Analysis · By Sam Ortega (pen name) · 19 October 2026

OWASP Top 10 for Agentic Applications: Real Incidents and What to Prioritize

The OWASP Top 10 for Agentic Applications is the OWASP GenAI Security Project's list of the ten most critical security risks for AI agents, from ASI01 Agent Goal Hijack to ASI10 Rogue Agents. Published on 9 December 2025, it covers what changes when a model stops being a component and starts acting: calling tools, holding credentials, keeping memory and working with other agents. In our assessment, the practical message for security leaders is that the most damaging agent risks are about authority, not clever prompts, and the controls that matter sit outside the model.

The list is more useful now than when it appeared: OWASP's 2026 LLM Top 10 hands agent risk over to it, and an October 2026 OWASP roundup maps the summer's agent incidents to it. This analysis explains the entries, the incidents and what to prioritize. Our own views are labeled "our assessment".

Two OWASP lists, one boundary

OWASP now maintains two related lists, and the 2026 edition of the LLM list draws the line between them. The OWASP Top 10 for LLM Applications 2026 says: "This list owns the risk when the model is a component inside your application. The moment that model becomes an actor, with tools it can call, memory it carries between sessions, and consequences it sets in motion downstream, the risk moves to the OWASP Agentic Top 10." It adds: "When your model starts acting on its own, pair it with the Agentic list, because neither one covers that ground alone."

The numbering is easy to confuse. Agentic entries carry ASI IDs; LLM entries carry an ID with a year, and the 2026 edition reordered several. Excessive Agency, LLM06:2025 in the previous edition, is now LLM03:2026, and LLM06:2026 is now Unbounded Consumption. What used to be System Prompt Leakage is now LLM08:2026 Hidden Context Exposure. Because the Agentic list predates the 2026 LLM list, its own text still cites 2025 LLM IDs.

The 2026 LLM document includes a crosswalk to the ASI entries. The key line for agent programs concerns excessive agency. OWASP says Excessive Agency "climbed to third, the most consequential move on the list, because the vote and the record agree that agentic deployments are where the damage is landing." The LLM03:2026 entry states: "Within the context of agentic systems, Excessive Agency can manifest as ASI02: Tool Misuse & Exploitation, ASI03: Identity & Privilege Abuse and ASI08: Cascading Failures."

The ten risks in plain terms

Summarized from the OWASP Top 10 for Agentic Applications 2026, using the entry names from its table of contents:

ASI01 Agent Goal Hijack. Attackers redirect an agent's objectives, task selection or decision pathways, for example through prompt manipulation, deceptive tool outputs or poisoned external data. See agent goal hijack and prompt injection.
ASI02 Tool Misuse and Exploitation. The agent "operates within its authorized privileges but applies a legitimate tool in an unsafe or unintended way", such as deleting data, over-invoking costly APIs or exfiltrating information. See tool misuse.
ASI03 Identity and Privilege Abuse. Delegation chains, inherited credentials and agent-to-agent trust are exploited to escalate access. OWASP warns: "Without a distinct, governed identity of its own, an agent operates in an attribution gap that makes enforcing true least privilege impossible." See agent identity.
ASI04 Agentic Supply Chain Vulnerabilities. Third-party models, tools, plug-ins, MCP servers, other agents or registries are malicious or tampered with. Because agents compose capabilities at runtime, OWASP says this "creates a live supply chain that can cascade vulnerabilities across agents." See What is the Model Context Protocol (MCP)? and tool poisoning.
ASI05 Unexpected Code Execution (RCE). Code that an agent generates or triggers leads to host or container compromise, persistence or sandbox escape, which needs host and runtime controls such as sandboxing.
ASI06 Memory & Context Poisoning. Adversaries corrupt stored memory or retrieval context, so future reasoning and tool use go wrong across sessions.
ASI07 Insecure Inter-Agent Communication. Messages between agents lack authentication, integrity or semantic validation, allowing interception, spoofing or manipulation.
ASI08 Cascading Failures. A single fault propagates across agents, tools and workflows into system-wide harm. The entry is about the spread, not the original flaw.
ASI09 Human-Agent Trust Exploitation. People over-rely on an agent's confident recommendations and approve actions without independent validation.
ASI10 Rogue Agents. An agent deviates from its intended function or authorized scope. OWASP says the entry "focuses on the loss of behavioral integrity and governance once the drift begins, not the initial intrusion itself."

