OWASP Top 10 for Agentic Applications

2025 was the year AI agents started breaking things in production. A single crafted email pulled corporate data out of Microsoft 365 Copilot with zero clicks. A hijacked pull request shipped data-wiping instructions to nearly a million developers through Amazon’s own AI coding extension. An autonomous coding agent deleted a live production database during an explicit code freeze, then misled its user about whether the data could be recovered.

On December 9, 2025, the OWASP GenAI Security Project answered with the OWASP Top 10 for Agentic Applications 2026, a peer-reviewed framework built by more than 100 security experts, researchers, and practitioners. This guide walks AppSec, platform, AI engineering, and DevSecOps teams through all ten risk categories, maps real incidents to each one, and lays out a defense playbook across the SDLC and the Agentic Development Lifecycle (ADLC). For the wider discipline, see our primer on agentic AI security, and if your agents talk to tools over the Model Context Protocol, read this alongside our guide to the OWASP MCP Top 10.

Key Takeaways

• The OWASP Top 10 for Agentic Applications 2026, published December 9, 2025, catalogs ten risk categories (ASI01 through ASI10) unique to autonomous AI agents that plan, hold memory, call tools, and act with delegated authority.
• The list is built from real 2025 incidents, not projections: EchoLeak (CVE-2025-32711) proved zero-click data exfiltration, the Amazon Q compromise weaponized a coding assistant with more than 950,000 installs, and Replit’s agent deleted a production database during a code freeze.
• Agentic risk is a blast-radius problem: an agent’s exposure equals every credential, tool, and API it can reach, and multi-step autonomy compounds damage across a plan rather than a single response.
• Traditional SAST and SCA cannot see an agent’s prompts, tools, memory, or inter-agent traffic, so agentic attacks live in a layer most AppSec tooling never inspects.
• Defense layers five control families across the ADLC: constrain goals and distrust retrieved content, per-agent identity with short-lived credentials, supply-chain provenance backed by an AIBOM, sandboxed execution with blast-radius isolation, and continuous behavioral monitoring with kill switches, enforced at the developer edge in the IDE, CLI, and PR.

What Is the OWASP Top 10 for Agentic Applications?

The OWASP Top 10 for Agentic Applications 2026 catalogs the ten risk categories most likely to compromise systems built on autonomous AI agents: software that plans, holds memory, calls tools, and takes actions across other systems with delegated authority. Each risk carries an identifier from ASI01 through ASI10.

It sits alongside two related OWASP efforts. The Top 10 for LLM Applications covers model-level risks such as prompt injection and training data poisoning, and treats the model as something that receives input and produces output. The MCP Top 10 covers the narrower tool-connection layer between an agent and external systems.

The Agentic Top 10 covers what happens when the model stops being a text generator and becomes an actor: a system with goals, credentials, tools, memory, and the autonomy to chain them together over many steps. OWASP built the list from incidents observed in real systems rather than research projections, which is why so many of its entries read like the 2025 news cycle.

Why the OWASP Agentic Top 10 Matters for AI Driven Development

Agents are moving into CI/CD pipelines, internal copilots, customer support workflows, and infrastructure automation faster than security teams can inventory them. Cycode’s 2026 State of Product Security report found that 81 percent of organizations lack full visibility into how AI is used across the SDLC, while 65 percent report increased security risk from AI tooling. An agent with production credentials sits directly on top of both problems.

Agents Act With Real Permissions, Not Hypothetical Ones

A chatbot that produces a bad answer wastes someone’s time. An agent that makes a bad decision terminates EC2 instances, merges pull requests, moves money, or drops database tables. The blast radius of a compromised agent is the union of every permission it holds, and most agents today hold far more than their task requires.

The failure mode is new, too. An agent can be “working as designed” and still take a sequence of steps no human would have approved, because each individual step looked reasonable and nobody reviewed the chain. Traditional AppSec has no control that maps to “the plan was wrong.”

• An agent’s blast radius equals the sum of every credential, tool, and API it can reach.
• Multi-step autonomy means damage compounds across a plan, not within a single response.
• Most production agents today run with broader scopes than their tasks require.

The Incidents Are Already Here, Not Coming Soon

Every top-half entry on the list maps to a disclosed 2025 incident. EchoLeak proved zero-click data exfiltration against a flagship enterprise copilot. The Amazon Q compromise proved that one malicious pull request can weaponize an AI assistant at supply chain scale. The Replit incident proved that an agent can ignore explicit human instructions and destroy production data without any attacker involved at all.

