For Heads-of · Practitioner
OWASP Top 10 for Agentic Applications
Also known as: OWASP Agentic Top 10 · OWASP ASI Top 10
OWASP's list of the ten most critical security risks specific to autonomous AI agents, published in December 2025. It complements the OWASP Top 10 for LLM Applications by covering what only goes wrong when a model acts: hijacked goals, misused tools, poisoned memory and failures that cascade between agents.
- OWASP
- AI agents
- ASI01
- agent security
- goal hijack
- memory poisoning
The ten
- ASI01 Agent Goal Hijack
- ASI02 Tool Misuse and Exploitation
- ASI03 Identity and Privilege Abuse
- ASI04 Agentic Supply Chain Vulnerabilities
- ASI05 Unexpected Code Execution
- ASI06 Memory and Context Poisoning
- ASI07 Insecure Inter-Agent Communication
- ASI08 Cascading Failures
- ASI09 Human-Agent Trust Exploitation
- ASI10 Rogue Agents
How it relates to the LLM Top 10
Every agent is also an LLM application, so the OWASP Top 10 for LLM Applications still applies. The agentic list adds the risks that come from autonomy, tools, memory and communication between agents. Excessive agency (LLM03) is the bridge between the two lists, and integrations built on the Model Context Protocol are where several of these risks arrive.
Using it
Use it as the coverage check for any agent deployment and as the scope for testing one. Its themes map to the register's excessive agency in autonomous agents and inadequate human oversight design, and to human-in-the-loop review on irreversible actions.
Sources
Related Terms
Agent Goal Hijack
Redirecting an AI agent's objective or plan, usually by placing instructions in content the agent reads, so that it pursues the attacker's goal with its own tools and permissions. It is the agentic form of prompt injection and the first item in OWASP's Top 10 for Agentic Applications (ASI01).
Agent2Agent Protocol (A2A)
An open protocol for AI agents from different vendors and frameworks to discover each other, describe what they can do and delegate tasks to one another. Google launched it in April 2025 and donated it to the Linux Foundation in June 2025.
Agentic AI
An AI system that pursues a goal by deciding for itself which actions to take, in what order, using tools and other systems it has been given access to, with a person checking some or none of the steps. The governance change is that the unit of risk stops being a single output and becomes a sequence of actions with consequences.
Excessive Agency
Giving an LLM-based system more functions, permissions or autonomy than its task needs, so that a manipulated or mistaken output becomes a damaging action. It is LLM03 in the OWASP Top 10 for LLM Applications 2026, up from sixth place in 2025.
Lethal Trifecta
Simon Willison's name for the combination of three capabilities that makes an AI agent exploitable for data theft: access to private data, exposure to untrusted content, and the ability to communicate externally. An agent with all three can be made to send private data to an attacker.
Memory Poisoning
Corrupting what an AI agent remembers or retrieves, so that later sessions, possibly other users' sessions, behave as the attacker wants. Unlike a one-off prompt injection it persists, and OWASP lists it among the top risks for agentic applications (ASI06).
Model Context Protocol (MCP)
An open protocol for connecting AI applications to external tools and data through servers that expose tools, resources and prompts. It has become the standard way to give an AI agent access to other systems, which makes its trust model the agent's attack surface: every connected server can steer the model as well as serve it.
OWASP Top 10 for LLM Applications
The OWASP GenAI Security Project's ranked list of the ten most critical security risks in applications built on large language models. The 2026 edition, published in August 2026, is the closest thing the field has to a shared vocabulary for LLM application security, and every item on it maps to an entry in this site's risk register.