OWASP Agentic Top 10

Agentic AI systems introduce risk surfaces a non-agentic LLM application doesn't have: the agent can act, not just generate text, and it frequently delegates to sub-agents or invokes tools with real-world side effects. The OWASP Agentic Top 10 names ten categories addressing this surface: prompt injection (agentic context), excessive agency, privilege escalation, context manipulation, insecure memory, tool injection, unauthorized lateral movement, supply chain risks, audit trail deficiency, and identity spoofing.

Three items address the ways agentic systems accumulate or exercise more privilege than a task requires — excessive agency, privilege escalation, and context manipulation — sharing a common root: provisioning agents with broad access and assuming prompt-level instructions are sufficient guardrails against misuse of that access.

The middle tier addresses operational components: insecure memory (persistent context that isn't properly scoped or access-controlled), tool injection (a manipulated tool descriptor redirecting agent behaviour, especially relevant in multi-server MCP environments), and unauthorized lateral movement (a compromised agent reaching resources belonging to another agent in a multi-agent system).

The final tier addresses ecosystem and observability risk: supply chain risks from third-party tools and models, audit trail deficiency (a system that can't reconstruct what it did and why), and identity spoofing (an attacker impersonating a trusted agent or tool in inter-agent communication).

As with the LLM Top 10, the taxonomy's value is in the control mapping, not the naming. A structured assessment maps each of the ten items to required controls, a lifecycle gate, and evidence of operation for the specific assessed system — producing an evidence pack, not a slide citing the framework.