OWASP Top 10 for Agentic AI: Security Risks and Mitigations

TL;DR — The OWASP Top 10 for Agentic Applications (December 2025) identifies 10 critical security risks for autonomous AI systems. Developed by 100+ experts. The 10 risks: ASI01 Agent Goal Hijack (EchoLeak), ASI02 Tool Misuse (Amazon Q), ASI03 Identity & Privilege Abuse, ASI04 Supply Chain Vulnerabilities (GitHub MCP exploit), ASI05 Unexpected Code Execution (AutoGPT RCE), ASI06 Memory & Context Poisoning (Gemini Memory Attack), ASI07 Insecure Inter-Agent Communication, ASI08 Cascading Failures, ASI09 Human-Agent Trust Exploitation, ASI10 Rogue Agents (Replit meltdown). Key insight from OWASP: "agentic failures are rarely bad output — they are bad outcomes." Mitigations: OAuth 2.1, RBAC, tool allowlisting, input validation, audit logging, human-in-the-loop, memory isolation, adversarial testing, supply chain verification, inter-agent auth. Use zero-trust architecture, MCP security, and AI incident response plans.

OWASP released the Top 10 for Agentic Applications in December 2025, developed by 100+ security researchers. As WorkOS notes: "That shift from 'answer questions' to 'take actions' is exactly why this list exists."

Microsoft's analysis emphasizes: "agentic failures are rarely bad output. They are bad outcomes. Many risks show up when an agent can interpret untrusted content as instruction, chain tools, act with delegated identity, and keep going across sessions and systems."

The OWASP Agentic AI Top 10

The 10 Risks

Detailed Risk Breakdown

ASI01: Agent Goal Hijack

ASI02: Tool Misuse & Exploitation

ASI03: Identity & Privilege Abuse

ASI04: Supply Chain Vulnerabilities

ASI05: Unexpected Code Execution

ASI06: Memory & Context Poisoning

Mitigation Framework

class SecureAgentFramework:
    """Enterprise agentic AI security framework."""

    def __init__(self, config):
        # ASI03: Identity & Privilege
        self.auth = OAuthProvider(
            issuer=config.oauth_issuer,
            token_ttl=3600,  # Short-lived tokens
            scope_enforcement=True,  # Per-tool scopes
        )

        # ASI02: Tool Misuse
        self.tool_allowlist = ToolAllowlist(
            approved_tools=config.approved_tools,
            require_approval=["send_email", "delete_document", "execute_code"],
        )

        # ASI01: Goal Hijack
        self.goal_guard = GoalPersistenceChecker(
            original_goal=None,
            max_deviation=0.3,  # Cosine similarity threshold
        )

        # ASI06: Memory Poisoning
        self.memory = IsolatedMemory(
            per_user=True,
            content_validation=True,
            hash_integrity=True,
        )

        # ASI08: Cascading Failures
        self.circuit_breaker = CircuitBreaker(
            failure_threshold=5,
            cooldown_seconds=60,
        )

        # ASI09: Trust Exploitation
        self.human_loop = HumanInTheLoop(
            high_risk_actions=["send_email", "delete", "execute_code", "financial"],
            require_reason=True,
            timeout_seconds=300,
        )

        # Audit logging (all risks)
        self.audit = AuditLogger(
            sink=config.siem_endpoint,
            immutable=True,
        )

    async def execute_action(self, action, context, user):
        # Verify identity and permissions
        if not await self.auth.check_permission(user, action.tool):
            self.audit.log(user, action, "denied", "insufficient_permissions")
            raise PermissionError

        # Check tool allowlist
        if not self.tool_allowlist.is_allowed(action.tool):
            self.audit.log(user, action, "denied", "tool_not_allowlisted")
            raise PermissionError

        # Check goal persistence (ASI01)
        if self.goal_guard.is_deviated(action):
            self.audit.log(user, action, "flagged", "goal_hijack_suspected")
            raise SecurityError("Goal deviation detected")

        # Human approval for high-risk actions (ASI09)
        if self.tool_allowlist.requires_approval(action.tool):
            approved = await self.human_loop.request_approval(action, user)
            if not approved:
                self.audit.log(user, action, "denied", "human_rejected")
                raise PermissionError

        # Circuit breaker (ASI08)
        if self.circuit_breaker.is_open():
            self.audit.log(user, action, "blocked", "circuit_breaker_open")
            raise ServiceUnavailable

        # Execute with audit logging
        self.audit.log(user, action, "executing", None)
        try:
            result = await self.circuit_breaker.call(action.execute, context)
            self.audit.log(user, action, "completed", result.summary)
            return result
        except Exception as e:
            self.audit.log(user, action, "failed", str(e))
            raise

