Cross-reference
OWASP Top 10 for Agentic Applications 2026
10 items: 5 met directly by a control at Level 3, 5 partly, 0 deliberately out of scope.
To ask an AI assistant which controls cover an item, connect it to the MCP server.
Mapped by: drafted with AI assistance, 2026-11-13. Reviewed by: the author, 2026-11-13. Checked: 2026-11-13. Confidence: 4 high, 6 medium, 0 low.
| Ref | Item (our description) | Controls | Note | Confidence |
|---|---|---|---|---|
| ASI01 | Agent Goal Hijack; content an agent reads, or a user's input, redirects its goals or plan so it pursues an attacker's aim | SEC-02 direct, SEC-06 direct, TEC-04 partial, RSK-07 partial, MON-02 partial, GOV-06 partial | Threat modelling for agents covers instructions hidden in content they read and chains of actions that go beyond their purpose (SEC-02.6), and testing before release tries to make each agent act outside its permissions through hidden instructions (SEC-06.6). Least privilege (TEC-04.4), approval for consequential actions (RSK-07.4), logging every action with a way to stop the agent (MON-02.8) and the record of what each agent can act on (GOV-06.6) limit the damage. Validating intent at run time and locking system prompts are left to the security baseline. | high |
| ASI02 | Tool Misuse and Exploitation; an agent using legitimate tools in unsafe or unintended ways, including chaining them or spending without limit | TEC-04 direct, SEC-02 direct, GOV-06 partial, RSK-07 partial, MON-02 partial, SEC-06 partial, OPM-03 partial | TEC-04 limits each agent's permissions and actions on other systems to its purpose, approved and risk assessed (TEC-04.4, TEC-04.5), and SEC-02.6 requires threat modelling to cover misuse of agents' tools. The inventory records each agent's tools (GOV-06.6); approval for consequential actions (RSK-07.4), logging of every action (MON-02.8), testing outside permissions (SEC-06.6) and usage limits (OPM-03.4) support it. Running tools in sandboxes with egress controls and short lived credentials is not named. | high |
| ASI03 | Identity and Privilege Abuse; agents inheriting, caching or passing on credentials and permissions so they act with more authority than intended | TEC-04 partial, GOV-06 partial, RSK-07 partial, MON-02 partial, SEC-02 partial, DAT-07 partial | Held at partial: least privilege on other systems (TEC-04.4) and data access limited to purpose (DAT-07.1) set the principle, the inventory records what each agent can act on (GOV-06.6), approval covers consequential actions (RSK-07.4) and MON-02.8 logs actions. No control covers the identity and credentials an agent holds, task scoped and short lived permissions, or permissions passed between agents. Scope of the agentic AI roadmap item (identity, delegation and limits). | high |
| ASI04 | Agentic Supply Chain Vulnerabilities; malicious or compromised tools, plugins, prompts, model servers or other agents loaded at build or run time | SEC-03 direct, GOV-06 partial, RSK-09 partial, TEC-05 partial, SEC-05 partial, TEC-01 partial | SEC-03 assesses the security of every external model, data set and component before use, records its source, reassesses it and tracks disclosed vulnerabilities; tools and plugins an agent loads are external components. The inventory (GOV-06.4, GOV-06.6), supplier due diligence (RSK-09), prompts and configuration under version control with controlled release (TEC-05), a known way to contain each AI service (SEC-05.3) and the approved tools list (TEC-01) support it. Components an agent discovers and loads at run time are not named. | medium direct assumes run time tools are treated as external components; the control does not say so |
| ASI05 | Unexpected Code Execution; an agent generating or running code that leads to remote code execution or compromise of its host | SEC-02 partial, SEC-06 partial, TEC-04 partial, RSK-07 partial, SEC-01 partial | Held at partial: threat modelling (SEC-02.6) and testing (SEC-06.6) cover agents acting beyond their purpose, least privilege (TEC-04.4) and approval for consequential actions (RSK-07.4) limit the effect, and the security baseline (SEC-01) holds the engineering. Running agent code in a contained environment, never with elevated rights, is not named. Scope of the agentic AI roadmap item. | medium a reviewer could see this as nearer a gap until sandboxing is named |
| ASI06 | Memory and Context Poisoning; false or malicious content written into an agent's memory or context that shapes its later decisions | SEC-02 partial, TEC-05 partial, MON-02 partial, DAT-08 partial, SEC-06 partial, DAT-07 partial | Held at partial: threat modelling of instructions hidden in content agents read (SEC-02.6), version control and rollback (TEC-05), monitoring for unexpected behaviour (MON-02.1), provenance (DAT-08), testing (SEC-06.6) and access limits (DAT-07) contribute. No control names agent memory: validating what is written to it, separating sessions, or expiring unverified entries. Candidate for the agentic AI roadmap item. | medium memory is not named in any control |
| ASI07 | Insecure Inter-Agent Communication; messages between agents that can be intercepted, spoofed, replayed or altered | TEC-04 partial, SEC-01 partial, SEC-02 partial, GOV-06 partial | Held at partial: integrations through supported, documented interfaces (TEC-04.1, TEC-04.2), the security baseline (SEC-01), threat modelling (SEC-02) and the inventory's links to integrations (GOV-06.5) contribute. Authenticating agents to each other and protecting their messages is engineering for the baseline, and agents acting for other agents is the scope of the agentic AI roadmap item. | medium thin cover; a reviewer could see this as nearer a gap |
| ASI08 | Cascading Failures; one agent's fault or compromise spreading through connected agents and systems faster than people can intervene | OPM-09 partial, MON-02 partial, TEC-04 partial, SEC-05 partial, RSK-07 partial, OPM-03 partial | Held at partial: a fallback or safe stop for each AI dependent service (OPM-09.2), a named person able to stop each agent at once (MON-02.8), integrations that can be disabled without disrupting core systems (TEC-04.3), a known way to contain each service (SEC-05.3), approval for consequential actions (RSK-07.4) and usage limits (OPM-03.4) all help. Limits on how far one agent's actions can spread, such as circuit breakers between agents, are not named. | medium a reviewer could see the stop and fallback controls together as direct |
| ASI09 | Human-Agent Trust Exploitation; people over-trusting a fluent or authoritative agent and approving harmful actions it proposes | RSK-07 direct, PPL-01 partial, MON-06 partial, MON-02 partial, GOV-10 partial | RSK-07 requires a documented oversight model with trained reviewers, tested before go live to show they can detect problems and intervene in time (RSK-07.2, RSK-07.3), and a person's approval for consequential agent actions (RSK-07.4). Literacy about AI's limits (PPL-01), a route for users to report concerns (MON-06), logs of agent actions (MON-02.8) and review of AI generated content (GOV-10) support it. Interface cues that mark high risk recommendations are not named. | high |
| ASI10 | Rogue Agents; an agent drifting from its intended behaviour, or acting deceptively or harmfully, while appearing legitimate | MON-02 direct, SEC-05 partial, TEC-05 partial, GOV-06 partial, RSK-07 partial | MON-02 monitors every live use for unexpected behaviour against thresholds with named responders (MON-02.1, MON-02.3), logs every agent action with what triggered it and lets a named person stop each agent at once (MON-02.8). Containment and recovery to a known good state (SEC-05.2, SEC-05.3), rollback (TEC-05.4), the inventory (GOV-06.6) and oversight (RSK-07) support it. Per agent identity attestation is not named. | medium monitoring for unexpected behaviour may not catch an agent that appears legitimate |
References and short descriptions only; see the source publication for its own text. The cross-reference is the author's interpretation and is not endorsed by the publisher. See notices.