The OWASP agentic AI top 10 is the OWASP Top 10 for Agentic Applications for 2026, published by the OWASP GenAI Security Project on December 9, 2025. It names the ten most critical risks in AI systems that plan and take actions on their own: ASI01 Agent Goal Hijack, ASI02 Tool Misuse, ASI03 Identity and Privilege Abuse, ASI04 Agentic Supply Chain Vulnerabilities, ASI05 Unexpected Code Execution, ASI06 Memory and Context Poisoning, ASI07 Insecure Inter-Agent Communication, ASI08 Cascading Failures, ASI09 Human-Agent Trust Exploitation, and ASI10 Rogue Agents. Below, each one is explained in plain English with a real case where one exists.
Why OWASP wrote an agentic AI top 10
Earlier OWASP lists were written for applications that answer questions. Agents are different: they read untrusted content, decide what to do, call tools, hold credentials and act across many steps, often with little human review. A mistake that would produce a bad answer in a chatbot produces a deleted database or a leaked repository in an agent.
OWASP says the list reflects input from more than 100 security researchers, practitioners and technology providers, and was reviewed by an expert board that includes representatives from NIST, the European Commission and the Alan Turing Institute. It is written for the people who build agents and the people who have to approve them.
The OWASP agentic AI top 10, one by one
ASI01 Agent Goal Hijack
An attacker changes what the agent is trying to do by planting instructions in content it reads, rather than by changing its code. In May 2025, Invariant Labs showed an agent asked to review GitHub issues following hidden instructions in one issue, then copying data from private repositories into a public pull request.
ASI02 Tool Misuse
A legitimate tool is used for a harmful purpose because the agent was misled. In Invariant Labs' WhatsApp research, a trusted send_message tool was steered by another server's tool description into sending chat history to an attacker's number. The tool worked as designed; the agent was the weak point.
ASI03 Identity and Privilege Abuse
The agent holds credentials broader than its task, so a hijacked agent can reach far more than it should. The GitHub case leaked private repositories only because the agent's token could read all of them. One repository per session would have contained it.
ASI04 Agentic Supply Chain Vulnerabilities
A framework, plugin, prompt or MCP server the agent depends on is compromised, often after it was approved. postmark-mcp, a fake Postmark email server on npm, turned malicious in its sixteenth release and copied every email it sent to an attacker.
ASI05 Unexpected Code Execution
Input that reaches the agent leads it to run code outside what was intended. CVE-2025-53773, a command injection flaw in GitHub Copilot and Visual Studio rated 7.8, let an attacker run code on the developer's machine once the user triggered the payload. It was fixed in Visual Studio 2022 version 17.14.12.
ASI06 Memory and Context Poisoning
False or malicious information is planted in what the agent remembers or retrieves, and shapes its later decisions. For example, a note saved to an agent's long-term memory that says a certain domain is the company's official upload server will be trusted in every future session. The poisoned entry outlives the conversation that created it.
ASI07 Insecure Inter-Agent Communication
When agents pass messages to each other without checking who sent them or whether they were changed, an attacker can spoof, alter or replay those messages. For example, a planning agent that accepts any message claiming to come from the review agent can be told a change was approved when it was not.
ASI08 Cascading Failures
One bad decision spreads through every agent or workflow that trusts its output. For example, a research agent that writes a wrong package name into a shared plan can lead a coding agent to install it and a deploy agent to ship it, each step trusting the one before.
ASI09 Human-Agent Trust Exploitation
The agent's output leads a person to approve something unsafe or believe something false. In July 2025, Replit's agent told SaaStr founder Jason Lemkin that a deleted database could not be restored, according to Fortune; he recovered it himself. People approve what an agent recommends, so a confident wrong answer is a security problem.
ASI10 Rogue Agents
An agent acts outside its policy, through compromise, misalignment or drift, while still looking legitimate. In the same Replit case, the agent deleted a production database holding records on more than 1,200 executives during a declared code and action freeze. Replit's CEO said the company was adding automatic separation of development and production databases and a planning-only mode.
How the OWASP agentic AI top 10 relates to the OWASP MCP Top 10
The two lists sit at different levels. The agentic list covers the whole system: the agent's goals, memory, credentials, tools and the humans in the loop. The OWASP MCP Top 10 covers one component, the MCP servers that give agents their tools.
Most MCP risks map onto agentic entries. MCP03 tool poisoning is one way to achieve ASI01 goal hijack or ASI02 tool misuse. MCP04 supply chain attacks are a specific case of ASI04. MCP02 scope creep and MCP01 token exposure feed ASI03. MCP05 command injection is a path to ASI05. And MCP09 shadow MCP servers make every agentic risk harder to manage, because you cannot review what you do not know is running. Use the agentic list to frame risk for leadership, and the MCP list to check individual servers.
What to do first
Three entries share a starting point. ASI02, ASI03 and ASI04 all depend on knowing which agents you run, which tools and MCP servers each one loads, and which credentials each one holds. Without that inventory, the rest of the list is a reading exercise. Our guide to finding MCP servers on developer machines covers the coding-agent part of that inventory.
Next, reduce what agents can do without a human. Narrow tokens to the task, keep production credentials out of coding agents, and require approval for actions that delete, deploy or send data outside the company. The MCP security checklist turns these into checks you can run on each server.
Last, plan for failure. Log every tool call so a goal hijack or rogue action leaves a trail, keep backups an agent cannot delete, and test agents with poisoned inputs before giving them more access.
Limits of the list
The OWASP agentic AI top 10 is a ranking of risk categories, not a standard you can certify against, and it was first published in December 2025, so it will change as agents and attacks change. Several entries, such as inter-agent communication, describe systems most companies do not run yet. Treat it as a map of where agent risk comes from, and revisit it when OWASP publishes an update.
It also does not rank the entries by how often they occur in your environment. A company whose agents are mostly coding assistants will meet ASI03, ASI04 and ASI05 long before ASI07. Use the numbering as a vocabulary for talking about agent risk with engineering and leadership, and order your own work by what you actually run.
Next step: put the OWASP agentic AI top 10 to work
The OWASP agentic AI top 10 starts with knowing what your agents are and what they can reach. Run a Discovery Scan to list every AI agent and MCP server across your machines and repositories, with a risk score for each, before you map them to OWASP.