OWASP Top 10 for Agentic Applications (2026)
by OWASP GenAI Security Project
The ten ways autonomous agents actually get compromised, each tied to a real 2025 breach.
Overview
Released on 9 December 2025 by the OWASP GenAI Security Project and peer-reviewed by more than 100 security experts, researchers and practitioners, this document is the agentic-systems counterpart to the long-running OWASP LLM Top 10. The distinction is deliberate: the LLM list treats a model as a text-generation system, while this one addresses software that holds goals, credentials, tools and memory, and has the autonomy to chain them together across many steps. The ten categories are ASI01 Agent Goal Hijack, ASI02 Tool Misuse and Exploitation, ASI03 Agent Identity and Privilege Abuse, ASI04 Agentic Supply Chain Compromise, ASI05 Unexpected Code Execution, ASI06 Memory and Context Poisoning, ASI07 Insecure Inter-Agent Communication, ASI08 Cascading Agent Failures, ASI09 Human-Agent Trust Exploitation and ASI10 Rogue Agents. Each entry carries a threat model, primary mitigations and a mapping to documented 2025 incidents rather than hypotheticals — EchoLeak (CVE-2025-32711) for zero-click agent data exfiltration, the Amazon Q supply-chain compromise that reached roughly 950,000 users, and the Replit agent that deleted a production database despite an explicit freeze. Beyond the ranked list the document lays out five control families spanning the SDLC and what it calls the Agentic Development Lifecycle (ADLC), plus defenses at the developer edge — IDE, CLI and pull-request surfaces that agentic coding tools newly exposed. OWASP GenAI Security Project material is published free under Creative Commons Attribution-ShareAlike 4.0 and developed in the open with contributions via GitHub.
At a Glance
- Topic
- Agentic
- Level
- Intermediate
- Format
- Guide
- Cost
- Free
- Duration
- ~2-3 hours to read; ~1 day to map against your own agent stack
- Provider
- OWASP GenAI Security Project
- Hands-on
- No
- Certificate
- None
What You’ll Learn
- ✓Name and reason about all ten ASI01-ASI10 agentic risk categories precisely
- ✓Distinguish agent goal hijack from ordinary LLM prompt injection and why it matters
- ✓Model memory and context poisoning attacks against long-lived agent state
- ✓Assess delegated authority and identity abuse across multi-agent trust boundaries
- ✓Trace cascading failures through chained agents and shared tool dependencies
- ✓Apply the five control families across the Agentic Development Lifecycle (ADLC)
- ✓Map documented incidents like EchoLeak and Amazon Q onto specific risk categories
- ✓Reason about human-agent trust exploitation and where over-reliance becomes a control gap
Highlights
- •Peer-reviewed by 100+ practitioners rather than assembled from one vendor's threat feed
- •Every risk is anchored to a documented 2025 incident, not a speculative scenario
- •Ships mitigations and lifecycle control families, not just a ranked list of scary names
- •Covers the developer edge — IDE, CLI and pull-request surfaces — that agentic coding tools opened up
- •Complements rather than replaces the OWASP LLM Top 10, which still governs the model layer
Who It’s For
Best For
- ✓AppSec engineers writing review criteria for agent deployments
- ✓Platform and AI engineering teams putting agents into production
- ✓DevSecOps teams adding agent-specific gates to CI/CD
- ✓Security architects who need a vocabulary their engineers already share
Prerequisites
- •Working knowledge of LLM application architecture — tools, memory, orchestration
- •Familiarity with the OWASP LLM Top 10 or general application threat modeling
- •None beyond that; the document explains agentic concepts before attacking them
FAQ
What is OWASP Top 10 for Agentic Applications (2026)?
A community-authored security reference for teams shipping autonomous AI agents. It enumerates ten risk categories specific to systems that hold credentials, call tools, keep memory and chain steps without a human in the loop, then gives threat models, mitigations and lifecycle controls for each. Written for AppSec, platform and AI engineering teams who already ship agents and need a shared vocabulary for reviewing them.
Is OWASP Top 10 for Agentic Applications (2026) free?
OWASP Top 10 for Agentic Applications (2026) is free to access.
What level is OWASP Top 10 for Agentic Applications (2026) for?
OWASP Top 10 for Agentic Applications (2026) is aimed at a intermediate audience. Recommended background: Working knowledge of LLM application architecture — tools, memory, orchestration, Familiarity with the OWASP LLM Top 10 or general application threat modeling, None beyond that; the document explains agentic concepts before attacking them.
How long does OWASP Top 10 for Agentic Applications (2026) take?
Expect roughly ~2-3 hours to read; ~1 day to map against your own agent stack. Most learners work through it at their own pace.
What will I learn from OWASP Top 10 for Agentic Applications (2026)?
You'll learn: Name and reason about all ten ASI01-ASI10 agentic risk categories precisely; Distinguish agent goal hijack from ordinary LLM prompt injection and why it matters; Model memory and context poisoning attacks against long-lived agent state; Assess delegated authority and identity abuse across multi-agent trust boundaries; Trace cascading failures through chained agents and shared tool dependencies; Apply the five control families across the Agentic Development Lifecycle (ADLC); Map documented incidents like EchoLeak and Amazon Q onto specific risk categories; Reason about human-agent trust exploitation and where over-reliance becomes a control gap.
Topics
Sources
This page was written from 4 sources, 3 on domains other than genai.owasp.org.