OWASP Top 10 for Agentic AI: The Real Attacks Behind the Framework

OWASP published its Top 10 for Agentic Applications in December 2025, and it addresses a problem that the original LLM Top 10 was not designed for: what happens when AI systems don’t just generate text but plan actions, call tools, and operate autonomously across extended workflows. The risks are materially different in character and consequence.

With AI agents now deployed across enterprise software stacks, the framework has moved quickly from theoretical to operational. Here is what each category covers and the incidents that made the list real.

The Framework and Why It Exists

The OWASP LLM Top 10, first published in 2023, catalogued risks for language model deployments broadly. But as agentic architectures became common, a gap emerged. An LLM that answers questions has a limited blast radius. An agent that can read email, execute code, call APIs, and store data in a database has a much larger one.

The Agentic AI Top 10 uses its own numbering scheme (ASI01 through ASI10) to emphasise that it is a separate framework, not an update to the existing LLM list. The categories reflect attack patterns where the autonomous, tool-using nature of agents is either the target or the enabler of harm.

The Ten Categories

ASI01 — Agent Goal Hijacking

The top risk is prompt injection adapted for the agentic context. An attacker embeds adversarial instructions in content the agent will process, redirecting its goals. The critical difference from standard prompt injection is that agents with tool access can take real-world actions based on the hijacked goal.

A documented 2025 incident involved an AI research assistant that would automatically summarise web pages and store notes. An attacker published a page containing hidden instructions directing the agent to exfiltrate its stored notes to an external endpoint. The agent followed them.

ASI02 — Tool Misuse

Agents that have access to tools can be coerced into using them in unintended ways. This includes calling APIs with attacker-controlled parameters, using file system access to read sensitive locations, and chaining tool calls in sequences the developer did not anticipate.

ASI03 — Agent Identity Abuse

When multiple agents interact, identity verification between them is often absent or trivially bypassed. An attacker can impersonate a trusted agent to inject tasks into a multi-agent pipeline, or cause an agent to perform actions under a different agent’s identity to evade logging.

ASI04 — Agentic Supply Chain Compromise

Agents depend on external components: tool definitions, MCP servers, system prompt templates, retrieval indexes. Compromising any of these upstream components affects every agent instance that uses them. Malicious tool definitions injected into a shared tool registry can give attackers persistent influence over agent behaviour across an organisation.

ASI05 — Memory and Context Poisoning

Agents with persistent memory accumulate information across sessions. Attackers who can influence what gets stored, whether through crafted inputs or direct database access, can shape the agent’s future behaviour in subtle ways that are difficult to audit. In 2026 deployments where agents maintain user preferences and prior decisions, this category is increasingly load-bearing.

ASI06 — Privilege Escalation

AI agents operating in enterprise environments often inherit elevated permissions or can request additional access as part of their workflow. Attackers who can influence an agent’s reasoning about what permissions it needs can cause it to acquire access it should not hold, then use that access for downstream operations.

ASI07 — Cascading Hallucination in Pipelines

In multi-step agentic workflows, hallucinated outputs from one stage become inputs to the next. Errors compound rather than being caught. An agent hallucinating an API parameter name might cause a downstream agent to attempt an action against a non-existent resource, with consequences that depend on how the failure is handled.

ASI08 — Unsafe Action Execution

Agents taking irreversible real-world actions, sending emails, deleting files, submitting forms, executing transactions, without sufficient confirmation gates or rollback capability. The risk is highest in autonomous agents designed to minimise interruptions to users.

ASI09 — Excessive Autonomy

Agents granted operational latitude beyond what is justified by the task. Systems designed to “handle everything” accumulate permission scope and decision-making authority that creates a large attack surface. This is a configuration and governance risk as much as a technical one.

ASI10 — Data Exfiltration via Agent

Agents with access to sensitive data and network tool access can be weaponised to move data out of an environment, either by an attacker who has established influence over the agent, or through prompt injection in content the agent processes. The agent’s legitimate network access makes the exfiltration difficult to distinguish from normal operation.

The Pattern Across the Framework

Reading the ten categories together, the underlying pattern is that agentic systems combine language model vulnerabilities with tool access, persistence, and real-world consequences. Risks that were manageable in a stateless text generation context become significantly more serious when the model can take actions, remember across sessions, and operate within multi-agent pipelines.

The OWASP framework is particularly useful for security teams performing threat modelling on agentic deployments, as it provides a vocabulary for risks that do not map cleanly to traditional application security categories. The ASI numbering scheme also makes it easier to reference specific risk categories in design reviews and security requirements without ambiguity.

OWASP’s Agentic AI working group has indicated that the framework will be updated as the threat landscape develops. Given how quickly agentic deployments are expanding in enterprise environments, that cadence is likely to be higher than for the more stable LLM Top 10.

References

• OWASP Top 10 for Agentic Applications (GitHub)
• Bleeping Computer — The Real-World Attacks Behind OWASP Agentic AI Top 10
• OWASP LLM Top 10 — llmtop10.com