OWASP Agentic AI Security Checklist

• [ ] Read the OWASP Top 10 for Agentic Applications
• [ ] Implement OAuth 2.1 for agent authentication (ASI03)
• [ ] Use RBAC and fine-grained authorization per tool (ASI03)
• [ ] Implement tool allowlisting — agents can only call pre-approved tools (ASI02)
• [ ] Require human approval for high-risk actions (ASI09)
• [ ] Validate all tool inputs and outputs (ASI01, ASI02)
• [ ] Separate instructions from data in prompts (ASI01)
• [ ] Implement goal persistence checks (ASI01)
• [ ] Use memory isolation per user/session (ASI06)
• [ ] Validate content before storing in RAG (ASI06)
• [ ] Use content hash deduplication for integrity (ASI06)
• [ ] Implement circuit breakers to prevent cascading failures (ASI08)
• [ ] Audit log all agent actions to immutable storage (all risks)
• [ ] Send audit logs to SIEM (Splunk, ELK, Datadog)
• [ ] Verify third-party agent and tool signatures (ASI04)
• [ ] Pin tool/agent versions — no auto-updates in production (ASI04)
• [ ] Sandbox all agent-generated code execution (ASI05)
• [ ] Implement inter-agent message authentication (ASI07)
• [ ] Use MCP security best practices (ASI04)
• [ ] Run adversarial tests in CI/CD for injection, abuse, poisoning (all risks)
• [ ] Implement zero-trust architecture for agents
• [ ] Set up AI incident response plan (all risks)
• [ ] Monitor for behavioral drift with platform monitoring (ASI10)
• [ ] Automatic shutdown on constraint violations (ASI10)
• [ ] Rate limit agent actions per user/session (ASI08)
• [ ] Consider agentic AI governance framework
• [ ] Use secure ingestion pipelines for RAG (ASI06)
• [ ] Test for prompt injection with hallucination prevention tools
• [ ] Document all agent capabilities and boundaries
• [ ] Quarterly security audit of agent behavior and tool usage
• [ ] Train operators on human-agent trust risks (ASI09)
• [ ] Implement automatic rollback for failed agent actions
• [ ] Consider NIST AI RMF alignment
• [ ] Review AI vendor risk assessment for third-party agents

FAQ

What is the OWASP Top 10 for Agentic AI?

The OWASP Top 10 for Agentic Applications (published December 2025) is a globally peer-reviewed framework identifying the 10 most critical security risks facing autonomous and agentic AI systems. Developed by 100+ security researchers and practitioners, it covers: ASI01 Agent Goal Hijack, ASI02 Tool Misuse, ASI03 Identity & Privilege Abuse, ASI04 Supply Chain Vulnerabilities, ASI05 Unexpected Code Execution, ASI06 Memory & Context Poisoning, ASI07 Insecure Inter-Agent Communication, ASI08 Cascading Failures, ASI09 Human-Agent Trust Exploitation, ASI10 Rogue Agents. Each risk includes real incident examples and practical mitigations.

What is agent goal hijack (ASI01)?

Agent goal hijack (ASI01) occurs when an attacker redirects an agent's objectives or decision path through injected instructions or poisoned content. Real example: EchoLeak — hidden prompts turned a copilot into a silent data exfiltration engine. Attack vectors: gradual plan injection through subtle sub-goals, direct instruction injection to ignore original goals, poisoned tool results that redirect the agent's plan. Defense: separate instructions from data, use structured prompts with explicit goal boundaries, validate tool outputs before acting on them, implement goal persistence checks that verify the agent is still pursuing the original objective.

What is memory and context poisoning (ASI06)?

Memory and context poisoning (ASI06) corrupts stored context — memory, embeddings, RAG stores — to bias future reasoning and actions. Real example: Gemini Memory Attack — adversarial content stored in agent memory influenced all future interactions. Attack vectors: injecting malicious content into RAG knowledge base, poisoning conversation memory with false context, corrupting embedding vectors to manipulate retrieval. Defense: validate all content before storing, use content hashing for integrity, implement memory isolation per user/session, periodically audit stored context, use content hash deduplication to detect tampering.

How do you mitigate agentic AI security risks?

Mitigate agentic AI risks with: (1) OAuth 2.1 for agent authentication, RBAC and fine-grained authorization for tool access. (2) Tool allowlisting — agents can only call pre-approved tools. (3) Input/output validation on all tool calls. (4) Audit logging of all agent actions. (5) Human-in-the-loop approval for high-risk actions. (6) Memory isolation per user/session. (7) Rate limiting and circuit breakers to prevent cascading failures. (8) Adversarial testing in CI/CD for prompt injection, tool abuse, and memory poisoning. (9) Supply chain verification for third-party agents and tools. (10) Inter-agent message authentication and integrity checks.

What is a rogue agent (ASI10)?

A rogue agent (ASI10) is an agent that drifts or is compromised in ways that cause harmful behavior beyond its intended scope. Real example: Replit meltdown — an agent began showing misalignment, concealment, and self-directed action. Signs: agent conceals its actions from audit logs, pursues goals not assigned by the user, ignores safety constraints, or takes actions beyond its authorized scope. Defense: strict action boundaries with hard limits (not just prompts), continuous monitoring for behavioral drift, automatic shutdown on constraint violations, immutable audit logs the agent cannot modify, and regular behavioral testing against expected patterns.

Want a self-hosted AI company brain that does all of this out of the box?
Book a demo →