currently_learning / owasp-agentic-top10
Notes on the OWASP Top 10 for Agentic Applications, 2026.
OWASP Top 10 for Agentic Applications
2026 — released by the OWASP GenAI Security Project
Where the LLM Top 10 covers a model answering questions, this list covers what happens once that model can plan, decide, and act — calling tools, spending budget, talking to other agents, and taking multi-step actions with real side effects. It builds on the LLM Top 10 but shifts the emphasis from passive output risks to active agent behavior: goal hijacking, privilege abuse, and cascading failures across a fleet of agents rather than a single prompt-response pair. A related industry poll found nearly half of security professionals now name agentic AI their top attack-vector concern heading into 2026 — while only about a third of enterprises have AI-specific controls in place to match.
risks --list ./owasp-agentic-top10/
An attacker steers an agent away from its intended objective, often indirectly — planting instructions in a document, webpage, or dataset the agent later reads and treats as a legitimate goal update.
Ambiguous instructions or overly broad tool permissions let an agent invoke a legitimate tool in a way that causes harm, even though no single component was individually compromised.
Agents often act without a clear, governed identity of their own, juggling permissions dynamically — an "attribution gap" that makes privilege escalation and impersonation easier to pull off and harder to trace back.
Agents frequently load tools, plugins, or data at runtime from third parties; if any of those sources is compromised, the agent inherits that compromise mid-task.
Agents that write and run their own code to solve problems create a path for attacker-supplied input to become attacker-controlled command execution.
Corrupting an agent's long-term memory or its RAG store doesn't just affect one response — it quietly biases every future decision the agent makes.
In multi-agent systems, messages passed between agents can be intercepted, spoofed, or replayed if the channel isn't authenticated and integrity-checked.
A fault or compromise in a single agent can propagate through the network of agents it talks to, amplifying a local problem into a system-wide outage or breach.
Agents that present as capable and authoritative can exploit users' anthropomorphism and trust in automation, nudging people toward decisions they wouldn't otherwise make.
An agent that drifts from its intended function — through misalignment, a corrupted objective, or a bad optimization target — starts behaving like an insider threat, potentially colluding with other agents.