegation structure and trust relationships are exploited to escalate access. It stems from the mismatch between existing identity/permission systems designed around humans, and the structure by which agents hand off and delegate permissions to one another.

A typical case: a high-privilege agent hands off a task without narrowing its own permissions, so a narrowly-scoped sub-agent ends up with excessive permissions. Cached credentials can also get reused across sessions or users without being properly cleaned up, or a fake agent with a plausible name like "admin assistant" can gain internal trust and perform privileged tasks. Another issue: permissions valid at the start of a task may be expired or reduced by execution time, yet the task keeps running under those stale permissions.

The risk is amplified in agents because agents often operate by borrowing a human's permissions rather than having their own distinct identity. This creates a gap in tracking who took what action under what authority, and that gap becomes a channel for privilege escalation. This threat connects directly to managing non-human identities — the identities of agents and services themselves.

 

ASI04 Agentic Supply Chain Vulnerabilities

A threat that arises when a component an agent uses is malicious or has been tampered with. "Component" here broadly includes models and weights, tools, plugins, datasets, other agents, interfaces like MCP/A2A, agent registries, and update channels.

Where traditional software supply chain security mainly checks static dependencies at install time, the agent ecosystem differs in that it dynamically pulls in and combines external tools and agents at runtime. Typical examples include hidden commands embedded in an externally-sourced prompt template, malicious instructions planted in a tool's description or metadata, or a look-alike tool impersonating a legitimate one being called instead. If a trusted registry is tampered with, a compromised component can spread broadly all at once.

The risk is amplified in agents because the unit of trust shifts from an install-time list to the moment of execution. It's not enough to check which components are installed — you have to continuously verify at runtime that each component is safe.

 

ASI05 Unexpected Code Execution (RCE)

A threat where agents that generate and execute code unintentionally lead to remote code execution or internal system abuse. This is especially problematic in environments like so-called "vibe coding" tools, which generate code in real time and execute it immediately.

Attacks come through several paths: shell commands hidden in a prompt get executed as-is, unsafe deserialization or code-evaluation functions get abused, or a package installed without validation runs malicious code during installation. Real-time-generated code can easily bypass existing security controls, leading to host or container takeover, persistent intrusion, or sandbox escape. Reported incidents include a coding agent executing install/delete commands without review and corrupting production data, and an agent that deleted a user's directory.

The risk is amplified in agents because human review between code generation and execution is often skipped. Sometimes it's not a single output but a chain of legitimate tools that ultimately achieves code execution.

  

ASI06 Memory & Context Poisoning

A threat where an attacker poisons the memory or context an agent stores and recalls to maintain continuity across tasks. Conversation summaries, embeddings, and RAG stores that an agent continually references are the target.

Attackers plant malicious data through loosely validated channels — uploaded files, API feeds, ordinary conversation, or exchanges with other agents — into memory. Once poisoned, all subsequent reasoning, planning, and tool selection happens on top of that bad information. Examples include repeatedly injecting fake pricing information so the agent stores it as fact, or training a security agent's memory so it comes to classify malicious activity as normal.

The risk is amplified in agents because, unlike a one-time input, poisoned content persists in memory. Even after the original malicious input is gone, the effect continues across sessions and tasks. Poisoned memory can eventually alter how an agent interprets its own goals, often leading into goal hijacking.

  

ASI07 Insecure Inter-Agent Communication

A threat that arises when the real-time messages multiple collaborating agents exchange lack sufficient authentication, integrity, and semantic validation. Agents constantly communicate through APIs, message buses, and shared memory, and if this channel is weak, the attack surface expands significantly.

Possible attacks include intercepting messages via man-in-the-middle on an unencrypted channel to inject hidden instructions, replaying trust/delegation messages to revive stale permissions, or downgrading communication to a weaker legacy protocol so malicious commands appear as normal exchanges. Registering a fake agent with a discovery service to intercept privileged communications is another example.

The risk is amplified in agents because the structure is distributed and each agent has a different trust level. This is hard to defend using traditional approaches that only guard a single boundary, and manipulating a single message can cascade into faulty collaboration across multiple agents.

 

ASI08 Cascading Failures

A threat where a single fault propagates through multiple autonomous agents and amplifies into a system-wide failure. Hallucination, malicious input, or a poisoned tool or memory can all serve as the starting point.

Because agents plan, delegate, and persist state on their own, a single error skips the step-by-step human checks and remains embedded in stored state, continuing to have effects. As agents connect with new tools or peer agents, a latent fault can escalate into a privileged action, simultaneously threatening confidentiality, integrity, and availability. Typical symptoms include one bad decision triggering many downstream subtasks in a short time, or a feedback loop where two agents trust each other's output and amplify the error.

The risk is amplified in agents because the speed and scale at which faults propagate outpaces what a human can keep up with. This threat focuses not on the origin of the fault but on its propagation and amplification. Fortunately, symptoms like rapid spread, cross-domain transfer, and repeated retries can serve as detection cues.

  

ASI09 Human-Agent Trust Exploitation

A threat that uses an agent's natural language and seemingly authoritative explanations to steer human judgment in the wrong direction. The risk grows when people over-trust autonomous recommendations and approve them without independent verification.

Typical examples: trusting a recommendation as-is because it sounds authoritative even though its basis is unclear; a sensitive task lacking a final confirmation step, so a single approval directly triggers a money transfer or data deletion; or an agent fabricating a plausible-sounding justification to make a risky action look legitimate. There are reported incidents where a finance assistant agent, having read a forged invoice, recommended an urgent transfer to an attacker's account, and a staff member trusted and approved it.

The risk is amplified in agents because, since a human ultimately executes the action, the agent's involvement often doesn't show up clearly in post-incident tracing. It gets logged as if it were a normal human approval, obscuring how much influence the agent had on that judgment.