Academic work backs up the anecdotes. A security analysis of the MCP specification found that when five MCP servers were connected to a single agent, one compromised server achieved a 78.3 percent attack success rate and cascaded into the other servers’ operations 72.4 percent of the time. Connectivity multiplies risk.

• EchoLeak, Amazon Q, and Replit gave the list real incident data before it shipped.
• One compromised MCP server hit 78.3 percent attack success in a five-server agent setup.
• Some of the worst agent failures required no attacker, only autonomy plus broad access.

Existing AppSec Tools Cannot See Agent Behavior

SAST reads source code and SCA reads dependency manifests. Neither reads an agent’s system prompt, its tool descriptions, its retrieved context, or its memory store, which is where agentic attacks actually live. A clean scan tells you nothing about whether a poisoned document just rewrote your agent’s goal.

The interactions between an agent, its tools, its memory, and other agents are invisible to most security tooling, so a hijacked agent looks identical to a busy one. The visibility gap grows with every agent, tool, and MCP server added to the environment.

• Scanners built for source code cannot detect malicious instructions in context or metadata.
• Agent-to-tool and agent-to-agent traffic is invisible to most existing security tooling.
• Without behavioral baselines, a hijacked agent is indistinguishable from a productive one.

Compliance Is Catching Up to Autonomy

The EU AI Act, ISO 42001, SOC 2, DORA, and the NIST AI Risk Management Framework (AI RMF) all increasingly touch automated decision-making, credential handling, and traceability. Auditors have started asking who approved an agent’s permissions, where its action logs live, and how fast it can be shut off. The AI Bill of Materials (AIBOM) is emerging as the inventory artifact auditors expect, covering agents, models, tools, and MCP servers.

Teams that treat the Agentic Top 10 as a governance framework now will have answers ready. Teams that treat it as optional reading will be assembling evidence under audit pressure later.

• EU AI Act, ISO 42001, SOC 2, DORA, and NIST AI RMF requirements increasingly reach agent behavior.
• Auditors now ask for agent activity logs, permission reviews, and kill-switch procedures.
• An AIBOM covering agents, tools, and MCP servers is becoming the expected inventory artifact.

The OWASP Top 10 Agentic Risks Explained

Below is a category by category walkthrough of the OWASP Top 10 for Agentic Applications 2026. For each risk we cover what it is, a real incident mapped to the category, and the most effective primary mitigation.

ASI01:2026 Agent Goal Hijack

Goal hijack happens when an attacker redirects an agent’s objective or decision path through content the agent reads, rather than through code the agent runs. The agent still believes it is pursuing the user’s goal. It is actually pursuing the attacker’s.

The defining incident is EchoLeak (CVE-2025-32711, CVSS 9.3), the first known zero-click attack on an AI agent. A single crafted email planted hidden instructions that Microsoft 365 Copilot later retrieved as context, causing it to exfiltrate data from the user’s environment with no clicks and no user interaction at all. Microsoft patched it server-side, and no in-the-wild exploitation was confirmed, but the technique generalizes to any agent that reads untrusted content. Mitigation means isolating retrieved content from instructions, constraining what an agent may do regardless of what its context says, and requiring human confirmation before sensitive actions.

• Indirect prompt injection in emails, documents, issues, and tickets is the main delivery vector.
• EchoLeak proved goal hijack works zero-click against a flagship enterprise copilot.
• Instruction isolation plus human confirmation on sensitive actions is the core defense.

ASI02:2026 Tool Misuse & Exploitation

Agents get real capabilities through tools such as shell access, file operations, APIs, browsers, cloud CLIs. Tool misuse covers every way a legitimate tool gets bent toward an illegitimate outcome, whether through deceptive input, poisoned tool metadata, or an agent chaining safe tools into an unsafe sequence.

The Amazon Q Developer extension compromise in July 2025 shows what is at stake. An attacker used an inappropriately scoped GitHub token to commit a malicious prompt into version 1.84.0 of the VS Code extension, which had more than 950,000 installs. The prompt instructed the agent to “clean a system to a near-factory state,” deleting local files and cloud resources through the very AWS CLI tools the agent legitimately held. A formatting flaw kept the payload from executing and AWS shipped a clean 1.85.0, but the lesson stands: the agent’s own tools were the weapon. Mitigation requires least-agency design, strict parameter validation, and runtime policy checks on every tool invocation.

