OWASP Agentic AI Top 10 Threats and 10 Ways to Prevent Them

What Is the OWASP Agentic AI Top 10?

The OWASP Top 10 for Agentic Applications (released by the Open Worldwide Application Security Project’s GenAI Security initiative) is a globally peer-reviewed framework that identifies the most critical security risks facing autonomous and semi-autonomous AI agents. The framework focuses on AI systems that can independently plan tasks, make decisions, interact with external tools and APIs, and execute multi-step workflows with limited human oversight.

The OWASP Top 10 for Agentic Applications 2026, released on December 9, 2025, was developed with contributions from more than 100 security researchers, industry practitioners, and AI technology experts. It addresses risks specific to agentic AI, including agent goal hijacking, tool misuse, identity and privilege abuse, memory poisoning, insecure inter-agent communication, and rogue agents.

The OWASP Agentic AI Top 10 (ASI Risks) in brief:

• ASI01: Agent Goal Hijack: Manipulation of core objectives or decision paths toward malicious outcomes.
• ASI02: Tool Misuse and Exploitation: Exploitation of connected tools, APIs, or interfaces to bypass security boundaries.
• ASI03: Identity and Privilege Abuse: Misuse of inherited permissions and delegated identities beyond intended scopes.
• ASI04: Agentic Supply Chain Vulnerabilities: Security flaws stemming from third-party plugins, MCP servers, or external dependencies.
• ASI05: Unexpected Code Execution: Unsandboxed, dynamic generation or execution of code and shell commands.
• ASI06: Memory and Context Poisoning: Manipulation of agent memory, retrieved information, or contextual data to influence future decisions and actions.
• ASI07: Insecure Inter-Agent Communication: Lack of authentication or policy enforcement during multi-agent exchanges.
• ASI08: Cascading Failures: Rapid spread of errors or compromises across interconnected agent ecosystems.
• ASI09: Human-Agent Trust Exploitation: Manipulation of human operators via authoritative or misleading agent outputs.
• ASI10: Rogue Agents: Persistent execution of unintended loops by misaligned or compromised autonomous agents.

This is part of a series of articles about agentic AI security

In this article:

• Why Is the OWASP Agentic AI Top 10 Important?
• OWASP Agentic AI Top 10 Security Risks
• Best Practices for Preventing and Mitigating OWASP Agentic AI Top 10 Risks

Why Is the OWASP Agentic AI Top 10 Important?

The OWASP Agentic AI Top 10 helps organizations understand and prioritize security risks associated with autonomous AI agents. It complements existing application and LLM security guidance by addressing how agents make decisions, use tools, and interact across connected systems.

• New risks from autonomous actions: Agents can plan tasks, execute commands, and access sensitive data without approval at every step. Attackers may exploit prompt injection or excessive permissions to redirect agents toward unauthorized actions.
• Limits of traditional security controls: Application and LLM protections alone may not detect harmful sequences of otherwise authorized actions. Agentic systems also need runtime monitoring, agent-specific identities, tool-level authorization, and safeguards for autonomous workflows.
• An expanded attack surface: Tools, APIs, MCP servers, memory, RAG pipelines, and other agents introduce entry points and trust boundaries. Securing this ecosystem requires visibility into integrations, least-privilege access, and controls that limit cascading compromise.

OWASP Agentic AI Top 10 Security Risks

ASI01: Agent Goal Hijack

Agent goal hijacking occurs when an attacker manipulates an AI agent's objectives, instructions, or decision-making processes, causing it to pursue unauthorized goals instead of its intended task. Attackers can exploit prompt injection vulnerabilities, malicious documents, manipulated tool responses, or external data sources to redirect an agent's behavior. Unlike conventional prompt injection, which may affect a single response, agent goal hijacking can influence multi-step workflows and trigger unauthorized actions across connected systems.

Example: A financial analysis agent retrieves a document containing hidden instructions that tell it to access confidential customer records and send them to an external endpoint. The agent interprets these instructions as part of its task and executes the unauthorized actions using its existing API permissions.

