OWASP Agentic Top 10

Agentic AI systems introduce risk surfaces a non-agentic LLM application doesn't have: the agent can act, not just generate text, and it frequently delegates to sub-agents or invokes tools with real-world side effects. The OWASP Top 10 for Agentic Applications (2026) names ten items for this surface, ASI01 to ASI10: agent goal hijack, tool misuse and exploitation, identity and privilege abuse, agentic supply chain vulnerabilities, unexpected code execution, memory and context poisoning, insecure inter-agent communication, cascading failures, human-agent trust exploitation, and rogue agents.

Three items address how an agent is steered or over-empowered: goal hijack (instructions in content the agent reads redirect what it is trying to do), tool misuse (a legitimate tool used in an unsafe way), and identity and privilege abuse (the agent acting with more authority than the person it serves — the confused-deputy problem).

Three address the agent's components: agentic supply chain vulnerabilities (a malicious or manipulated tool, model, prompt or MCP server descriptor), unexpected code execution (generated code reaching the host), and memory and context poisoning (untrusted content persisting into later decisions).

The rest address systems of agents and the people around them: insecure inter-agent communication, cascading failures (one fault fanning out across orchestrated steps), human-agent trust exploitation (approvals that become rubber stamps), and rogue agents (an agent acting outside its mandate, which only a complete action trail can show).

As with the LLM Top 10, the taxonomy's value is in the control mapping, not the naming. A structured assessment maps each of the ten items to required controls, a lifecycle gate, and evidence of operation for the specific assessed system — producing an evidence pack, not a slide citing the framework.