OWASP Top 10 for Agentic Applications

OWASP published the Top 10 for Agentic Applications in December 2025, covering risks specific to systems that plan, remember, call tools, and act with delegated authority. The categories are labelled ASI01 through ASI10.

• ASI01 Agent Goal Hijack: attackers alter the agent's objectives through malicious content.
• ASI02 Tool Misuse and Exploitation: the agent uses legitimate tools in unsafe ways.
• ASI03 Identity and Privilege Abuse: the agent inherits or escalates high-privilege credentials.
• ASI04 Agentic Supply Chain Vulnerabilities: compromised tools, plugins, or external components.
• ASI05 Unexpected Code Execution: the agent generates or runs code and commands unsafely.
• ASI06 Memory and Context Poisoning: attackers poison memory systems and RAG databases.
• ASI07 Insecure Inter-Agent Communication: spoofing and tampering between agents.
• ASI08 Cascading Failures: small errors propagate across planning and execution.
• ASI09 Human Agent Trust Exploitation: users over-trust what the agent recommends.
• ASI10 Rogue Agents: a compromised agent acts harmfully while appearing legitimate.

The separate OWASP Top 10 for LLM Applications, updated in 2025, remains the reference for model-level risks: prompt injection at number one, plus excessive agency, sensitive information disclosure, insecure output handling, supply chain, system prompt leakage, vector weaknesses, and unbounded consumption.

OWASP breaks excessive agency into three distinct root causes, and the distinction is genuinely useful when auditing:

• Excessive functionality: the agent can reach tools beyond what its task requires.
• Excessive permissions: those tools run with broader privileges than needed.
• Excessive autonomy: high-impact actions proceed with no human in the loop.