OWASP Top 10 for Agentic Applications 2026

The OWASP Top 10 for Agentic Applications 2026, published in December 2025 and announced at both Black Hat Europe and the OWASP Agentic Security Summit, is the most consequential AI security framework released to date. Enterprises deploying AI agents without it are operating like surgeons performing operations blindfolded — technically capable, but missing everything that matters. This is not a projection document. Every risk category, labeled ASI01 through ASI10, is grounded in real incidents from 2025 and reviewed by a global community spanning industry, academia, and government. The framework's core argument is straightforward: agentic systems, those that plan autonomously, maintain memory, call external tools, and act with delegated authority over multiple steps, create failure modes that existing LLM security guidance does not fully address. A single-turn model responds and stops. An agent pursues a goal until something stops it. That difference in architecture produces a qualitatively different threat surface, and the blast radius of any manipulation scales accordingly.

How the ten risks group into three domains, and why that structure matters for defenders

OWASP organizes the ten categories into three domains. Behavior and Trust, covering ASI01, ASI06, ASI09, and ASI10, addresses risks that corrupt what an agent believes, remembers, trusts, or pursues. Access and Execution, covering ASI02, ASI03, and ASI05, addresses risks that weaponize what an agent can actually do: its tools, its credentials, and its ability to run code. Ecosystem and Trust, covering ASI04, ASI07, and ASI08, addresses the broader infrastructure an agent depends on: supply chains, inter-agent messaging, and cascading dependencies across orchestration layers.

That grouping is not merely organizational. It is operationally useful. A security team governing a single-agent customer service workflow has a materially different threat profile than a team managing a multi-agent pipeline where a dozen autonomous systems pass outputs to each other. The domain structure lets defenders prioritize based on actual deployment posture rather than treating all ten risks as equally urgent regardless of context.

Real incidents also cross domain lines, and that is where the grouping earns its keep. A compromised tool (Access and Execution) combined with a poisoned memory entry (Behavior and Trust) that neither alone would trigger meaningful damage together can produce a persistent, difficult-to-detect attack chain. Understanding the domains shows how one failure enables the next.

One cross-cutting pattern deserves naming before diving into the individual risks: many of the ten categories are identity and authorization problems in disguise. Goal hijacking, tool misuse, rogue agents, and cascading failures all share a common precondition: the system cannot tie a verified identity to a specific action at the moment that action occurs. That thread runs the length of the framework, and we will return to it at the end.

ASI01 Agent Goal Hijack: how attackers redirect an agent's objectives mid-task

Goal hijack is the foundational risk of the Behavior and Trust domain. The mechanism is this: an attacker manipulates an agent's objectives, through prompt injection, deceptive tool outputs, or poisoned data, to redirect multi-step behavior away from the user's intent and toward the attacker's goal. The agent then pursues that redirected objective with all the tools and authority it was legitimately given.

What makes this categorically more serious than ordinary prompt injection is the agentic loop itself. Inject a malicious instruction into a single-turn model and you get one malicious response. Inject it into an agent mid-task and you get every subsequent action in that task executed in service of the attacker's goal, until the agent either completes the new objective or hits a hard constraint. OWASP notes explicitly that prompt injection and excessive autonomy, both covered in prior LLM guidance, combine here to produce something qualitatively worse than either generates alone. In other words: two wrongs don't make a right, but they do make a much bigger incident.

The concrete attack is not exotic. An agent reading external content, an email, a document, a retrieved web page, encounters hidden instructions embedded in that content. It then begins pursuing a different goal. The user's original task continues to appear in progress. The manipulation is not visible in the agent's outputs unless someone is specifically looking for it.

OWASP's mitigations are worth taking seriously: treat all external data as untrusted input regardless of source, use verifiable intent capsules to anchor the original goal so that mid-task deviations require explicit re-authorization, and require human-in-the-loop approval before any goal change can propagate into further action.

