Hidden instructions embedded in a shared document were enough to turn a Microsoft 365 Copilot session into a channel for exfiltrating sensitive data, an incident now known as “EchoLeak” — no phishing email, no malicious click, just a document the agent was already trusted to read. Incidents like this are why the OWASP Gen AI Security Project built a Top 10 for Agentic Applications, developed with more than 100 practitioners across the industry. Once AI systems started taking actions instead of just generating text, security had to change with them.
The list contains ten categories, each anchored in a real failure: identity abuse, supply-chain compromise, agents that quietly drift from what they were asked to do. That structure gives security teams something to build a program against, instead of reacting to each new incident as its own surprise.
A Shared Vocabulary for a New Risk Surface
A framework only helps if it lets different teams describe the same problem the same way. “Agentic security” often means something different depending on who you asked: a prompt-injection filter to one team, an identity and access review to another, a monitoring dashboard to a third. Each team solves a piece of the problem without seeing how the pieces fit together.
The OWASP list categorizes those pieces into a single structure that maps each risk to its root cause: identity and privilege (ASI03), supply chain (ASI04), inter-agent communication (ASI07), cascading failures across automated pipelines (ASI08). A security team can now go into a budget conversation with a common language and a checklist where every item on it maps to something enforceable.
Mapping the Ten Risks to the AI Gateway
The Cequence AI Gateway sits inline in front of every MCP server, LLM provider, and agent an organization uses, no matter where the agent is running. Every request passes through it before reaching its destination, which is what makes a direct mapping between the OWASP risks and enforceable controls.
| OWASP Risk | Cequence AI Gateway Control |
|---|---|
| ASI01 — Agent Goal Hijacking | Prompt Guard blocks injected instructions inline before they reach the model with self-service rule tuning as new injection patterns emerge. |
| ASI02 — Tool Misuse & Exploitation | MCP and Skill registries limit agents to vetted, curated tools instead of ad hoc integrations; automated tool risk scoring and Agent Behavior Protection catch business-logic abuse and misuse of tools that are technically permitted. |
| ASI03 — Identity & Privilege Abuse | Agent Personas enforce least privilege by job description; the API registry brokers credentials so agents authenticate with a single agent access key and never have access to the underlying secret; OAuth 2.1 identity proxy and on-behalf-of token exchange attribute every action to both agent and user. |
| ASI04 — Agentic Supply Chain Vulnerabilities | AI Discovery continuously scans for unsanctioned MCP servers, agents, and LLM providers already in use so they can be brought under governance or blocked; The Cequence registries offer only vetted MCP servers, APIs, and LLMs. |
| ASI05 — Unexpected Code Execution | Rate limiting and tool risk-scoring guardrails contain what a runaway tool call can do; a pre-production validation gate checks every new tool or policy before it goes live. |
| ASI06 — Memory & Context Poisoning | The AI Gateway continuously monitors agent actions and refuses any that stray from the described job description, so even if an attacker successfully poisons the memory and context of the agent, the AI Gateway will prevent the resulting actions. |
| ASI07 — Insecure Inter-Agent Communication | Native authenticated MCP support and session binding verify both parties on every call (Agentic Zero Trust principles); inter-agent workflows require explicit persona-to-persona authorization. |
| ASI08 — Cascading Failures | Real-time behavioral monitoring catch failures early; rate limiting and Agent Personas limit the blast-radius and keeps one agent’s error from propagating into a chain reaction. |
| ASI09 — Human-Agent Trust Exploitation | Indelible audit trail supports after-the-fact review of agentic interactions. |
| ASI10 — Rogue Agents | Agent Personas are a containment ring around each agent, ensuring that they don’t exceed their job description. Trusted registries offer only vetted MCP servers, APIs, LLMs, and skills. Built-in guardrails include automated tool risk scoring, rate limiting, and spend limits. |
An important detail is that the AI Gateway’s Agent Personas capability is the overseer that not only protects against most of the threats above, but renders them completely toothless. Agent Personas use a plain-language job description to bind specific tools, models, access, and guardrails to the persona, delivering real-time agent containment at enterprise scale. As soon as an agent tries to go outside its described job description, the AI Gateway simply doesn’t allow it. Prompt injection protection, sensitive data protection, and monitoring and logging are also applied against agent activities.
A Closer Look at Specific Risks
ASI03, identity and privilege abuse, is the one most teams underestimate: when an agent has a database password or a third-party API key directly, a leaked credential gives an attacker that same access. The AI Gateway brokers the credentials instead, so the agent authenticates with its own access key and never sees the underlying secret.
ASI09 requires more than just security tooling; the sole exception on this list. An indelible audit trail supports investigating what happened after a human approves something an agent talked them into, but the control that actually prevents it is procedural: requiring human sign-off on high-risk actions before they execute. Tooling can surface the evidence for that review. It can’t replace the judgment call itself.
Four of these risks — memory poisoning, cascading failures, human-agent trust exploitation, and rogue agents — share a common trait: no single action looks wrong in isolation. An agent reading a file, calling a tool, and fetching a credential are all individually unremarkable. What matters is the sequence, and whether it stays inside the boundaries of what the agent was built to do. AI Gateway’s Agent Behavior Protection is built for that problem. It scores an agent’s behavior over time against its described persona in addition to evaluating each call on its own. And because the AI Gateway is observing agentic actions in real time, it can stop any actions that deviate from the agent’s job description – immediately and automatically.
Keeping Pace with New Attack Techniques
It seems as if new attack techniques against agentic systems show up daily. When a new prompt-injection pattern or data-leak technique surfaces, adding a rule to AI Gateway’s Prompt Guard puts it in front of every model, tool, and MCP server under governance right away, without waiting on an LLM provider fix, an MCP server maintainer patch, or a model retraining cycle. That’s what keeps the mapping above current: the ten risks are fixed, but the specific techniques inside each one keep changing, and the gateway absorbs that shift in stride and at scale.
Extending the Shared Vocabulary
OWASP’s Top 10 gives agentic risks a shared vocabulary built for a threat surface that didn’t exist a few years ago. CIS Controls are the vocabulary security teams already trust for everything else, and connecting the two is exactly where Cequence has been putting its effort. In December 2025, Cequence joined the Center for Internet Security (CIS) to develop a companion guide extending the CIS Critical Security Controls into AI environments. The guide covers Model Context Protocol deployments specifically, including risks like credential exposure, ungoverned local execution, and uncontrolled data flows between models and tools. This partnership puts agent identity and MCP-specific risk inside the same trusted structure CIS Controls already provide, instead of leaving practitioners to evaluate a newer, separate body of guidance on its own. It reflects a point Cequence has been making about agentic AI generally: trust comes down to visibility, governance, and control over what an agent can see and do inside an organization’s applications and data.
Between the OWASP mapping above and the CIS Controls guidance, the pattern is consistent: agentic AI risk gets easier to manage once it’s described in language security teams already trust, with real controls enforcing every item on the list.