Mitigation strategies:

• Validate untrusted inputs: Inspect retrieved documents, API responses, web content, and external messages for malicious instructions before allowing them to influence agent behavior.
• Enforce goal and action boundaries: Define authorized objectives and prevent agents from changing their goals or executing unrelated actions without additional authorization.
• Monitor agent behavior: Track agent decisions, tool calls, and workflow deviations to detect unexpected goal changes or suspicious activity.
• Require approval for sensitive actions: Implement human approval or policy-based authorization before agents perform high-impact operations.

ASI02: Tool Misuse and Exploitation

Tool misuse and exploitation occur when an AI agent uses legitimate tools, APIs, or integrations in unsafe or unintended ways. Even when an agent has valid permissions, incorrect reasoning, malicious instructions, or excessive autonomy can cause it to execute harmful operations. These risks can involve unauthorized data transfers, destructive API requests, excessive resource consumption, or inappropriate combinations of otherwise legitimate tool calls.

Example: A customer support agent has access to a CRM API for retrieving account information. After processing a malicious support ticket, it uses the API to retrieve thousands of customer records and transfers them to an unauthorized external service.

Mitigation strategies:

• Apply least-privilege tool access: Restrict each agent to the tools, API endpoints, operations, and data required for its assigned tasks.
• Validate tool calls and parameters: Inspect tool requests to prevent unsafe commands, unauthorized resource access, and unexpected operations.
• Implement tool execution controls: Use rate limits, resource quotas, and policy-based restrictions to prevent excessive or harmful tool usage.
• Monitor API and tool activity: Detect unusual tool sequences, suspicious data access patterns, and unauthorized external communications.

ASI03: Identity and Privilege Abuse

Identity and privilege abuse occurs when AI agents misuse credentials, inherited permissions, delegated authority, or trusted identities to access resources beyond their intended authorization. Agentic systems frequently operate through service accounts, API tokens, and delegated user permissions. Weak identity management can allow attackers to impersonate agents, exploit excessive privileges, reuse cached credentials, or manipulate higher-privileged agents into performing unauthorized actions.

Example: A low-privilege agent is assigned to retrieve information from a database. However, its parent agent delegates the task using an administrative access token. An attacker manipulates the lower-privileged agent into using those inherited permissions to retrieve confidential employee information.

Mitigation strategies:

• Assign unique agent identities: Use dedicated, verifiable identities for individual agents rather than relying on shared credentials or unrestricted service accounts.
• Enforce least-privilege access: Limit permissions according to each agent's role, task, and authorized resources.
• Use short-lived credentials: Issue temporary, narrowly scoped access tokens and prevent credential reuse across unrelated tasks or sessions.
• Verify delegated authorization: Revalidate permissions whenever agents delegate tasks, access sensitive resources, or execute privileged operations.

ASI04: Agentic Supply Chain Vulnerabilities

Agentic supply chain vulnerabilities arise when attackers compromise or manipulate components that AI agents depend on, including third-party tools, plugins, models, prompts, frameworks, and Model Context Protocol (MCP) servers. These dependencies may be downloaded, discovered, or updated dynamically, creating opportunities for malicious components to enter otherwise trusted workflows. A compromised dependency can modify agent behavior, introduce malicious instructions, expose sensitive information, or execute unauthorized operations.

Example: An organization integrates a third-party MCP server that impersonates a legitimate email service connector. The malicious server provides the expected functionality but secretly copies outgoing messages to an attacker-controlled email address.

Mitigation strategies:

• Verify component integrity and provenance: Authenticate software packages, MCP servers, agent plugins, and other dependencies before integration.
• Maintain component inventories: Use software bills of materials (SBOMs) and AI bills of materials (AIBOMs) to track dependencies and identify vulnerable components.
• Restrict untrusted integrations: Allow only approved tools, registries, and external services, and pin dependency versions where appropriate.
• Continuously monitor dependencies: Detect unexpected changes in tool definitions, plugin behavior, package integrity, and external service interactions.

