Agent Goal Hijack
Untrusted content or context redirects the agent away from the intended objective.
First controls
- Separate instructions from data.
- Track goal changes.
- Require policy validation before action.
OWASP Top 10 for Agentic Applications 2026
Table of Contents
Quick Answer
The OWASP Top 10 for Agentic Applications 2026 is a security framework for AI systems that can plan, use tools, retain memory, communicate and take actions. It expands beyond ordinary LLM risks to cover goals, identities, privileges, supply chains, code execution, persistent context, cascading failures, human trust and rogue behavior.
What Is the OWASP Agentic Applications Top 10?
The framework identifies ten important risk areas for agentic applications. These systems do more than generate text: they may plan multi-step tasks, select tools, access private data, act through APIs, store memory, coordinate with other agents, and continue working with limited supervision.
Why AI Agents Need a Separate Risk List
A conventional chatbot mainly produces output. An agent can create operational impact. A wrong answer is a quality issue; a wrong tool call can delete data, expose records, send a message, change permissions, spend money, or start a cascading workflow. Agent security therefore requires identity, execution, recovery and governance controls beyond prompt filtering.
The 10 Agentic Application Risks
Use this catalogue to scan the full framework. Each risk keeps its plain-language meaning visible, while the first defensive controls remain available without turning the article into ten permanently expanded panels.
Tool Misuse
A legitimate tool is used in an unsafe, excessive or unintended way.
First controls
- Least privilege.
- Argument validation.
- Approval for high-impact tools.
Identity and Privilege Abuse
Agents or users act with excessive, inherited or confused authority.
First controls
- Separate user, agent and service identities.
- Use short-lived credentials.
- Recheck resource authorization.
Agentic Supply-Chain Vulnerabilities
Models, tools, skills, plugins, MCP servers or dependencies introduce risk.
First controls
- Approved sources.
- Version pinning.
- Change review and revocation.
Unexpected Code Execution
Agent workflows cause code or command execution outside intended boundaries.
First controls
- Sandboxing.
- No raw model-to-shell path.
- Restricted interpreters and filesystems.
Memory and Context Poisoning
Persistent context stores unsafe, stale or attacker-controlled information.
First controls
- Source provenance.
- Tenant isolation.
- Review, quarantine and deletion.
Insecure Inter-Agent Communication
Agents trust messages, identities or requests from other agents without sufficient checks.
First controls
- Authenticate agents.
- Authorize messages and resources.
- Validate message schemas.
Cascading Failures
One incorrect decision or compromised agent triggers failures across connected systems.
First controls
- Limit blast radius.
- Use circuit breakers.
- Design rollback and recovery.
Human-Agent Trust Exploitation
People approve or trust agent output without understanding the action or evidence.
First controls
- Clear approval screens.
- Show impact and data.
- Avoid dark patterns and urgency.
Rogue Agents
An agent operates outside intended governance, policy or ownership.
First controls
- Strong inventory.
- Behavior monitoring.
- Kill switch and credential revocation.
Agentic risk coverage map
| Group | Risks |
|---|---|
| Goal, tool and identity risks | 3 |
| Supply chain and execution | 2 |
| Memory and communication | 2 |
| Systemic, human and rogue risks | 3 |
OWASP LLM Top 10 vs Agentic Applications Top 10
| LLM application focus | Agentic addition |
|---|---|
| Prompt and output risk | Goal and action risk |
| Sensitive information | Persistent memory and cross-agent flow |
| Excessive agency | Detailed tool, identity and privilege failures |
| Supply-chain weakness | Dynamic agents, skills, tools and MCP ecosystems |
| Improper output handling | Cascading operational actions |
| Misinformation | Human trust and approval failures |
Agent-Security Standards and Incident Timeline
Milestones showing how the agentic framework, standards work, research and incident evidence developed.
OWASP GenAI Security Project
OWASP released the Agentic Applications Top 10
The framework consolidated risks unique to systems that plan, use tools, retain memory and act with delegated authority.
