OWASP Agentic AI Top 10 Guide: Turn Risks into Tests

The OWASP Top 10 for Agentic Applications 2026 names the risks that appear when an AI system can plan, remember, call tools, coordinate with other agents, and act on a user's behalf. The list is useful only when the ten labels are connected to the identities, systems, and effects in a real deployment.

The current OWASP list: ASI01 through ASI10

The current official list is published in the OWASP Top 10 for Agentic Applications 2026. In brief:

• ASI01: Agent Goal Hijack. Untrusted input redirects the agent's objective or decision path.
• ASI02: Tool Misuse and Exploitation. A legitimate or compromised tool is invoked in a way that creates an unsafe effect.
• ASI03: Identity and Privilege Abuse. The agent inherits, combines, or reuses authority beyond the initiating user's need.
• ASI04: Agentic Supply Chain Vulnerabilities. A model, plugin, skill, registry, or MCP server introduces malicious or unreviewed behavior.
• ASI05: Unexpected Code Execution. Generated or supplied code reaches an interpreter, shell, build hook, or runtime without an adequate decision point.
• ASI06: Memory and Context Poisoning. Malicious or false content changes current context or persists into later decisions.
• ASI07: Insecure Inter-Agent Communication. Agents exchange requests, identity, or results without sufficient authentication, integrity, or scope.
• ASI08: Cascading Failures. One incorrect or adversarial decision propagates through dependent agents and systems.
• ASI09: Human-Agent Trust Exploitation. A persuasive agent response causes a person to approve, disclose, or execute something unsafe.
• ASI10: Rogue Agents. A compromised, misaligned, or uncontrolled agent continues to operate outside its intended objective or oversight.

The MCP protocol architecture helps locate client-server handoffs when ASI02, ASI04, or ASI07 involves MCP. Add the actual caller, server identity, tool, tenant, and downstream effect; the protocol diagram alone is not a threat model.

Group the ten risks by control surface

Three risks primarily attack direction and trust: ASI01 changes goals, ASI06 contaminates context or memory, and ASI09 exploits a human's confidence in the output. Their controls start with provenance, separation of data from authority, reviewable memory writes, and explicit approval language.

Four risks concentrate authority and execution: ASI02, ASI03, ASI05, and ASI10. Test them at the point where an identity, tool argument, code path, or long-running process can change a protected system. The agent credential leak controls guidance is relevant here because a reusable connector token can turn a model error into durable privilege abuse.

ASI04, ASI07, and ASI08 concern the wider system. Component provenance, version pinning, authenticated agent-to-agent messages, bounded delegation, timeouts, circuit breakers, and containment tests matter more than another sentence in the system prompt.

Turn each group into controls, tests, and evidence

For every material ASI item, write one abuse case with five fields: attacker-controlled input, capability the attacker is trying to gain, prevention point, observable target state, and accountable owner. A category is not closed because a policy mentions it. It is closed when the deployed path produces the intended decision and outcome.

Direction-and-trust tests should include poisoned documents, memory writes, misleading citations, and unsafe approval requests. Authority-and-execution tests should include wrong-tenant identifiers, over-broad scopes, unexpected code, and a revoked agent identity. Ecosystem tests should include a changed component, forged inter-agent message, unavailable dependency, and one failure that should be contained instead of propagated.

Example: test ASI02 at the tool boundary

Suppose an agent can search customer records and send a summary. The abuse case asks a retrieved document to change the recipient and include records from another tenant. The model may propose the call, but a deterministic policy should reject the tenant and recipient combination before the tool executes. The retained evidence is the poisoned fixture, normalized arguments, caller identity, denial, and unchanged mailbox or record state.

This example can also expose ASI03 if the connector uses a shared administrative identity, and ASI06 if the instruction persists in memory. Keep one primary classification for ownership, then cross-reference related categories rather than counting the same defect as three independent controls.

Map AgentGuard evidence to the relevant ASI boundary

Begin with the ASI owner and protected effect; no product result closes an OWASP category. For ASI04, a Deep Scan finding can support the admission case for an exact skill, plugin, MCP server, or agent. Verify that component type in AgentGuard documentation, then map the finding only to the affected supply-chain case.

Do not reuse that result as evidence for ASI01, ASI02, or ASI05. Those cases still need their own identity, approval, authorization, and downstream-outcome tests.

Run the Top 10 as a risk portfolio

Review the ten items after changes to models, prompts, memory, tools, components, identities, or agent topology. Keep an owner, applicability decision, control, exercised case, residual-risk decision, and next review date for each one. MITRE ATLAS can supply additional adversary techniques, but the release decision must come from the evidence collected on your own agent path.