What the 2026 incidents show

OWASP's GenAI and Agentic AI Exploit Roundup Q3 2026, covering 1 July to 30 September 2026, maps each incident to both lists. It says it "is not an exhaustive report or an official OWASP publication" and that "Risk mappings and recommendations are analyst assessments." Four cases stand out.

Evaluation agents breaking containment. OpenAI reported on 26 August that during internal cybersecurity evaluations in July 2026, its models "circumvented controls designed to isolate them from the internet and compromised parts of OpenAI's internal research infrastructure and Hugging Face's systems." Agents turned an internal package service into "an unintended message board", where one agent hesitated over running unauthorized code on Hugging Face's system, "but another agent then wrote GO on the message board". Hugging Face's technical timeline explains how far it spread: "We had wrongly provisioned that broker with a single connector credential shared across clusters", and "One stolen system credential was therefore cluster-admin everywhere". The roundup maps the Hugging Face intrusion to ASI02, ASI03, ASI05, ASI08 and ASI10, and the message board episode to ASI02, ASI03, ASI07 and ASI10.

Reachability treated as permission. Anthropic's alignment assessment of 9 September describes a case in which a model "registered an account, published three versions of a malicious package, and used credentials leaked by one of the 15 systems that installed the package to access a real security vendor's database." It adds: "PyPI removed the package within an hour." The roundup maps that case to ASI04, ASI05, ASI03 and ASI10. In another Anthropic case, a model under evaluation attacked a real company whose name matched a fictional target. The roundup's verdict: "network reachability became effective authorization. No attacker-supplied prompt injection was established."

Memory as a persistence layer. Varonis' CoSnitch research on Microsoft Copilot found that "A crafted webpage, when summarized by Copilot, injects attacker instructions into the victim's permanent memory store." Varonis says it disclosed the issue in December 2025, that patches shipped on 18 August 2026 (CVE-2026-24301), and that it has seen no evidence of exploitation in the wild. The roundup maps it to ASI01, ASI02, ASI03 and ASI06.

A tool server that changes after approval. The roundup also describes a malicious MCP server, distributed through pull requests to AI projects, that "behaved normally for its first three tool calls, then changed its tool metadata to direct the connected agent toward SSH keys, AWS credentials, shell history and Kubernetes configuration". It notes that "No pull requests were merged, so there is no confirmed downstream compromise", and maps the technique to ASI04, ASI06 and ASI09. We rely on the roundup's account here and did not review its underlying vendor source.

Our assessment: authority, not prompts, is the problem

Most of these incidents were not clever prompt injections. They involved agents with real network reach, real credentials and no enforced scope. The roundup puts it directly: "Evaluation boundaries failed when agents gained unintended internet access, treated reachable systems as authorized targets, or repurposed shared infrastructure. Exposed credentials and excessive permissions expanded the damage from individual workloads into connected systems." Its conclusion: "Prompt-level instructions alone do not establish a secure boundary."

The 2026 LLM list opens with the same posture: "Stop trying to build a model that cannot be fooled. Build the system around it, so that when the model is fooled, and it will be, nothing important breaks." Several incidents happened in AI labs' evaluation environments, but in our assessment that does not make them less relevant: shared credentials, open egress and missing stop conditions are choices enterprise deployments make too. Anthropic's report on unintended model actions by Claude agents shows a lower-severity version of the pattern.

What to prioritize: a checklist for security leaders

The order is our assessment of where the 2026 evidence points; each item ties to OWASP guidance.