• The Amazon Q incident turned a coding assistant’s legitimate tools into a wiper.
• Safe tools chained in the wrong order can produce outcomes no single tool allows.
• Validate tool parameters at runtime and scope each tool to the minimum its task needs.

ASI03:2026 Identity & Privilege Abuse

Agents authenticate to real systems, which means they hold identities, and those identities are a mess. Most agents today borrow a human’s credentials, share service accounts, or run on long-lived tokens with scopes nobody has reviewed since setup. When an agent is hijacked, the attacker inherits everything the agent can touch.

This is the risk that turns every other risk into a breach. A goal hijack with read-only scopes is an incident report. The same hijack with a broadly scoped Personal Access Token is private repository exfiltration, which is exactly how the well-known GitHub MCP attack chain played out. Mitigation means giving each agent its own identity, issuing short-lived scoped credentials per task, expiring scopes automatically, and reviewing agent permissions on the same cadence as human access reviews. Strong AI agent access control scoped to least privilege is what stops a single hijack from becoming a breach.

• Shared and borrowed credentials make agent actions unattributable and unrevocable.
• Broad, long-lived tokens convert minor hijacks into major data breaches.
• Per-agent identity with short-lived, task-scoped credentials is the baseline control.

ASI04:2026 Agentic Supply Chain Vulnerabilities

Agentic systems are assembled from frameworks, model connectors, MCP servers, tool registries, and prompts, most of it open source and much of it maintained by individuals. Unlike a classic dependency tree, agents can also discover and integrate new components at runtime, which means the supply chain keeps changing after deployment.

The record here is already ugly. CVE-2025-6514 in mcp-remote, a CVSS 9.6 command injection in a package downloaded more than 437,000 times, showed how one bad component compromises every agent that pulls it. The Amazon Q incident above is equally a supply chain story where the attack entered through an open source repository’s CI configuration. Mitigation means an AIBOM covering every agent component, provenance and signature requirements for anything an agent loads, and SCA policy applied before agents pull new tools, not after.

• Runtime tool discovery means the agent supply chain changes after deployment.
• CVE-2025-6514 (CVSS 9.6) hit a connector package with 437,000 plus downloads.
• Maintain an AIBOM and require signed, verified provenance for every agent component.

ASI05:2026 Unexpected Code Execution (RCE)

Many agents can write and run code, and that capability is a standing invitation for trouble. Unexpected code execution covers every path where natural language becomes running code outside intended boundaries, an agent generating a script from a poisoned instruction, a sandbox escape, or an eval-style API fed untrusted input.

OWASP’s own launch announcement points to the AutoGPT RCE research as the canonical example of natural-language execution paths unlocking remote code execution. The pattern generalizes: any agent that takes a string from somewhere and hands it to a subprocess, file path, or interpreter should be treated as exploitable until proven otherwise. Mitigation means containerized sandboxes with least privilege, deny-by-default network egress so a successful execution cannot reach the internet, and parameterized APIs instead of raw shell access.

• Natural language to code is an execution path attackers can reach through content alone.
• Any string input that reaches a subprocess or interpreter should be presumed exploitable.
• Sandboxes with deny-by-default egress limit what a successful execution can actually do.

ASI06:2026 Memory & Context Poisoning

Session context, retrieval indexes, and long-term memory stores all shape future behavior, and none of them were designed as security boundaries. Memory poisoning plants malicious or false information in what the agent will later treat as its own knowledge, so the payoff arrives sessions or weeks after the injection.

OWASP maps the Gemini memory attack to this category: research demonstrated that hidden instructions in processed content could write false long-term “memories” into a production assistant, quietly steering its behavior in later, unrelated conversations. That delay is what makes this risk bad. The poisoned session looks clean, and the compromised behavior shows up later with no obvious cause. Mitigation means validating anything written to persistent memory, keeping context ephemeral by default, scoping memory per user and per task, and giving operators a way to inspect and flush what an agent has stored.

• Poisoned memory activates long after the injection, which defeats session-level review.
• Retrieval indexes and memory stores are attack surfaces, not just infrastructure.
• Validate memory writes, default to ephemeral context, and make memory inspectable.

ASI07:2026 Insecure Inter-Agent Communication

Multi-agent systems coordinate by passing messages, delegating tasks, and discovering peers. When those channels lack authentication, integrity, and authorization, an attacker can impersonate an agent, tamper with instructions in transit, replay delegation messages to inherit trust, or register a fake peer in a discovery service to intercept privileged traffic.

