OWASP Top 10 for Agentic Applications

What it is

The OWASP Top 10 for Agentic Applications is a security framework for AI systems that plan, remember, call tools and act with delegated authority. It was published on 9 December 2025 by the OWASP Gen AI Security Project, the same community behind the OWASP Top 10 for LLM Applications, and built with input from more than a hundred security experts, researchers and practitioners.

The ten risks are:

• ASI01 Agent Goal Hijack: attackers redirect what the agent is trying to do, often through injected content.
• ASI02 Tool Misuse: legitimate tools used in harmful ways.
• ASI03 Identity and Privilege Abuse: agents acting with more access than they should have.
• ASI04 Agentic Supply Chain Vulnerabilities: compromised tools, plugins, MCP servers or models.
• ASI05 Unexpected Code Execution.
• ASI06 Memory and Context Poisoning: false information planted in what the agent remembers.
• ASI07 Insecure Inter-Agent Communication.
• ASI08 Cascading Failures: one error spreading through connected agents and systems.
• ASI09 Human-Agent Trust Exploitation: people approving harmful actions because an agent presents them convincingly.
• ASI10 Rogue Agents.

Each risk is tied to real incidents and comes with mitigations, and the project released companion material alongside it, including a threat and mitigation taxonomy, a threat modelling guide and a capture-the-flag environment for hands-on practice.

Why it is worth reading

The LLM Top 10 covers risks of a model in an application. The agentic list covers what changes when the model becomes an actor with credentials, tools and memory, which is exactly where most new agent projects are exposed. Reading it before you design tool permissions, approval steps and memory saves you from building the classic mistakes into your architecture.

Prerequisites and time

A basic understanding of how agents call tools and some security fundamentals help. Reading the document takes two to three hours; using it as a design review checklist for your own agent is where the value is.

Free or paid?

Free to download from the OWASP Gen AI Security Project site.

What you can do after it

Threat-model an agent against ten named risks, choose mitigations such as least-privilege tools, human approval and memory validation, and explain your agent's security design in a review.

Common questions

Does it replace the LLM Top 10? No. Use both: the LLM list for model-level risks such as prompt injection and data leakage, the agentic list for tools, autonomy, memory and multi-agent systems.