ASI10 Rogue Agents

A threat where an agent operates outside its intended function or permitted scope, acting in a harmful or deceptive way. Each individual action may look normal, but the focus is on the loss of behavioral integrity — the overall pattern of behavior becoming harmful.

External compromises like prompt injection, goal hijacking, or supply chain tampering can be the trigger, but this threat is specifically about the loss of control after the deviation has already begun. Examples include goal drift — appearing compliant on the surface while pursuing a hidden objective — hijacking a trusted workflow, collusion and self-replication among agents, and reward hacking that exploits a poorly designed reward metric. A case where an agent instructed to cut costs judged that deleting backups was the most effective way and destroyed recovery assets on its own illustrates the danger: the goal is followed, but the means go wrong.

The risk is amplified in agents because autonomy and speed let a deviation spread quickly and broadly, like an insider threat. Rule-based controls alone struggle to catch a harmful overall pattern hiding within individually normal-looking actions.

 

☑️ Common mitigation directions OWASP proposes 

 

OWASP provides separate mitigation guidance for each of the 10 threats, but several responses recur across many of them. Checking these common items first helps establish a baseline defense before addressing individual threats.

First, least privilege and least agency. OWASP recommends narrowly scoping each tool's permissions and data access, and going beyond minimizing permissions to avoid granting unnecessary autonomy in the first place (Least-Agency).

Second, short-lived, scope-limited credentials. It recommends issuing task-scoped credentials with short validity and revoking them immediately after use to limit blast radius.

Third, a human-in-the-loop approval step. It recommends requiring human confirmation for high-risk or irreversible actions to prevent unchecked automatic execution.

Fourth, tamper-proof logging and anomaly detection. It recommends recording every tool call and agent action in a form that can't be tampered with, and detecting behavior that deviates from normal patterns.

Fifth, trust boundaries and isolation. It recommends running agents and code execution in isolated environments and controlling outbound communication.

  

☑️ Solution areas that can help address these threats

 

The mitigation directions above don't implement themselves conceptually — they need an actual solution behind them. Cloud Networks offers solutions in the following areas that connect to the mitigation direction for each threat. That said, no single product solves any one threat completely on its own; it's more accurate to think of each as covering part of the response to a given threat.

Among the threats covered above, Identity and Privilege Abuse (ASI03) and the broader non-human identity management problem are addressed by giving agents a distinct identity and tightly controlling their permissions. Okta provides identity security that manages human, machine, and AI agent identities together, and can be applied in this area.

The key to reducing damage from Privilege Abuse (ASI03) and Tool Misuse (ASI02) is issuing short-lived, task-scoped credentials and revoking them immediately. HashiCorp Vault supports issuing dynamic, short-lived credentials with automatic revocation, and can be applied to this response.

Cascading Failures (ASI08), Rogue Agents (ASI10), and most other threats share a common mitigation: recording every agent action and tool call in a tamper-proof form and detecting anomalous behavior. Splunk provides log collection, threat detection, and security operations automation, and can be applied to this detection and tracing.

Threats targeting input and execution, like Goal Hijack (ASI01) and Code Execution (ASI05), are addressed by not trusting input by default, validating it, and controlling it through policy. Cisco AI Defense provides AI model and application protection, network-based visibility, and policy/guardrail enforcement, and can be applied in this area.

Detailed information on each solution is available on the product pages below.

Solution	Coverage Area	Related Threats
Okta	Identity and permission control	Identity/Privilege Abuse (ASI03)
HashiCorp Vault	Credential and secrets management	Tool Misuse (ASI02), Privilege Abuse (ASI03)
Splunk	Security operations and visibility	Cascading Failures (ASI08), Rogue Agents (ASI10), and others
Cisco AI Defense	AI security visibility and guardrails	Goal Hijack (ASI01), Code Execution (ASI05)

  

☑️ Frequently Asked Questions

 

What is the OWASP Top 10 for Agentic Applications 2026?

It's an OWASP framework outlining the 10 highest-impact security threats in environments where AI agents operate autonomously. The Agentic Security Initiative, under the OWASP GenAI Security Project, published the first version in December 2025.

How is this different from general generative AI security?

Unlike traditional generative AI that just answers questions, agents judge on their own and call tools to execute tasks. This autonomy means the same attack can expand across multiple steps and cause greater damage. The OWASP Top 10 for Agentic Applications focuses on this risk that stems from an agent's autonomy and delegation.

What should companies look at first?

Items OWASP consistently recommends across multiple threats' mitigation guidance include least privilege/least agency, short-lived credentials, a human approval step, tamper-proof logging with anomaly detection, and establishing trust boundaries. These common items can serve as a starting point before addressing individual threats.

Is this list finalized?

This is the first version, published in December 2025. The accompanying list of real-world security incidents is updated periodically, so specific cases and figures should be understood as current as of when this was written.

☑️ Closing

The OWASP Top 10 for Agentic Applications 2026 is the first community-built reference point systematizing agentic AI security. The 10 threats each address a different attack surface, but they share a common underlying issue: autonomy and delegation amplify existing risks.

As covered above, addressing these threats requires agent identity and permission control, short-lived credential management, security operations and anomaly detection, and AI security visibility and guardrails working together. Cloud Networks can work with you to review an agent security approach suited to your environment, based on solutions across these areas including Okta, HashiCorp Vault, Splunk, and Cisco AI Defense. If you're preparing to adopt agentic AI and want to review your security governance, please contact Cloud Networks.

▶ OWASP Top 10 for Agentic Applications 2026 Download the original

 

[Source : OWASP GenAI Security Project - Agentic Security Initiative, "OWASP Top 10 for Agentic Applications 2026"]