Why Agents Need Their Own Security List
A chatbot that gives a wrong answer is a problem. An agent that acts on a wrong answer, by sending the email, changing the record, or moving the money, is a much bigger one.
That is why the OWASP GenAI Security Project published the OWASP Top 10 for Agentic Applications in December 2025. It was developed with input from more than 100 experts, and it extends OWASP's earlier list of risks for LLM applications rather than replacing it.
The list was written for security teams, but the decisions it raises also belong to the people who own the business process. Here are all ten risks in plain English, each with one control to start from.
The Ten Risks
ASI01: Agent Goal Hijack
An attacker changes what the agent is trying to do. This often happens indirectly, through instructions hidden in a document, email, or web page the agent reads.
Start here: treat all outside content as untrusted data, and require approval for high-impact actions.
ASI02: Tool Misuse & Exploitation
The agent uses a tool it is allowed to use, but in an unsafe way. It might pass unchecked input into a command, or chain tools together in a way nobody intended.
Start here: give each agent only the tools it needs, and validate what goes into them.
ASI03: Identity & Privilege Abuse
Agents often inherit credentials from a person or a service account, and attackers can exploit that borrowed trust to go beyond what the owner intended.
Start here: give each agent its own short-lived credentials with the minimum access it needs.
ASI04: Agentic Supply Chain Vulnerabilities
Models, plugins, and tools loaded from third parties can be malicious, compromised, or tampered with.
Start here: keep an approved list of components, pin their versions, and review changes before they reach production.
ASI05: Unexpected Code Execution
Code that an agent writes or receives runs on a host in ways nobody intended, which can lead to a compromised system.
Start here: run agent-generated code in an isolated sandbox with no access to production credentials.
ASI06: Memory & Context Poisoning
Corrupted long-term memory or search indexes can skew an agent's decisions long after the original attack. One bad entry can affect many future sessions.
Start here: control what can be written to memory, record where each entry came from, and clear out stale data.
ASI07: Insecure Inter-Agent Communication
When authentication, encryption, or validation is weak, attackers can intercept, fake, replay, or alter messages between agents.
Start here: authenticate and encrypt agent-to-agent traffic, and never assume another agent's message is safe.
ASI08: Cascading Failures
One fault spreads across connected agents and services, and grows into a wider outage or breach. Because agents act quickly, this can happen before anyone notices.
Start here: add rate limits and circuit breakers, and make sure you can stop one agent without stopping everything.
ASI09: Human-Agent Trust Exploitation
Agents sound confident and authoritative. Attackers can use that to persuade people to share credentials or approve a transfer, and an approval step doesn't help if people approve whatever the agent suggests.
Start here: show reviewers the evidence behind each request, and train them to question it.
ASI10: Rogue Agents
An agent drifts from its intended purpose or authorized scope through compromise, misalignment, or unexpected behavior. Each action may look fine alone, while the overall pattern is harmful.
Start here: monitor behavior over time, not just single actions, and rehearse how to shut an agent down.
Where to Begin
Ten risks can feel like a lot, but a few controls address several of them at once:
• Least privilege. Limit what each agent can access, so that any successful attack can do less damage.
• Human approval. Put a person in front of the actions you couldn't easily reverse.
• Treat inputs as untrusted. This applies to documents, web pages, tool results, memory, and messages from other agents.
• Full tracing. Log every action, so that you can detect problems and investigate them afterward.
• A tested shutdown. Know exactly who can stop an agent and how, and practice it before you need it.
Questions to Ask Before Go-Live
• What is the worst thing this agent could do with the access it has today?
• What happens if a document it reads contains hidden instructions?
• Which actions need human approval, and could the reviewer make a real decision with what they are shown?
• Can we reconstruct exactly what the agent did and why?
• Who can shut it down, and how quickly?
If those questions are hard to answer, that is useful to know before launch.
Security Is What Lets You Scale
Forrester reported in 2026 that 49% of security decision-makers named agentic AI as a concern. Their concern is reasonable, but it doesn't have to stop a project. Controls like these are what give a business the confidence to give an agent more responsibility.
We offer security audits for AI projects based on this framework. If you have an agent heading toward production, get in touch through our contact form.