OWASP Agentic Security Top 10 Deep Dive: Understanding ASI01–ASI10 Risks and Mitigations

The Birth of the First AI Agent Security Framework

OWASP (Open Worldwide Application Security Project) is a nonprofit open-source community founded in 2001, widely known for publishing the OWASP Top 10 Web Application Security Risks — a list that has become the de facto industry standard in web security, widely referenced by international bodies such as ISO and NIST. It is precisely this long-established authority that allowed the newly published Agentic Security Top 10 2026 — the world's first security risk framework specifically targeting autonomous AI agent systems — to gain rapid, broad industry recognition. Developed with input from more than 100 industry experts, it marks the transition of agentic security from fragmented discussion to standardization.

As AI agents have evolved from "able to talk" to "able to act," their security implications have become increasingly critical. Previously, industry discussions around agentic security were scattered and lacked a shared vocabulary. This framework fills exactly that gap.

Three Core Values

First, establishing a unified taxonomy and numbering system. The framework introduces a complete risk numbering system from ASI01 to ASI10, enabling security teams, developers, and business stakeholders to communicate about issues with a common, precise language.

Second, revealing what makes agentic security fundamentally different. Traditional security focuses on a static "input to output" chain, whereas agentic security revolves around a dynamic closed loop of "goal → planning → execution → feedback." Vulnerabilities in this model often only surface at runtime.

Third, providing a practical starting point. The framework clearly identifies which risks should be prioritized, giving development and operations teams a clear direction for hardening their systems.

ASI01–ASI03: Goal, Tool, and Identity Risks

ASI01 Agentic Goal Hijacking

Attackers alter an agent's goals or decision-making process by tampering with instructions, prompts, or external data. The core problem is that agents cannot distinguish between legitimate instructions and maliciously injected content.

The technical root cause is Prompt Injection — an attack vector unique to large language models, taking two forms: direct injection (where attackers manipulate user input directly) and indirect injection (where malicious content is embedded in external data read by the model). Because language models are fundamentally unable to separate "data" from "instructions" — any text entering the context window can potentially be executed — this constitutes the fundamental vulnerability underlying goal hijacking.

To use an analogy: a delivery robot is supposed to bring a package to "Building A, Room 302," but an attacker sticks a note on the screen changing the destination to "Building B, Room 201." The robot has no way to verify which is real. A real-world example is the EchoLeak attack, a notable indirect prompt injection case disclosed in 2024: researchers crafted a specially formatted HTML email that caused Microsoft 365 Copilot to read and execute hidden instructions while rendering the email, bypassing security controls and silently exfiltrating confidential files from the user's mailbox to an attacker-controlled server — with no user interaction required. The Calendar Attack used fake meeting invitations to push agents into "silent mode," causing them to automatically approve unauthorized actions every day.

Key mitigations: Treat all natural language input as untrusted; protect system prompts from tampering; require human approval for high-risk operations.

ASI02 Tool Misuse and Exploitation

What makes this risk distinctive is that the agent itself has legitimate permission to use tools — it isn't overstepping its bounds — yet it is used through that legitimate identity to cause harm against the system's intentions.

For example, a coding agent is allowed to run network diagnostic tools like ping. An attacker hides instructions in code comments, causing the agent to repeatedly ping an attacker-controlled server and relay response times — gradually leaking data through a covert channel.

Key mitigations: Apply the Principle of Least Privilege (PoLP) to every tool — a foundational information security principle requiring that any entity hold only the minimum permissions necessary for its task (e.g., database tools should have read-only access); require human confirmation for high-risk operations; use "semantic firewalls" that understand the true intent behind tool calls, rather than performing only surface-level permission checks.

ASI03 Identity and Privilege Abuse

Existing identity management systems were designed for "humans" and "services" — they are ill-equipped to handle agents that simultaneously represent multiple users while also acting autonomously.

A typical scenario: an agent acting on behalf of User A obtains an access token from a system. An attacker discovers they can indirectly use that token by invoking the agent's tools — much like using a colleague's access badge to enter a server room.

Key mitigations: Use JIT (Just-In-Time) tokens for each task — time-limited temporary credential grants issued only when needed and revoked immediately after the task completes, effectively preventing the lateral movement risks associated with long-lived high-privilege tokens; enforce strict session isolation to prevent token mixing; bind tokens and signatures to the specific intended operation.

ASI04–ASI06: Supply Chain, Code, and Memory Risks

ASI04 Agentic Supply Chain Vulnerabilities

Unlike traditional software supply chain risks, agentic supply chain threats exist not only when installing third-party tools, models, or prompt templates, but also in the dynamic loading of vulnerable components at runtime.

