Agentic AI Top 10

The 10 critical security risks unique to autonomous AI agents — representing the official OWASP Top 10 for Agentic Applications (ASI01-ASI10).

The OWASP LLM Top 10 addresses risks in language models — hallucinations, prompt injection into a chatbot, and insecure output handling. Those risks matter. But they assume a human is in the loop: the model generates text, a person reads it, a person decides what to do next. Agentic AI applications break that assumption entirely. When an AI agent can browse the web, send emails, execute code, query databases, and call external APIs — all without a human reviewing each step — the risk profile changes fundamentally. An agent doesn't just say something dangerous. It does something dangerous, at machine speed, often irreversibly.

The **OWASP Top 10 for Agentic Applications (ASI01-ASI10)**, released in late 2025, addresses this new category of risk. These are not theoretical concerns — early agentic deployments in financial services, IT operations, customer service, and software development are already encountering these failure modes. The common thread across all ten risks is **autonomous action**: the agent has been given the ability to act in the world, and each of these risks describes a way that capability can be turned against the organization that deployed it. Understanding these risks is not optional for technology leaders. Agentic AI is moving from pilot to production, and security frameworks need to move with it.

ASI01

Agent Goal Hijack

Attackers manipulate an agent's objectives via malicious prompts, content, or indirect injection.

Critical

ASI02

Tool Misuse & Exploitation

Agents invoke tools or APIs in unintended, destructive, or unauthorized ways.

Critical

ASI03

Identity & Privilege Abuse

Agents inherit or escalate excessive permissions to perform actions outside authorization boundaries.

High

ASI04

Agentic Supply Chain

Vulnerabilities introduced through untrusted MCP servers, packages, skills, or model registries.

High

ASI05

Unexpected Code Execution

Agents dynamically generate and execute system commands or python scripts without isolation.

Critical

ASI06

Memory & Context Poisoning

Attackers manipulate agent long-term memory or RAG indexes to influence future decision-making.

High

ASI07

Insecure Inter-Agent Comm.

Spoofing, interception, or manipulation of messages within multi-agent workflow systems.

High

ASI08

Cascading Failures

Small errors in parsing or planning compound iteratively to cause catastrophic system actions.

High

ASI09

Human-Agent Trust Exploitation

Attackers manipulate agent outputs to exploit human over-reliance, causing unsafe actions.

Medium

ASI10

Rogue Agents

Compromised or unmanaged agents spawned unauthorized, creating botnets or stealth backdoors.

High

⚠️

This list reflects the canonical **OWASP Agentic Top 10** standard. Organizations deploying autonomous agents today should treat this framework as a living governance model and align their security monitoring controls to detect these specific vectors.