OWASP Top 10 for Agentic Applications (2026)
by OWASP GenAI Security Project
The peer-reviewed reference for the ten security risks unique to agents that plan, remember, and call tools.
Overview
Published on December 9, 2025 by the OWASP GenAI Security Project and developed with more than 100 industry experts, researchers, and practitioners, the OWASP Top 10 for Agentic Applications 2026 defines ten risk categories — ASI01 through ASI10 — that are specific to agentic systems rather than to LLM prompts alone. The categories span agent planning manipulation, insecure tool use, identity and delegated authority, supply chain, code execution, memory poisoning, inter-agent communication, cascading failures, human-agent trust, and rogue agents. Its central premise is that agentic applications change how risk propagates: agents act autonomously across many steps and systems, natural language becomes an input surface carrying actionable instructions, tools are composed dynamically at runtime, and memory is reused across sessions, roles, and tenants. The framework introduces the principle of least agency — granting an agent only the minimum autonomy needed for a safe, bounded task — and pairs each risk with practical, actionable mitigation guidance. It is distributed as a free PDF whitepaper and has become the common vocabulary for agent security reviews, threat models, and vendor questionnaires.
At a Glance
- Topic
- Agentic
- Level
- All Levels
- Format
- Guide
- Cost
- Free
- Duration
- ~1-2 hour read (PDF whitepaper)
- Provider
- OWASP GenAI Security Project
- Hands-on
- No
- Certificate
- None
What You’ll Learn
- ✓The ten agent-specific risk categories (ASI01-ASI10) and how each manifests in production
- ✓Why prompt injection is the enabling vulnerability behind most other agentic risks
- ✓How memory poisoning and tool composition create risks that classic AppSec misses
- ✓Apply the least agency principle when scoping an agent's tools and permissions
- ✓Threat-model multi-agent systems, including inter-agent communication and cascading failures
- ✓Concrete mitigations to apply at the planning, tool-execution, and identity layers
Highlights
- •Peer-reviewed by 100+ security experts and practitioners under OWASP
- •Agent-specific — not a rewrite of the LLM Top 10
- •Introduces least agency as a design principle for agent permissions
- •Free PDF; the de facto shared vocabulary for agent security reviews
Who It’s For
Best For
- ✓AI engineers shipping tool-using or multi-agent systems to production
- ✓Security engineers and architects reviewing agentic applications
- ✓Platform teams defining guardrails and permission models for internal agents
Prerequisites
- •Working understanding of LLM agents, tool calling, and agent memory
- •Basic application security concepts
FAQ
What is OWASP Top 10 for Agentic Applications (2026)?
A free, peer-reviewed security framework from the OWASP GenAI Security Project cataloguing the ten most critical risks in autonomous and agentic AI applications. It is the reference document for engineers and architects shipping agents that plan, hold memory, call tools, and act with delegated authority.
Is OWASP Top 10 for Agentic Applications (2026) free?
OWASP Top 10 for Agentic Applications (2026) is free to access.
What level is OWASP Top 10 for Agentic Applications (2026) for?
OWASP Top 10 for Agentic Applications (2026) is aimed at a all levels audience. Recommended background: Working understanding of LLM agents, tool calling, and agent memory, Basic application security concepts.
How long does OWASP Top 10 for Agentic Applications (2026) take?
Expect roughly ~1-2 hour read (PDF whitepaper). Most learners work through it at their own pace.
What will I learn from OWASP Top 10 for Agentic Applications (2026)?
You'll learn: The ten agent-specific risk categories (ASI01-ASI10) and how each manifests in production; Why prompt injection is the enabling vulnerability behind most other agentic risks; How memory poisoning and tool composition create risks that classic AppSec misses; Apply the least agency principle when scoping an agent's tools and permissions; Threat-model multi-agent systems, including inter-agent communication and cascading failures; Concrete mitigations to apply at the planning, tool-execution, and identity layers.