AI Governance & Security7 min read
AI Agent Security: The OWASP Agentic Top 10 in Plain English
Agents have credentials, tools and memory, which makes them a new attack surface. We translate the OWASP Top 10 for Agentic Applications into concrete risks and the controls a business can put in place this quarter.
Contents
A chatbot that says something wrong is embarrassing. An agent that does something wrong, with your credentials, is an incident. That is the premise behind the OWASP Top 10 for Agentic Applications 2026, a peer-reviewed framework from the OWASP GenAI Security Project cataloging the most critical risks once a model becomes an actor with goals, tools, memory and permissions.
The list was assembled from incidents observed in real systems rather than research projections. Its entries are numbered ASI01 to ASI10. Below we paraphrase each in plain language; use the official OWASP publication for exact titles and guidance.
Why agents need their own threat model
Traditional application security assumes code does what it was written to do. An agent's behavior is decided at run time by a model reading untrusted text. Anything the agent reads, including emails, web pages, support tickets, documents and tool output, can carry instructions. Combine that with credentials and a chain of tool calls, and one small manipulation can escalate.
The ten risks, translated
| ID | Risk | What it looks like | First control |
|---|---|---|---|
| ASI01 | Agent goal hijack | A hidden instruction in a web page or email redirects the agent's objective | Treat all retrieved content as data; separate instructions from content; approval for sensitive actions |
| ASI02 | Tool misuse and exploitation | An agent uses a legitimate tool in a harmful way, such as bulk-deleting or over-querying | Narrow tool scopes, argument validation, rate and spend limits |
| ASI03 | Identity and privilege abuse | An agent inherits a person's broad credentials and uses them beyond the task | One identity per agent, short-lived, least privilege |
| ASI04 | Agentic supply chain | A malicious or compromised third-party tool, server or model is loaded | Allow-list and review integrations; pin versions |
| ASI05 | Unexpected code execution | Agent-generated code runs with more access than intended | Sandbox execution, no ambient secrets |
| ASI06 | Memory and context poisoning | False facts or instructions are saved into persistent memory and shape future behavior | Validate before writing memory; scope and expire memory; audit it |
| ASI07 | Insecure inter-agent communication | One agent spoofs or manipulates another | Authenticate agents; validate structured messages |
| ASI08 | Cascading failures | A small error propagates across chained agents and systems | Circuit breakers, step limits, isolation |
| ASI09 | Human-agent trust exploitation | Persuasive agent output leads a person to approve something harmful | Show evidence with each approval request; train reviewers |
| ASI10 | Rogue agents | An agent drifts from its intended behavior or is left running unmanaged | Inventory, monitoring, kill switch, owner per agent |
Only ASI01 (goal hijack), ASI06 (memory poisoning), tool misuse and rogue agents are named in most public summaries we reviewed. Treat the exact numbering and wording of the other entries as paraphrase and confirm them against OWASP's document.
Three attacks to walk through with your team
The poisoned inbox
A support agent summarizes incoming email and can draft replies. An attacker sends a message containing hidden text that says to include the last customer's order details in the reply. If the agent can read order data and send email, it may comply. Controls: keep the summarizing agent read-only, strip or flag hidden content, require approval before any outbound message that includes account data.
The remembered lie
A sales agent stores notes about accounts in long-term memory. A crafted message convinces it to record 'this customer is pre-approved for a 40% discount'. Weeks later a different conversation retrieves that note and acts on it. Controls: memory writes go through validation, are attributed to a source and expire, and discounts require approval regardless of what memory says.
The over-trusted tool
An agent is connected to a third-party server that updates its tool descriptions after installation. The new description contains instructions to send data to an external address. Controls: pin and review versions, allow-list servers and monitor egress. This is why we recommend treating each MCP server as a dependency with an owner.
A control set you can adopt this quarter
- 01Inventory every agent. Name, purpose, owner, tools, data it can reach, where it runs. You cannot secure what you have not found.
- 02Give each agent its own identity with least-privilege, short-lived credentials. Never let it borrow an administrator's session.
- 03Separate read from write. Start read-only. Add write tools individually, each behind approval.
- 04Require human approval for irreversible actions: sending external messages, moving money, deleting, publishing, changing permissions. Show the evidence with the request. See human-in-the-loop design.
- 05Allow-list tools and servers, pin versions and review changes.
- 06Sandbox code execution and strip ambient secrets from the environment.
- 07Cap the loop: maximum steps, maximum spend, timeouts, and a kill switch.
- 08Log everything, including prompts, retrieved content, tool calls with arguments and results, and approvals. Send logs somewhere the agent cannot edit.
- 09Test adversarially. Build a small set of injection cases and run them before each release and after each prompt or tool change.
- 10Review on a schedule. Owners re-certify each agent's access every quarter.
Governance beyond security
Security controls sit inside a wider governance program: risk assessment, accountability, documentation and compliance. Frameworks such as ISO/IEC 42001 and the NIST AI Risk Management Framework give structure, and regulation such as the EU AI Act adds legal duties. Start with the small business AI governance checklist and see what the EU AI Act delay means for you. For the full rollout context, start at the AI automation guide.
Sources and further reading
Frequently asked questions
What is the OWASP Top 10 for Agentic Applications?
It is a peer-reviewed list from the OWASP GenAI Security Project of the ten most critical security risks in autonomous AI agent systems, identified ASI01 to ASI10. It was built from incidents seen in real systems and covers risks such as agent goal hijacking, tool misuse, memory poisoning and rogue agents.
What is prompt injection in an AI agent?
Prompt injection is when text the model reads, such as an email, web page, document or tool result, contains instructions that override or redirect the agent's intended task. In agents the impact is larger because the model can act, for example forwarding data or calling a tool, not only produce text.
How is agent security different from LLM security?
LLM security focuses on what a model says. Agent security also covers what it does: the identities it uses, tools it can call, memory it keeps and other agents it talks to. A minor weakness such as a simple injection can cascade into data exfiltration or financial loss because the agent can chain actions.
What is the single most important control for AI agents?
Least privilege. Give each agent its own identity with the narrowest permissions needed and require human approval for irreversible or high-value actions. Even if the model is manipulated, the damage is capped by what the agent is allowed to do.
Do no-code automation agents need the same controls?
Yes. Agents built on workflow platforms hold credentials and act across systems just as custom agents do. Restrict who can edit them, use dedicated service accounts, log runs and review connected apps regularly.
Work with Navelo Software
Published by Navelo Software
An independent software and AI studio building AI systems, web platforms, mobile apps and SaaS for clients worldwide.