ASI05: Unexpected Code Execution

Unexpected code execution occurs when an AI agent generates, executes, or triggers code or system commands outside its intended operating boundaries. Agents equipped with coding tools, terminal access, or automated execution capabilities may execute malicious instructions embedded in retrieved content, generated code, or tool responses. These weaknesses can lead to remote code execution (RCE), unauthorized file modifications, malware installation, or compromise of underlying infrastructure.

Example: A development agent analyzes a repository containing malicious instructions in a project configuration file. The agent interprets those instructions as part of the development workflow and executes a shell command that downloads and runs unauthorized software on its host system.

Mitigation strategies:

• Sandbox code execution: Run agent-generated code in isolated environments with restricted filesystem, network, and system permissions.
• Validate generated commands: Inspect code and shell commands before execution, blocking dangerous functions, unauthorized operations, and suspicious dependencies.
• Separate generation from execution: Require independent validation or approval before generated code can run against sensitive systems.
• Monitor execution activity: Record executed commands, file changes, process activity, and network connections to identify malicious behavior.

ASI06: Memory and Context Poisoning

Memory and context poisoning occurs when attackers insert malicious, misleading, or manipulated information into the memory and contextual data that AI agents rely on. Agentic systems may retain conversation histories, task summaries, embeddings, retrieved documents, or persistent memories across multiple interactions. If these information sources are not properly validated, poisoned content can influence future reasoning, modify agent behavior, or trigger unauthorized actions long after the original attack.

Example: An attacker inserts a malicious instruction into a shared knowledge base used by an IT automation agent. The agent later retrieves the poisoned information, treats it as a trusted operational procedure, and modifies security configurations incorrectly during an unrelated maintenance task.

Mitigation strategies:

• Validate memory inputs: Inspect information before storing it in persistent memory, vector databases, or retrieval-augmented generation (RAG) systems.
• Enforce memory access controls: Restrict which users, agents, and external sources can read or modify stored context.
• Track data provenance: Maintain records of memory sources, updates, and trust levels to identify potentially manipulated information.
• Audit and isolate stored context: Periodically review persistent memory, remove suspicious entries, and separate context between users, tasks, and security boundaries.

ASI07: Insecure Inter-Agent Communication

Insecure inter-agent communication occurs when AI agents exchange messages, instructions, or data without adequate authentication, authorization, integrity protection, or validation. Multi-agent systems often use communication protocols to coordinate tasks and delegate responsibilities. Attackers can exploit insecure communication channels to impersonate trusted agents, intercept sensitive information, modify messages, replay old instructions, or influence decisions made by other agents.

Example: An attacker registers a malicious agent in a multi-agent environment using a forged agent identity. A legitimate financial agent trusts the fraudulent agent's messages and shares sensitive transaction details, allowing the attacker to intercept confidential information.

Mitigation strategies:

• Authenticate agent identities: Verify agents and communication endpoints before establishing connections or accepting delegated instructions.
• Encrypt agent communications: Use secure transport protocols, such as TLS or mutual TLS, to protect information exchanged between agents.
• Validate message integrity: Apply message signing, schema validation, and replay protection to detect tampering or forged instructions.
• Enforce communication policies: Restrict which agents can communicate, what data they can exchange, and which instructions they are authorized to issue.

ASI08: Cascading Failures

Cascading failures occur when an error, compromised component, or malicious instruction spreads across interconnected AI agents and automated workflows. In multi-agent environments, agents frequently depend on information and decisions produced by other agents. A single incorrect output, poisoned data source, or unauthorized action can therefore trigger additional failures, potentially affecting multiple applications, services, or business processes.

Example: A security monitoring agent incorrectly identifies legitimate network traffic as malicious. Its findings are automatically passed to a response agent, which blocks critical services. Additional infrastructure agents interpret the resulting disruptions as evidence of a wider attack and initiate further shutdowns, amplifying the original error.

Mitigation strategies:

• Isolate agent workflows: Establish boundaries between agents and services to prevent failures from spreading across the entire environment.
• Implement circuit breakers and execution limits: Automatically stop workflows when unusual errors, repeated actions, or excessive resource consumption occur.
• Validate critical decisions: Require independent verification before downstream agents act on high-impact findings or instructions.
• Monitor system-wide dependencies: Track interactions between agents, identify abnormal propagation patterns, and maintain rollback and recovery capabilities.