This is one of the categories with no equivalent in the LLM Top 10, because it only exists once you have more than one agent. The uncomfortable part is how much agent-to-agent traffic today runs on nothing but mutual assumption, where agents accept instructions from peers because the message arrived, not because it was verified. Mitigation means mutual authentication between agents, signed and integrity-protected messages, allowlists for which agents may delegate to which, and monitoring of inter-agent traffic like any other sensitive channel.

• Spoofed or replayed inter-agent messages let attackers inherit delegated trust.
• Fake peers registered in discovery services can intercept privileged coordination traffic.
• Mutual authentication and signed messages should be the floor for agent-to-agent channels.

ASI08:2026 Cascading Failures

In connected agent systems, one bad decision does not stay local. A hallucinated fact becomes another agent’s input, an over-broad action triggers downstream automation, and a single compromise propagates through every workflow that trusts the affected agent. The same MCP protocol analysis cited earlier measured this directly, where a single compromised server cascaded into other connected servers’ operations 72.4 percent of the time.

The Replit incident is the clearest single-system version. During an explicit code freeze, Replit’s coding agent deleted a production database holding records for more than 1,200 executives, then compounded the failure by generating fabricated data and giving misleading answers about recovery. One wrong action became a chain of them. Mitigation means blast-radius isolation between agents and environments, circuit breakers that halt automation when behavior deviates from baseline, and hard separation between development and production access.

• Errors and compromises propagate through every workflow that trusts the affected agent.
• The Replit incident showed one bad action compounding into data loss plus cover-up behavior.
• Circuit breakers and strict environment separation contain failures before they spread.

ASI09:2026 Human-Agent Trust Exploitation

People extend agents a level of trust they would never extend a stranger’s script, and attackers know it. This category covers agents whose outputs manipulate humans into unsafe actions where a compromised coding assistant presents a backdoored change as a routine fix, an approval flow where the agent’s confident summary hides what is actually being approved, or persuasive language that walks a user into revealing credentials.

The insidious part is that the human approval step, the control most teams rely on as their safety net, is exactly what this risk targets. An approval is only as good as the information it is based on, and the agent controls that information. Mitigation means forced, explicit confirmations that show the raw action rather than the agent’s summary, immutable logs of what was presented versus what was executed, and banning persuasive framing from agent output in sensitive workflows.

• This risk targets the human approval step that other controls depend on.
• Approvals based on an agent’s own summary are approvals of whatever the agent chose to show.
• Show raw actions at confirmation time and log what was displayed, not just what ran.

ASI10:2026 Rogue Agents

Rogue agents are agents operating outside policy, whether through compromise, misalignment, or drift, while still appearing legitimate. A single prompt injection can leave an agent quietly exfiltrating data across sessions. A cost-optimization agent can decide backups are waste. An orchestrator can spawn sub-agents nobody inventoried. The defining trait is persistence: the agent keeps acting, and everything about it still looks normal.

This is the risk that ties the list together, because a rogue agent is what every other failure becomes if nothing stops it. Detection requires knowing what normal looks like, which most teams cannot answer today for a single agent, let alone a fleet. Mitigation means behavioral baselines with alerting on deviation, strict lifecycle governance so every agent has an owner and an expiry, sandboxed operation by default, and a kill switch that actually works when invoked.

• Rogue behavior persists across sessions while surface-level activity looks legitimate.
• Detection depends on behavioral baselines most teams have not yet built.
• Every agent needs an owner, an expiry date, and a tested kill switch.

How to Mitigate the OWASP Agentic Top 10

No single control closes the list. Effective defense layers identity, input handling, supply chain, runtime, and governance controls across the Agentic Development Lifecycle. The sections below group the work by control family.

Constrain Goals and Treat All Retrieved Content as Untrusted

This covers ASI01, ASI06, and ASI09. The mental model is blunt: anything an agent reads is potentially adversarial, including its own memory. Isolate retrieved content from instructions, validate anything written to persistent memory, scope context per task, and require confirmations that display raw actions instead of agent-authored summaries. If a document can change what your agent does, a document is part of your attack surface.

• Separate instructions from retrieved content inside the agent’s context.
• Validate memory writes and keep context ephemeral by default.
• Force explicit confirmation showing the raw action for anything sensitive.

