FollowAgents AI AGENTS DIRECTORY
Home / AI Agent Glossary / OWASP Agentic AI Top 10
Evaluation & Safety

OWASP Agentic AI Top 10

Also called: OWASP Top 10 for Agentic Applications · OWASP Agentic Top 10 · ASI Top 10

The OWASP Top 10 for Agentic Applications is a community-produced list from the OWASP GenAI Security Project that catalogues the ten most significant security risks specific to AI agent systems, from goal hijacking to rogue agents.

Goal hijackTool misuseIdentity abuseMemory poisoningRogue agentsAgentic Top 10
A few of the ten risk categories the OWASP list covers — each is a failure mode that only appears once a model can plan, remember, use tools, and coordinate with other agents.

OWASP has long published "Top 10" lists that give security teams a shared vocabulary for a class of system — for web apps, and more recently for LLM applications. The OWASP Top 10 for Agentic Applications, published by the OWASP GenAI Security Project in late 2025 for 2026, does the same job for agents specifically.

Its premise is that an agent has failure modes a single-shot LLM app does not, because it can plan over many steps, keep memory, call tools, hold delegated permissions, and talk to other agents. The list's categories run from ASI01 Agent Goal Hijack — redirecting an agent's objective, often through prompt-injection in content it reads — through ASI02 Tool Misuse, ASI03 Agent Identity & Privilege Abuse, ASI04 Agentic Supply Chain Compromise, ASI05 Unexpected Code Execution, and ASI06 Memory & Context Poisoning, to ASI10 Rogue Agents (an agent that drifts from intended behavior and acts as a trusted insider threat). The remaining entries cover areas including insecure inter-agent communication, cascading failures across an agent system, and exploitation of human trust in the agent.

The value of the list is as a checklist and a common language, not as a standard you comply with. Each item comes with description, example scenarios, and mitigation guidance. Numbering and exact titles can be refined between revisions, so cite it as "the OWASP Agentic Top 10" and check the current version for precise wording.

How it works

Teams use the list the way they use other OWASP Top 10s: as a coverage map during threat modeling and review. For each category you ask whether your agent is exposed and what control addresses it — for goal hijack, isolation of untrusted content and least privilege; for identity abuse, scoped short-lived agent-identity; for memory poisoning, validation of what gets written to and read from memory; for rogue agents, monitoring and kill-switches. It is deliberately framed around agent-specific risk, so it complements rather than replaces the separate OWASP Top 10 for LLM Applications, which still covers model-level issues.

Example

A security reviewer walks a new internal "deploy assistant" agent against the list. ASI01: it reads ticket text — is that content sandboxed from its instructions? ASI03: does it use its own scoped credentials or a shared admin token? ASI05: can a tool result cause it to run arbitrary shell commands? ASI06: is its long-term memory writable by untrusted input? Each gap becomes a tracked finding with a mitigation, instead of the review relying on the reviewer remembering every agent-specific pitfall.

How it differs

OWASP Agentic Top 10 vs. OWASP Top 10 for LLM Applications: the LLM list targets risks in applications built around a model call — prompt injection, insecure output handling, training-data poisoning, and so on. The Agentic list targets risks that only exist once that model is wired into an agent that plans, remembers, uses tools, and coordinates with other agents. They are companion lists, not versions of each other.

Common misconceptions

Often assumed: It's just the OWASP LLM Top 10 renamed.
Actually: It's a separate list focused on agent-specific failure modes — tool misuse, delegated-identity abuse, memory poisoning, inter-agent communication, rogue agents — that a single model call doesn't have.
Often assumed: Following the list makes an agent compliant or certified.
Actually: It's an awareness and threat-modeling resource, not a certification or regulatory standard; it gives you a checklist and mitigations, not a pass/fail stamp.

FAQ

What is the OWASP Agentic AI Top 10?
A 2026 list from the OWASP GenAI Security Project cataloguing the ten most significant security risks specific to AI agent systems, from Agent Goal Hijack (ASI01) to Rogue Agents (ASI10), each with examples and mitigations.
How is it different from the OWASP Top 10 for LLM Applications?
The LLM list covers risks in model-centric apps; the Agentic list covers risks that appear only when a model is part of an agent that plans, holds memory, uses tools, and coordinates with other agents. They're companion lists.
Is the OWASP Agentic Top 10 a compliance standard?
No. It's a community awareness and threat-modeling resource — useful as a review checklist — not a certification or regulatory requirement.

Last checked: 2026-08-30

Related terms

AI Agent Safety

Agent safety is the practice of anticipating and limiting the harm an AI agent could cause once it can take real actions in the world, not just generate text.

Prompt Injection

Prompt injection is an attack in which text inside the content a model reads — a web page, a document, an email, a tool result — is crafted so the model treats it as an instruction and acts on it, overriding what the developer or user actually asked for.

Agent Identity

Agent identity is the practice of treating an autonomous agent as its own principal in an access-management system — with its own credentials, narrowly scoped and time-limited permissions, a delegation chain back to an authorizing human, and its own audit trail.