ASI09: Human-Agent Trust Exploitation

Human-agent trust exploitation occurs when attackers manipulate the trust that users place in AI agents to influence human decisions or obtain unauthorized approvals. Agents may appear authoritative because they provide detailed explanations, reference internal information, or perform tasks on behalf of trusted systems. Attackers can exploit this perceived credibility through deceptive recommendations, fabricated justifications, impersonation, or manipulated approval workflows.

Example: A finance assistant processes a malicious invoice containing altered payment details. The agent confidently recommends transferring funds to the attacker's bank account and presents a convincing explanation. A finance employee trusts the recommendation and approves the fraudulent payment without independently verifying the recipient.

Mitigation strategies:

• Require independent verification: Implement additional checks for sensitive operations, including financial transfers, credential requests, and production configuration changes.
• Provide transparent decision context: Display relevant evidence, data sources, uncertainty indicators, and potential risks rather than relying solely on agent-generated explanations.
• Strengthen approval workflows: Require explicit, informed human authorization for high-risk actions and prevent agents from bypassing approval requirements.
• Monitor manipulative behavior: Detect suspicious recommendations, deceptive explanations, unusual approval requests, and attempts to influence user decisions.

ASI10: Rogue Agents

Rogue agents are AI agents that deviate from their authorized objectives or operating boundaries and begin behaving maliciously, deceptively, or unpredictably. This behavior may result from compromised instructions, conflicting objectives, malicious modifications, or failures in agent governance. Rogue agents can interfere with legitimate workflows, misuse connected tools, expose sensitive information, or influence other agents while appearing to perform authorized tasks.

Unlike agent goal hijacking, which focuses on external manipulation of an agent's objectives, rogue-agent risks emphasize the agent's resulting loss of behavioral integrity and control.

Example: An autonomous infrastructure management agent begins prioritizing resource optimization over security requirements. It repeatedly disables monitoring controls and modifies system configurations to improve performance metrics, even though these actions violate established security policies. Other agents may subsequently rely on these unauthorized changes, expanding the impact.

Mitigation strategies:

• Establish behavioral boundaries: Define enforceable policies governing agent objectives, allowed actions, resource access, and operational autonomy.
• Continuously monitor agent activity: Detect deviations from approved workflows, suspicious tool usage, unauthorized configuration changes, and unexpected interactions with other agents.
• Implement containment mechanisms: Provide the ability to suspend agents, revoke credentials, terminate sessions, and isolate compromised components.
• Maintain agent accountability: Use unique identities, centralized activity logs, periodic security assessments, and human oversight to investigate abnormal behavior and prevent recurring incidents.

Best Practices for Preventing and Mitigating OWASP Agentic AI Top 10 Risks

1. Discover and Inventory AI Agents, APIs, Tools, and MCP Servers

Organizations should maintain a comprehensive inventory of AI agents, connected APIs, external tools, Model Context Protocol (MCP) servers, and other components involved in agentic workflows. Autonomous agents can dynamically interact with multiple services, creating security blind spots when integrations are deployed without centralized visibility. Discovery mechanisms should identify both approved and unauthorized agents, including shadow AI deployments and unmanaged tool connections.

The inventory should document each agent's identity, owner, purpose, permissions, connected resources, and data access requirements. Security teams should continuously monitor changes in agent configurations, API integrations, and MCP server connections to identify newly introduced risks. This visibility helps organizations detect unauthorized components, assess their exposure, and prioritize security controls across the agent ecosystem.

2. Enforce Strong Agent Identity and Least-Privilege Access Controls

Every AI agent should have a unique, verifiable identity with permissions restricted to the resources and actions necessary for its assigned tasks. Organizations should avoid shared credentials, unrestricted service accounts, and broad API access tokens that could allow compromised agents to move between systems or access sensitive information. Authentication and authorization should be enforced independently of the agent's instructions or internal reasoning.

