The OWASP Top 10 for Agentic Applications describes risks in systems where AI agents plan and act with tools. OWASP numbers the entries ASI01 to ASI10 but does not rank them by severity.
| Risk | Summary | Guides here |
|---|---|---|
| ASI01:2026 Agent Goal Hijack | Attackers redirect an agent's objectives, task selection or plan through injected instructions, deceptive tool output, forged agent messages or poisoned external data. | 4 |
| ASI02:2026 Tool Misuse and Exploitation | An agent applies legitimately granted tools in unsafe or unintended ways, such as deleting data, overusing costly APIs or exfiltrating information, within its existing privileges. | 3 |
| ASI03:2026 Identity and Privilege Abuse | Delegation chains, inherited credentials, cached sessions and agent-to-agent trust are exploited to escalate access or act beyond the authority intended for an agent. | 2 |
| ASI04:2026 Agentic Supply Chain Vulnerabilities | Third-party agents, tools, MCP servers, plugins, prompt templates, registries or update channels, often loaded at runtime, are malicious, compromised or tampered with. | 4 |
| ASI05:2026 Unexpected Code Execution (RCE) | Agent-generated or agent-triggered code, commands, deserialization or template evaluation executes unexpectedly, compromising hosts or containers or escaping sandboxes. | 3 |
| ASI06:2026 Memory & Context Poisoning | Stored agent memory, conversation summaries, embeddings or retrieval context are corrupted so later reasoning, planning or tool use becomes unsafe across sessions. | 3 |
| ASI07:2026 Insecure Inter-Agent Communication | Messages between agents lack authentication, integrity or semantic validation, allowing interception, spoofing or manipulation of agent intents. | 1 |
| ASI08:2026 Cascading Failures | A single fault, such as a hallucination, poisoned memory or compromised tool, propagates and amplifies across agents and workflows into system-wide harm. | 1 |
| ASI09:2026 Human-Agent Trust Exploitation | People's trust in fluent, authoritative-seeming agents is exploited to obtain harmful approvals or disclosures while the agent's role stays hidden. | 3 |
| ASI10:2026 Rogue Agents | Agents drift from their intended function or authorized scope and act harmfully, deceptively or parasitically, even when each individual action looks legitimate. | 1 |
Entries from OWASP Top 10 for Agentic Applications for 2026 (OWASP GenAI Security Project, Agentic Security Initiative). “Guides here” counts the guides whose main subject is the entry or that cover it in a dedicated section.