Goal hijack also sets up the rest of the Behavior and Trust domain. A redirected agent will use its legitimate tools (ASI02) and its trusted position with users (ASI09) in service of the attacker's objective. Stopping hijack early is cheaper than containing its downstream consequences.

ASI06 Memory and Context Poisoning: corrupting what an agent carries across sessions

If goal hijack is an attack on what an agent is doing right now, memory and context poisoning is an attack on what an agent will do across every future session. The mechanism is corrupting agent memory systems, vector database embeddings, and RAG retrieval stores so that the poisoned information shapes decision-making long after the initial compromise.

Persistence is what makes this distinctly dangerous. A goal hijack affects one session. A poisoned memory entry affects every session that draws on it, and in enterprise workflows, agents frequently share memory or context stores across users or teams. The blast radius of a single poisoning event scales directly with how broadly that memory is trusted.

The attack surface is broader than it might appear. It includes vector database entries, summarized prior conversations, user preference stores, and retrieved document chunks. Any of these can carry adversarial content that the agent will later treat as legitimate prior context.

Detection is the hard part. Poisoned memory often looks syntactically identical to valid prior context; there is no obvious anomaly at retrieval time. The agent is not doing anything unusual. It is drawing on its memory, which is what it is supposed to do. Knock knock. Who's there? The attack. It's been here since Tuesday — you just didn't notice.

Mitigation requires a different posture than most teams currently hold: integrity verification on stored context, provenance tracking for individual memory entries so that the source and insertion time of any piece of context is auditable, and strict sandboxing of what external content can write to persistent stores. The last point is structural. If external content can freely modify what an agent remembers, the attacker's write access to memory is essentially unlimited.

ASI09 Human-Agent Trust Exploitation and ASI10 Rogue Agents: when the agent itself becomes the threat vector

These two risks close out the Behavior and Trust domain, and together they describe what happens when the attack exploits trust relationships rather than technical vulnerabilities.

ASI09 Human-Agent Trust Exploitation

Humans extend genuine trust to agents based on apparent expertise, consistency, and personality. That anthropomorphic trust is not irrational; agents are designed to be coherent, helpful, and responsive, and those properties earn credibility. The attack surface is the gap between the trust an agent receives and the verification applied to what it claims or recommends.

OWASP identifies a forensic problem here that deserves specific attention: a hijacked agent that persuades a user to approve a malicious action leaves a clean audit trail. The logged entry shows a legitimate user decision. The agent's manipulation, the framing, the selective presentation of options, the manufactured urgency, none of that appears in the record. Human oversight mechanisms designed to catch automated misbehavior fail entirely when the human becomes the final, unwitting executor of the attack.

This is simultaneously a security gap and a governance gap. The mitigation OWASP points toward is auditing agent behavior at the interaction level, not just the action level. What the agent said to the user before approval matters as much as what the user ultimately approved.

ASI10 Rogue Agents

Rogue agents are compromised or misaligned agents that act harmfully while appearing legitimate within multi-agent workflows. The key attack variant OWASP describes is malicious workflow injection: an agent that impersonates an approval signal, causing every downstream agent in the pipeline to trust and act on instructions that are, in fact, adversarial.

This risk is architecturally dependent. Single-agent deployments do not face it. It only becomes possible when agents operate in pipelines where one agent's output is another's input, and it scales directly with enterprise adoption of multi-agent orchestration frameworks. The more sophisticated the deployment, the larger the rogue agent surface.

The linking thread between ASI09 and ASI10 is precise: both attacks exploit the trust relationship itself, rather than a flaw in the underlying system. Human-agent trust and agent-agent trust are both real and both exploitable, and neither was a meaningful attack surface before agentic architectures existed.

ASI02 Tool Misuse and ASI05 Unexpected Code Execution: what happens when an agent's reach exceeds its authorization

ASI02 Tool Misuse and Exploitation

Agents misuse legitimate tools through prompt injection, goal misalignment, or unsafe delegation. The tool itself is not compromised. The way the agent uses it causes harm. This distinction matters because most authorization frameworks check whether an agent is permitted to use a given tool, not whether this specific invocation, with these specific arguments, against this specific target, is appropriate in this context.