OWASP releaseNIST
NIST launched an AI Agent Standards Initiative
The initiative added standards, interoperability, identity and secure-agent infrastructure to the public policy agenda.
NIST announcementUnit 42
In-the-wild indirect prompt injection was reported
Security researchers documented malicious web content targeting AI review and agent workflows, demonstrating that external content is an active control boundary.
Unit 42 reportOWASP GenAI Security Project
OWASP mapped real incidents to agentic risks
The Q1 round-up connected agent failures, identity abuse, tool misuse and MCP exploitation to concrete defensive lessons.
OWASP incident round-up
Recent Agent-Security Incident Lessons
Three recent incident patterns highlight recurring controls for destructive actions, inherited identity and executable configuration boundaries.
Inbox deletion failure
Destructive permissions need hard confirmation, reliable stop controls and reversible actions. A natural-language request should never be the only safety boundary.
Inherited cloud identity
Agent deployments can inherit powerful service credentials. Review default scopes, cross-project access and resource-level authorization.
CustomMCP exploitation
Agent configuration is a code and supply-chain boundary. Validate, patch and restrict orchestration features that can execute or load custom capabilities.
Control Priorities
- Separate user, agent and service identities.
- Keep authorization and business policy outside the model.
- Use least-privilege tools with strict argument schemas.
- Isolate memory by user and tenant, with provenance and deletion controls.
- Require explicit approval for high-impact and irreversible actions.
- Log plans, tool calls, approvals, results and policy decisions.
- Provide circuit breakers, revocation, rollback and a tested kill switch.
30/60/90-Day Adoption Plan
| Window | Priority actions |
|---|---|
| First 30 days | Inventory agents, tools, identities and data; classify actions by impact; remove unnecessary write/delete access; require approval for privileged operations. |
| By 60 days | Add deterministic policy enforcement; validate tool arguments; separate memory by user and tenant; centralize tool-call and approval logs. |
| By 90 days | Test indirect prompt injection, identity and scope boundaries, rollback and kill switches; review third-party agent components and MCP servers. |
Explore AI Security Topics
AI Agent SecurityControl agent identity, tools, memory, approvals, monitoring, and recovery.MCP SecuritySecure MCP hosts, clients, servers, authorization, tools, resources, and audits.MCP Tool PoisoningPrevent unsafe tool descriptions, schemas, updates, shadowing, and results.OWASP LLM Top 10Use the OWASP LLM Top 10 as a risk map for GenAI application security.Indirect Prompt Injection in AgentsRecent evidence, attack surfaces, layered defenses, and response guidance.LLM Security ChecklistReview LLM apps, RAG, agents, MCP, tools, monitoring, and approvals.
FAQs
It is an OWASP security framework for applications where AI agents can plan, use tools, retain memory, communicate, and take actions. It highlights ten important risk areas for agentic systems.
The LLM Top 10 focuses on language-model application risks. The Agentic Top 10 adds deeper coverage of goals, tools, identity, privileges, memory, inter-agent communication, cascading actions, human trust, and rogue behavior.
Agent goal hijacking occurs when untrusted content, context, memory, or instructions redirect an agent away from the user’s intended objective.
A rogue agent behaves outside intended governance or policy, whether because of compromised instructions, unsafe autonomy, faulty controls, or deliberate misuse.
Some risks may apply, but the framework is most relevant when a system can use tools, memory, identities, workflows, or autonomous actions beyond text generation.
Start by inventorying agents, tools, identities and data, then remove unnecessary permissions, require approval for high-impact actions, validate tool calls outside the model, and centralize logging and rollback.
Sources and further reading
- OWASP Top 10 for Agentic Applications 2026 — Official agentic application risk framework
- OWASP Agentic Applications Top 10 Release — Release context and risk names
- OWASP Agentic AI Threats and Mitigations — Threat modeling and defensive controls
- NIST AI Agent Standards Initiative — Agent identity, interoperability and security standards work
- OWASP GenAI Incident Exploit Round-Up Q1 2026 — Recent agentic incident and exploit lessons