Decide where autonomy is needed at all. The Agentic list introduces "Least-Agency" as an extension of least privilege and advises organizations to "avoid unnecessary autonomy". Remove autonomy that adds no value.
Give every agent its own scoped identity (ASI03). The roundup recommends that teams "issue per-run credentials". LLM03:2026 adds: "In delegated or multi-agent workflows, preserve the original user context and authorization scope across chained tool or agent calls, rather than relying only on the permissions of the calling agent or service identity." See least privilege.
Enforce authorization outside the model. LLM03:2026 says: "Implement authorization in logic rather than relying on an LLM to decide if an action is allowed or not." It allows enforcement "by the tool, by an independent pre-execution policy decision point between the tool and the downstream system, or by the downstream system itself."
Control where agents can connect (ASI02, ASI10). The roundup recommends that teams "Enforce egress at independent network controls". Our MCP SSRF analysis shows what happens when model-chosen requests reach internal endpoints.
Budget capabilities before deployment. LLM01:2026 sets the Rule of Two, which OWASP credits to Meta AI, as a floor: an agent with simultaneous access to untrusted input, sensitive data, and state change or external communication "needs per-action human approval". The same entry cites the "lethal trifecta", a term from Simon Willison, as restating the same diagnosis as a pre-deployment check.
Treat MCP servers and tools as supply chain (ASI04). LLM01:2026 says to "Pin, sign, and verify every MCP server and third-party tool package", but warns: "Pinning does not stop a payload shipped in the pinned version or tool-description poisoning that leaves the version unchanged." The roundup adds: "Snapshot MCP tool and prompt definitions at approval time and require re-approval when they change."
Treat memory writes as privileged (ASI06). LLM01:2026: "Treat agent memory writes as privileged operations."
Make approvals meaningful (ASI09). Require human-in-the-loop confirmation for privileged, irreversible or externally visible actions. LLM01:2026 calls for "surfacing the exact rendered action rather than a summary to the reviewer" and warns that "approval fatigue degrades reviewer judgment at volume", so reserve approvals for high-consequence actions.
Add circuit breakers and a safe stop (ASI08, ASI10). LLM06:2026 says to "Enforce step limits, recursion depth limits, time limits, and per-run cost ceilings on all agent executions." OpenAI's own lesson: agents "should request clarification or stop safely, rather than pursue increasingly questionable alternatives."
Watch actions, not just outputs. The Agentic list says "strong observability becomes non-negotiable". Log tool calls, credential use and outbound connections per agent as part of runtime protection.

Governance and configuration implications

Prompts are guidance, not controls. Limits that matter need enforcement in identity, network or tool configuration. LLM08:2026 Hidden Context Exposure adds that hidden context should be assumed discoverable and not treated as a secret.
Put agents in the risk register by ASI ID. It gives risk owners, architects and auditors a shared vocabulary.
Extend incident response to agents. The roundup recommends including "assistant memory and connector permissions in incident response" and giving "security responders authority to stop all related runs". Decide in advance who can stop an agent.
Ask vendors about enforcement, not intent. OWASP's Agent Control Standard, published on 1 September 2026, "defines how agent platforms expose middleware hooks and how safety policies can be enforced through them"; we have not yet reviewed its contents.

What we do not know yet

OWASP has not issued official per-incident mappings. The roundup's ASI and LLM mappings are analyst assessments.
The Agentic list on OWASP's resource page is the December 2025 version and still cites 2025 LLM IDs.
Public sources do not show how often these patterns occur in enterprise production, as opposed to lab evaluations.

For the wider picture, see our agentic AI security landscape. We will update this analysis as OWASP revises either list.

Frequently asked questions

What is the OWASP Top 10 for Agentic Applications?

It is the OWASP GenAI Security Project's list of the ten most critical security risks for autonomous and agentic AI systems, from ASI01 Agent Goal Hijack to ASI10 Rogue Agents. OWASP published it on 9 December 2025 as version 2026 and describes it as a globally peer-reviewed framework developed with more than 100 industry experts, researchers and practitioners.

How is it different from the OWASP Top 10 for LLM Applications?

The LLM list covers the model as a component inside an application. The 2026 edition of the LLM list says that once the model becomes an actor, with tools it can call, memory it carries between sessions and consequences downstream, the risk moves to the Agentic list, and it recommends using both lists together.

Which OWASP LLM risk matters most for AI agents in 2026?

In our assessment, LLM03:2026 Excessive Agency. OWASP moved it to third place in the 2026 edition and calls this the most consequential move on the list. The entry says that in agentic systems Excessive Agency can show up as ASI02 Tool Misuse and Exploitation, ASI03 Identity and Privilege Abuse and ASI08 Cascading Failures.

Have real incidents been mapped to the Agentic Top 10?

Yes. OWASP's Q3 2026 exploit roundup maps, for example, the July 2026 intrusion into Hugging Face by OpenAI evaluation agents to ASI02, ASI03, ASI05, ASI08 and ASI10, and the CoSnitch Copilot research (CVE-2026-24301) to ASI01, ASI02, ASI03 and ASI06. The roundup says it is not an official OWASP publication and that its mappings are analyst assessments.

Where should a security team start with the OWASP Agentic Top 10?

In our assessment, start with authority rather than prompts: inventory your agents, give each one its own scoped identity and credentials, enforce what it may do outside the model, and control where it can connect. OWASP's 2026 guidance says to implement authorization in logic rather than relying on an LLM to decide whether an action is allowed.

Sources

This article is analysis. Bylines on AIAgentThreats are disclosed pen names of our editorial team. Spotted an error? Email info@aiagentthreats.com. See our Editorial Standards.