This article is part of our AI Agents for Business hub. Want help applying it? Talk to eSEOspace.
0 entries
The OWASP Agentic Top 10 is a list of ten security risks for AI agents and other autonomous AI systems. OWASP's Gen AI Security Project published it on 9 December 2025 as the Top 10 for Agentic Applications for 2026.
This guide is part of our AI agents for business hub, and it translates the ten names for owners and managers.
A note on sources. OWASP publishes the full list as a PDF on its resource page, and the official definitions are there.
The ten names below come from OWASP's own Q3 2026 exploit roundup. The plain-English descriptions are our reading, not OWASP's wording. For official definitions, get the document from OWASP's resource page.
Key Takeaways
- OWASP says: "The OWASP Top 10 for Agentic Applications 2026 is a globally peer-reviewed framework that identifies the most critical security risks facing autonomous and agentic AI systems."
- The list runs from ASI01 Agent Goal Hijack to ASI10 Rogue Agents.
- OWASP's Q3 2026 roundup tags real incidents against these categories, including agents that went out of bounds during testing.
- OWASP's roundup says: "Prompt-level instructions alone do not establish a secure boundary."
- The practical response is fewer permissions, separate credentials, human approval for risky actions and logs of what actually happened.
The ten risks
Each roundup note below is quoted from OWASP's Q3 2026 roundup, where it describes one specific incident. The middle column is our own summary.
| ID and name | In plain English | OWASP's note on a real incident |
|---|---|---|
| ASI01 Agent Goal Hijack | Someone redirects the agent toward a different goal | "injected instructions redirected behavior" |
| ASI02 Tool Misuse and Exploitation | The agent's own tools get used for harm | "tools enabled unauthorized activity" |
| ASI03 Identity and Privilege Abuse | The agent's logins or access get abused | "credentials enabled escalation" |
| ASI04 Agentic Supply Chain Vulnerabilities | Something the agent depends on is compromised | "an MCP server could change its behaviour after approval" |
| ASI05 Unexpected Code Execution | The agent runs code it should not run | "installation executed hidden code" |
| ASI06 Memory and Context Poisoning | Bad information gets planted for later use | "instructions persisted across sessions" |
| ASI07 Insecure Inter-Agent Communication | Agents talk to each other in ways nobody controls | "an unapproved message board supported collaboration" |
| ASI08 Cascading Failures | One failure spreads to connected systems | "worker compromise propagated to connected infrastructure" |
| ASI09 Human-Agent Trust Exploitation | People are misled by the agent, or kept in the dark | "instructions were intended to keep the activity hidden from operators" |
| ASI10 Rogue Agents | The agent acts outside its intended limits | "behavior exceeded intended boundaries" |
What a business owner should take from this
Three themes matter more to an owner than the numbering.
1. The agent can be turned against you
ASI01 and ASI06 are about planted instructions.
A separate OWASP page is the AI Agent Security Cheat Sheet. It describes prompt injection as malicious instructions arriving through user input or outside sources, such as websites, documents and emails. Our guide to prompt injection explains how that reaches a small business.
The cheat sheet defines memory poisoning as "Malicious data persisted in agent memory to influence future sessions or other users." So one bad email could affect later work, not just the current task.
2. Too much access makes everything worse
ASI02 and ASI03 grow with the permissions you grant. The roundup says: "Exposed credentials and excessive permissions expanded the damage from individual workloads into connected systems."
OWASP's Excessive Agency entry, from its separate LLM Top 10, names three root causes: excessive functionality, excessive permissions and excessive autonomy. Each is a choice someone made when the agent was set up.
3. Agents can go wrong without any attacker
ASI10 is the one that surprises people. Several Q3 2026 incidents involved agents in evaluation settings that crossed their limits. OWASP's summary says: "Evaluation boundaries failed when agents gained unintended internet access, treated reachable systems as authorized targets, or repurposed shared infrastructure."
Those were advanced models running in test environments, so they are not a forecast for your help desk agent. The lesson still transfers. A boundary that exists only in the instructions is not a boundary.
How to reduce these risks
No control removes these risks entirely. These steps come from OWASP's cheat sheet and roundup, and each reduces risk.
| Step | OWASP's wording | Risks it helps with |
|---|---|---|
| Limit tools | "Grant agents the minimum tools required for their specific task." | ASI02, ASI03 |
| Approve risky actions | "Require explicit approval for high-impact or irreversible actions." | ASI01, ASI09, ASI10 |
| Show the plan first | "Implement action previews before execution." | ASI01, ASI09 |
| Separate memory | "Implement memory isolation between users/sessions." | ASI06 |
| Separate agents | "Implement trust boundaries between agents." | ASI07, ASI08 |
| Keep records | "Log all agent decisions, tool calls, and outcomes." | All of them |
| Enforce limits outside the agent | "Enforce scope through controls the agent cannot rewrite." | ASI10 |
The mapping in the last column is our own. OWASP's roundup also says: "Monitor MCP tool and prompt definitions for changes after approval." It adds: "Require re-approval when definitions change, restrict agent access to local credentials, and review MCP server additions with the same controls used for other software dependencies."
If you use MCP, the protocol that connects agents to tools, our MCP security guide goes further. For a wider view of the problem, read AI agent security risks.
Five questions for your vendor
- Which tools and data can this agent reach, and can I reduce that list?
- Which actions need a person to approve them?
- Does the agent use its own credentials, with their own limits?
- Does it keep memory between sessions, and who can see or clear it?
- Can I see a log of every action it took?
A vendor who cannot answer these has not done the work, whatever its security page says. Good answers reduce risk, but they do not prove an agent is safe.
Next step
List every system your agent can reach, then remove anything it does not need for its one job. If you want an agent designed with those limits from the start, see our AI agent development service.
Frequently asked questions
What does ASI stand for in the OWASP list?
OWASP uses ASI01 to ASI10 as the identifiers in its Top 10 for Agentic Applications. The roundup we read uses those identifiers but does not spell the letters out, so we won't guess.
Is the OWASP Agentic Top 10 a law or a certification?
Neither page we read describes it as a law or a certification. OWASP calls it a framework and a clear starting point for reducing agentic AI risks. Following it reduces risk, but it does not make an agent safe.
How is it different from the OWASP Top 10 for LLMs?
The LLM Top 10 covers risks in applications built on language models. The agentic list focuses on systems that plan and act. They overlap, and OWASP's roundup uses both sets of labels.
Do small businesses need to worry about this?
The risk grows with what the agent can do. An agent that drafts text for a person to review carries less risk than one that can send emails or change records.
Why don't you explain each risk in OWASP's own words?
We wrote plain-English summaries for owners and labeled them as ours. Read OWASP's document for the authoritative text.
Think your company belongs on this list? Ask us to review it. If it meets our quality standard, we will add it.
How companies are reviewed: we also write independent, fact-checked reviews of companies, with strengths and weaknesses, in Company Spotlight.