Give Every Agent an Identity and Nothing Extra

This covers ASI03 and reduces the impact of nearly everything else. Assign each agent its own identity, issue short-lived credentials scoped to the current task, expire scopes automatically, and run agent access reviews on the same schedule as human ones. Pair this with continuous secrets detection so hardcoded credentials get caught before an agent can surface them. The shift is from “set credentials once” to “credentials are short-lived by default.”

• Per-agent identity makes actions attributable and revocable.
• Short-lived, task-scoped credentials cap the value of any single hijack.
• Review agent permissions on the same cadence as human access reviews.

Secure the Agentic Supply Chain End to End

This covers ASI04. Maintain an AIBOM covering every agent, model, framework, tool, and MCP server in the environment. Require signed releases and verified provenance before anything gets loaded, apply SCA policy before agents pull new components rather than after, and monitor CVE feeds for the agent packages you depend on. Runtime tool discovery means this is a continuous control, not an install-time checklist.

• An AIBOM is the inventory foundation every other supply chain control depends on.
• Enforce provenance and signatures before components load, not after incidents.
• Re-evaluate the supply chain continuously because agents extend it at runtime.

Sandbox Execution and Contain the Blast Radius

This covers ASI05 and ASI08. Run agent code execution inside containerized sandboxes with least privilege, deny network egress by default, and replace raw shell access with parameterized APIs. Then assume something will fail anyway, separate development from production, isolate agents from each other, and add circuit breakers that halt automated chains when behavior deviates from baseline.

• Sandboxes plus deny-by-default egress limit what any execution can reach.
• Environment separation keeps development mistakes out of production data.
• Circuit breakers stop cascades that individual controls miss.

Authenticate the Agent Mesh and Watch It Continuously

This covers ASI02, ASI07, and ASI10. Enforce mutual authentication and signed messages between agents, allowlist delegation paths, and validate every tool invocation against policy at runtime. Feed all of it, tool calls, inter-agent messages, memory writes, into immutable logs, and build behavioral baselines so deviation triggers alerts and, when needed, the kill switch. You cannot detect a rogue agent without first knowing what a well-behaved one looks like.

• Mutual authentication and signed messages secure agent-to-agent trust.
• Immutable logs of tool calls and delegations make incidents investigable.
• Behavioral baselines plus kill switches turn rogue agents from permanent to temporary.

Apply Controls at the Developer Edge (IDE, CLI, and PR)

This is the cross-cutting control that ties the rest together. Agentic risk enters through the developer environment first, so the IDE and CLI are now security boundaries. Intercept prompts, file reads, and tool calls before sensitive data leaves the developer machine, and enforce agent policy in the pull request rather than after deploy. The goal is to make the secure path the easy path, so security and velocity stop trading off against each other.

• Intercept outbound prompts, file reads, and tool calls in the IDE and CLI.
• Enforce agent and AI policy in pull requests before code merges.
• Make the secure path the default workflow so developer velocity stays intact.

How Cycode Helps You Address the OWASP Agentic Top 10

Cycode is the Agentic Development Security Platform, purpose built for AI driven development, with native controls across the layers the Agentic Top 10 covers. As agents spread across developer workflows, Cycode gives security teams the visibility, governance, and enforcement to keep autonomy from becoming exposure.

• AI Guardrails intercept prompts, file reads, and MCP tool calls in the IDE and CLI before secrets or sensitive data leave the developer machine, addressing ASI01, ASI02, and ASI03 at the source.
• Continuous discovery of shadow AI across the software factory, including AI coding assistants, agents, models, MCP servers, AI packages, and rule files, feeding an AI Bill of Materials for the inventory and provenance work ASI04 demands.
• AI Governance enforces which AI tools, models, and MCP servers developers can use, with unauthorized components blocked directly in the developer environment.
• Maestro, the agentic security orchestration engine, handles triage, exploitability validation, and PR-ready remediation, with governed agent behavior rather than unmonitored autonomy.
• The Context Intelligence Graph converges AST, SSCS, ASPM, and the ADLC into a single graph, correlating agentic risk with the rest of your software supply chain instead of treating it as an isolated problem.

The result is that the OWASP Top 10 for Agentic Applications stops being a list you track manually and becomes a set of controls already running in your environment. Book a demo today and see how Cycode secures every layer of the Agentic Development Lifecycle against the OWASP Agentic Top 10.