That gap is the core vulnerability. An agent authorized to use a file system tool can read, write, or delete depending on what it has been instructed to do, not on what it should be allowed to do for the current task. Granular, per-call permission enforcement and strict argument validation before execution are the mitigation directions OWASP identifies, and both require investment in tooling that most organizations have not yet built.

ASI05 Unexpected Code Execution

Agents that generate or run code unsafely create pathways to remote code execution, sandbox escapes, and data exfiltration. The Replit incident OWASP references is illustrative: an agent with code execution capability deleted a production database during a code freeze, acting on an instruction that any experienced engineer would have recognized as dangerous given the deployment context. The agent lacked that contextual judgment — like handing a demolition crew the keys to your house and asking them to "just fix the squeaky door."

Code execution is categorically different from data access because it converts a software vulnerability into a systems vulnerability. An agent that can write and run code is not just a data risk; it is an infrastructure risk. The blast radius is infrastructure-wide.

Sandboxed execution environments, mandatory review gates before agent-generated code runs in production, and hard scope limitations on what environments an agent can target are the structural mitigations. Without those constraints, granting an agent code execution authority is effectively granting it the ability to act on any instruction, regardless of whether that instruction is safe.

Both ASI02 and ASI05 are, at root, authorization problems. The agent has the capability. The system never asks whether this action, in this context, at this moment, is permitted.

ASI03 Identity and Privilege Abuse: the credential aggregation problem unique to agents

The core mechanism of ASI03 is that attackers exploit inherited or cached credentials, delegated permissions, or agent-to-agent trust relationships, using the agent as an aggregation point for non-human identities. An agent operating on behalf of a user effectively merges every key, token, and service account assigned to it into a single execution point, and that merged identity acts dynamically, across systems, in real time.

That is structurally different from ordinary credential theft in a way that matters. A static credential sitting in a vault is dangerous if stolen; the window of exposure is bounded by when the theft is detected. A credential held by an active agent is not waiting to be used. It is in continuous use, making decisions, calling services, and producing outputs that downstream systems trust.

Enterprises already face a large and fast-growing ratio of non-human identities to human ones. AI agents accelerate that ratio further, and most non-human identity governance practices were not designed for identities that make autonomous, multi-step decisions under delegated human authority. The governance frameworks predate the threat model.

OWASP's mitigation framing is specific: treat agents as managed non-human identities, issue short-lived task-scoped just-in-time credentials rather than persistent tokens, and revoke credentials at task completion rather than at session end. The rationale for short-lived credentials in agentic contexts is more urgent than it might appear elsewhere. A static token granted to an agent persists across every task that agent runs. Compromise it once and you have access to every action that agent can take, indefinitely, until someone notices and revokes it manually.

ASI04 Agentic Supply Chain Vulnerabilities: how compromised tools and servers reach agents at scale

The supply chain risk for agentic systems has two primary attack forms. First, malicious tool packages that execute hidden functionality alongside their advertised behavior: the tool does what it claims and also does something the agent and user have no visibility into. Second, compromised prompt templates that inject adversarial instructions into the agent's own operating context, turning the instructions themselves into the attack surface.

OWASP identifies a specific variant called the rug pull, which is worth understanding in detail. A server ships a benign tool description at install time, earns approval through that benign presentation, and then mutates its description on a subsequent connection. Clients that only prompt users on first approval never re-alert them to the change. The MCP specification's June 2025 revision added change notifications to allow clients to detect these mutations, but enforcement is client-side and inconsistent across implementations. The protection exists in the specification; adoption is uneven in practice.