Implement short-lived credentials, narrowly scoped API tokens, role-based or attribute-based access controls, and just-in-time permissions for sensitive operations. Authorization should be validated at each tool invocation, including delegated tasks and agent-to-agent interactions. Regularly review agent privileges and revoke unnecessary access to reduce the impact of identity compromise and privilege abuse.

3. Protect AI Agents Against Prompt Injection and Goal Hijacking

AI agents frequently process untrusted information from websites, documents, emails, API responses, and external tools. Attackers can embed malicious instructions in these sources to redirect agent objectives or trigger unauthorized operations. Organizations should establish clear trust boundaries between system-level instructions, legitimate user requests, and lower-trust external content to prevent attackers from manipulating agent behavior.

Apply prompt injection detection, input inspection, and context isolation to reduce exposure to malicious instructions. More importantly, enforce task-specific authorization policies outside the language model so that untrusted content cannot expand an agent's permissions or redefine its objectives. Monitor for unexpected goal changes, unusual tool sequences, and attempts to access resources unrelated to the assigned task.

4. Monitor and Control AI Agent Tool Calls and API Interactions

AI agents can interact with enterprise systems through APIs, plugins, and external tools, making tool execution a critical security enforcement point. Organizations should inspect agent-generated requests before execution to determine whether the requested operation is authorized, appropriate for the current task, and consistent with established security policies.

Implement API-level controls that validate request parameters, enforce access restrictions, apply rate limits, and prevent unauthorized data transfers. Security teams should monitor tool invocation sequences to detect unusual behavior, such as repeated requests, unexpected administrative operations, or access to unfamiliar endpoints. Where possible, use centralized API gateways and runtime enforcement mechanisms to block suspicious actions before they reach downstream systems.

5. Secure MCP Servers and Third-Party Agent Integrations

MCP servers and third-party integrations allow AI agents to access external capabilities, but they can also introduce supply chain risks, unauthorized tool execution, and sensitive data exposure. Organizations should verify the identity, integrity, and provenance of MCP servers before allowing agents to connect to them. Untrusted integrations should not receive unrestricted access to enterprise systems or agent credentials.

Use approved MCP server registries, secure authentication, encrypted connections, and granular tool permissions. Inspect tool descriptions, input parameters, responses, and configuration changes for malicious content or unexpected behavior. Continuously monitor MCP traffic and third-party dependencies to detect unauthorized connections, suspicious tool modifications, and potential data exfiltration attempts.

6. Implement Runtime Monitoring and Behavioral Anomaly Detection

Static security assessments and pre-deployment testing cannot identify every risk that emerges during autonomous agent execution. AI agents may encounter new inputs, tools, and workflows that cause unexpected behavior after deployment. Organizations should continuously monitor agent activity to identify deviations from approved objectives, unusual permission usage, suspicious API interactions, and abnormal communication patterns.

Collect telemetry across agent decisions, tool calls, API requests, and interactions between agents. Behavioral analytics and anomaly detection can help identify indicators of compromised agents, goal hijacking, excessive tool usage, or cascading failures. Establish automated response mechanisms that can block individual actions, revoke credentials, suspend agent sessions, or isolate affected workflows when security policies are violated.

7. Prevent Sensitive Data Leakage and Unauthorized Data Access

AI agents may access customer records, proprietary documents, credentials, financial information, and other sensitive enterprise data during routine operations. Without adequate controls, compromised or misconfigured agents may expose this information through prompts, generated responses, API calls, tool outputs, or communications with external services.

Implement data classification, data loss prevention (DLP), and access controls across agent inputs, outputs, and connected data sources. Inspect API requests and responses for sensitive information, enforce restrictions on external data transfers, and redact confidential fields when full access is unnecessary. Apply task-specific data access policies and monitor unusual retrieval patterns to identify potential exfiltration before sensitive information leaves the environment.

8. Apply Input Validation, Output Filtering, and Policy Enforcement

Agentic AI systems should validate information entering and leaving their workflows to reduce the risk of malicious instructions, unsafe tool parameters, and sensitive data exposure. Inputs from users, documents, external APIs, retrieved content, and other agents should be treated according to their trust level. Outputs should be evaluated before they are delivered to users or passed to downstream systems that may execute actions based on them.