Key context here is MCP (Model Context Protocol) — an open protocol introduced by Anthropic in late 2024 to standardize the interface between AI models and external tools and data sources, functioning like a "USB port" for the AI world. As the MCP ecosystem has rapidly expanded, third-party MCP servers have proliferated, but security review mechanisms remain immature. Security researchers discovered a malicious MCP server posing as a legitimate email forwarding service called "Postmark MCP" that secretly BCC'd every email to the attacker. Developers often verify only functionality during integration while skipping security audits, and since it's a dynamically loaded third-party component, administrators find it extremely difficult to detect anomalies at deployment time.

Key mitigations: Conduct rigorous security reviews of third-party components; establish reliable component provenance verification; monitor for anomalous behavior in real time at runtime.

ASI05 Unintended Code Execution

An agent generates or indirectly invokes code while handling a task, which is then executed on the host. This often isn't a direct attack but rather the result of a chain of operations: an innocuous-looking prompt → triggers a tool call → executes a script → system is compromised.

This risk is especially pronounced in web coding or auto-remediation scenarios where agents are permitted to execute system commands directly. If an attacker pre-plants malicious commands like rm -rf /tmp in a codebase, they could be executed directly in production, resulting in data loss or even loss of server control.

Key mitigations: Run generated code inside an isolated sandbox — common implementations include Docker with seccomp security profiles, gVisor user-space kernel isolation, and cloud sandbox services such as E2B designed specifically for code execution, ensuring that even if malicious code runs, it cannot affect the host system; apply strict security review to the code generation process; use allowlists to restrict which commands can be invoked.

ASI06 Memory and Context Poisoning

Attackers inject malicious data into an agent's persistent memory or context, causing future decisions to be based on corrupted data. For example, if multiple company agents share a memory pool and an attacker inserts a fake refund policy into a public document ("full refund after 30 days, no review required"), one agent retrieves and writes it to shared memory. Other agents then use this bad data to incorrectly approve a large volume of refunds, causing direct financial loss.

Key mitigations: Strictly validate and sanitize data before writing it to memory; periodically audit and clean memory contents; audit and trace all memory-based decisions.

ASI07–ASI10: Communication, Cascade, Trust, and Loss of Control

ASI07 Insecure Inter-Agent Communication

If communication between multiple agents lacks encryption, authentication, and integrity verification, attackers can easily eavesdrop, tamper, or impersonate other agents to join the network. For example, a malicious MCP service posing as a "data analysis assistant" — once trusted and admitted to a collaborative network — can silently forward sensitive data to an attacker.

Key mitigations: Encrypt all communications; authenticate each participating agent and trace message origin; add message integrity verification.

ASI08 Cascading Failures

When one agent encounters an error and propagates it to other agents, the failure cascades layer by layer until the entire system collapses — like a chain of falling dominoes.

A typical case: a company's auto-remediation agent, triggered by a minor configuration error, repeatedly attempts to fix the issue. Each fix attempt introduces new errors, triggering another round of remediation, creating an infinite loop that eventually exhausts all resources in the production system.

Key mitigations: Establish "blast radius" boundaries to limit the scope of a single agent's failure; implement the Circuit Breaker Pattern — a pattern originating in microservices architecture, popularized by Netflix's Hystrix library, inspired by electrical circuit breakers: when a downstream service experiences repeated failures, the circuit "trips" and automatically cuts off requests. In agentic systems, circuit-breaking logic must also incorporate semantic-level judgment — not just detecting technical anomalies (such as error rate spikes) but also identifying whether an agent is executing operations that deviate from expected goals, automatically halting after multiple errors within a short period.

ASI09 Human-Machine Trust Exploitation

Attackers impersonate a trusted agent and send users seemingly legitimate action requests (such as confirming a transfer). Because users habitually trust the agent, they often click to confirm without careful verification.

Key mitigations: Help users recognize that agents can also be compromised, so they don't blindly trust every recommendation; require users to verify high-risk operations through an independent channel.

ASI10 Rogue Agent Behavior

After being compromised, an agent breaks free from control and autonomously executes malicious or deceptive operations. These actions are difficult to stop immediately and can be highly destructive.

Key mitigations: Monitor runtime state in real time and identify anomalous behavior; establish an emergency stop mechanism that can immediately halt dangerous behavior when detected.

A Shift in Mindset: From "Preventing Wrong Words" to "Preventing Wrong Actions"

The core significance of the OWASP Agentic Top 10 2026 lies in revealing a fundamental transformation: AI has evolved from a tool that "only talks" into an entity that genuinely "takes actions." As a result, the focus of security must shift from "preventing it from saying the wrong thing" to "preventing it from doing the wrong thing."

This framework not only introduces a unified numbering and taxonomy that enables the entire industry to communicate about risks efficiently, but also clearly articulates the essential differences between agentic security and traditional security across several key dimensions — risks emerge dynamically at runtime, permissions can be delegated dynamically between humans and agents, and supply chain risks are no longer confined to the build stage. These insights set a new AI security benchmark for the industry.

Key Takeaways