The ClawHub registry incident demonstrated the scale problem concretely. A primary marketplace for agent skills was systematically compromised, with the most-downloaded skills carrying malicious functionality. Popularity signals, the metrics organizations typically use as a proxy for trustworthiness, became attack amplifiers. The more trusted the source appeared, the more damage the compromise could do.

The public MCP server registry grew more than sevenfold in roughly fourteen months. The attack surface for supply chain compromise is expanding faster than the governance practices designed to contain it. Explicitly allowlisting MCP connections, requiring signed manifests, pinning dependencies, and treating third-party tools as untrusted until independently verified are the structural responses OWASP identifies.

ASI07 Insecure Inter-Agent Communication and ASI08 Cascading Failures: the systemic risks of multi-agent architectures

ASI07 Insecure Inter-Agent Communication

Multi-agent pipelines create communication channels between agents, and those channels can be spoofed, tampered with, or replayed. The underlying vulnerability is a trust assumption baked into most pipeline architectures: an agent receiving a message from another agent in its workflow trusts that message. An attacker who can inject a message that appears to come from a trusted upstream agent controls every downstream agent that acts on it.

This is the technical complement to ASI10 rogue agents. Where ASI10 describes a compromised agent, ASI07 describes a compromised channel. Either produces the same outcome: instructions the pipeline treats as legitimate that are, in fact, adversarial. The mitigation is authenticated, integrity-verified messaging between agents, and a foundational policy change: agents should not grant elevated trust to instructions simply because they arrive from another agent in the workflow. Source is not authorization.

ASI08 Cascading Agent Failures

Cascading failures describe what happens when small errors in one agent propagate across planning, execution, and memory layers, compounding through interconnected systems rather than being contained. The amplification mechanism is structural: in a tightly coupled multi-agent workflow, each agent treats the preceding agent's output as a trusted input. Errors do not cancel; they compound. By the time a flawed premise has propagated through several pipeline stages, the distance between the original error and the final harmful output can make attribution nearly impossible. It is like a game of telephone played by robots with production database access.

This risk category is notable because it captures fragility as well as exploitability. Cascading failures can result from model error or misalignment, not just adversarial manipulation. An agent does not need to be compromised to produce a failure that cascades destructively through a pipeline.

The Amazon Q incident OWASP references illustrates the scale dynamic: when a widely adopted tool is weaponized or fails in a way that propagates, the integration and trust that made it useful become the same properties that make the failure spread. Circuit breakers between pipeline stages, independent validation of each agent's outputs before they become a downstream agent's inputs, and failure isolation at the orchestration layer are the structural mitigations.

The identity and authorization thread that runs through all ten risks

OWASP names this pattern directly, and it holds up under examination across every category. Goal hijacking succeeds when an agent cannot distinguish trusted orchestration from untrusted external data: an identity verification failure. Tool misuse succeeds when authorization is checked at the agent level but not at the level of each individual tool call: an authorization granularity failure. Rogue agents succeed when there is no behavioral baseline tied to a verified identity: an accountability failure. Memory poisoning succeeds when external content can write to persistent stores without provenance tracking: an integrity failure that is also an identity failure, because nothing enforces that only trusted sources can modify what the agent remembers.

The infrastructure-level expression of this problem is the authentication gap in agent communication protocols. When agents interact with external tools, services, and each other through channels that lack robust authentication, every message in the pipeline is an assertion rather than a verified claim. Assertions can be forged. Verified claims are significantly harder to compromise.

The implication for enterprise deployment is specific and actionable: identity and authorization infrastructure must be extended to cover non-human agents, at the granularity of individual actions, with short-lived credentials scoped to tasks rather than sessions. Most organizations have mature identity practices for human users. Very few have applied the same rigor to the agents now acting on those users' behalf. That gap is not a minor oversight; it is the condition that makes the majority of the OWASP Top 10 exploitable in the first place.

The framework gives builders and security teams a shared vocabulary. The harder work, applying that vocabulary to production deployments before the incidents those categories describe become your incidents, is the task 2026 makes urgent.