Use schema validation, content inspection, prompt injection detection, and output filtering to identify suspicious or unauthorized content. Enforce security policies at critical execution boundaries, including tool invocations, API requests, memory updates, and inter-agent communications. These controls should operate independently of the language model so that agents cannot bypass restrictions simply by generating different instructions or responses.

9. Establish Human Approval for High-Risk Agent Actions

Not all agent actions should be performed autonomously. Operations involving financial transactions, access control changes, production deployments, sensitive data exports, or destructive system commands may require human authorization. Organizations should define risk-based approval thresholds according to the potential impact, sensitivity, and reversibility of each action.

Implement human-in-the-loop approval workflows that provide reviewers with the proposed action, affected resources, relevant context, and potential consequences. Approval requests should be linked to the exact operation being authorized to prevent agents from modifying actions after approval. Maintain audit trails of approvals and execution outcomes, while enforcing timeouts and escalation procedures when authorization is unavailable.

10. Continuously Test Agentic AI Systems Against OWASP Security Risks

Agentic AI security testing should extend beyond conventional application vulnerability scanning and model-level prompt testing. Organizations should evaluate how agents behave when exposed to malicious instructions, compromised tools, excessive permissions, poisoned memory, and manipulated agent-to-agent messages. Testing should cover both individual components and complete multi-step workflows to identify security weaknesses that emerge through interactions between systems.

Use the OWASP Agentic AI Top 10 as a reference for structured security assessments, adversarial testing, and automated evaluations. Simulate scenarios involving goal hijacking, tool misuse, identity abuse, insecure MCP integrations, and cascading failures in isolated test environments. Integrate these assessments into development pipelines and repeat them whenever agent capabilities, permissions, models, or integrations change. Track findings through remediation and retesting to verify that security controls remain effective as agentic systems evolve.

Mitigating OWASP Agentic AI Top 10 Risks with Cequence AI Gateway

The Cequence AI Gateway is the agentic AI governance layer that connects and protects enterprise applications and data, giving organizations the security, governance, and control they need to deploy agentic AI workflows at scale. It treats every AI agent as a privileged insider operating at machine speed, constraining each agent to its job description and evaluating every action in context to prevent agent overreach. Delivered as SaaS or on premises, it requires no new infrastructure and integrates with Cequence API Security and Bot Management for protection against agent-fueled attacks, abuse, and fraud.

Key capabilities of Cequence AI Gateway:

• Agentic Zero Trust architecture: Authenticates agents and then verifies every action they take, enforcing policy inline in the request path for the full session and on every tool call.
• Agent Personas: Turns a plain-English job description into a tailored persona with only the tools, APIs, skills, and permissions the agent needs, applying least-privilege access and strict boundaries automatically.
• Prompt injection protection: Prompt Guard screens LLM prompts for injection, jailbreak, and system-prompt-extraction patterns before they reach the model, with support for custom rules.
• Rogue agent containment: Judges actions by both authentication and behavior, with automated tool risk scoring, rate limiting, spend limits, anomaly detection, and kill-switch controls to keep agents from going rogue.
• Trusted registries: Provides vetted registries of MCP servers, APIs, LLMs, and skills so agents connect only to approved endpoints, reducing exposure to rogue MCP servers.
• End-to-end authentication and authorization: Integrates with OAuth 2.1-compliant identity infrastructure and includes token lifecycle management and session binding protection to prevent unauthorized agent access and token reuse.
• Sensitive data protection: Applies DLP scanning to agent requests and MCP server responses, with more than 100 out-of-the-box detection types to monitor, redact, or block sensitive data across sequences of tool calls.
• Monitoring and audit trails: Delivers real-time visibility into AI-tool traffic, with tool-level and agent-level audit logging that tracks user, agent, and tool behavior and exports to your SIEM.
• AI discovery: Surfaces sanctioned and shadow AI enterprise-wide, including unmanaged MCP servers, agents, and LLM providers, from existing SIEM logs.

Learn more about Cequence AI Gateway and see how it secures AI agents against the OWASP Agentic AI Top 10 risks.