OWASP agentic security
Agentic security is the practice of securing AI systems that take actions. Its shared vocabulary is the OWASP Agentic Top 10. The test of any implementation is not the policy document - it is whether each control can show a recorded refusal.
Get an Agent Trust Gap BriefThe ten risks, each with its control and its evidence
Security for agentic applications is not a rebrand of LLM security. The unit of risk is the action, not the token. The OWASP Agentic Top 10 names the failure modes; each leaf below maps the risk to controls and to the evidence an auditor accepts.
| Risk | One line | Leaf |
|---|---|---|
| ASI01 | An attacker steers the agent's objective through content it treats as instruction | controls → |
| ASI02 | A legitimate tool used in an unintended, damaging way | controls → |
| ASI03 | The agent acts with more authority than the task required | controls → |
| ASI04 | Compromise arrives through a tool, model or MCP server the agent trusts | controls → |
| ASI05 | Generated content reaches an interpreter and runs | controls → |
| ASI06 | Poisoned memory or context misbehaves long after injection | controls → |
| ASI07 | One agent accepts instruction from another without verifying authority | controls → |
| ASI08 | One bad output amplifies through an agent chain | controls → |
| ASI09 | Fluency persuades a human to approve what they should question | controls → |
| ASI10 | An agent operates outside governance entirely | controls → |
Full taxonomy hub: OWASP Agentic Top 10 (ASI01-ASI10). How it maps to NIST, ISO 42001 and the EU AI Act: the control crosswalk.
Common questions
Is OWASP agentic security the same as the OWASP Agentic Top 10?
The Top 10 (ASI01-ASI10) is the taxonomy at the centre of it. 'Agentic security' is the wider practice: the risks, the controls that answer them, and the evidence that proves the controls fire.
Is there an OWASP certification for agentic security?
No. No certification exists for the Agentic Top 10 and OWASP does not issue one. Its value is shared vocabulary.
How does agentic security differ from LLM security?
LLM security concerns model input and output - injection, leakage, unsafe content. Agentic security concerns systems that ACT: goal hijack, privilege abuse, rogue agents, cascading failures. Different failure modes, different controls.
What is the fastest way to assess agentic security posture?
Walk ASI01 to ASI10 and ask two questions per risk: which control answers it, and what evidence shows that control has ever fired. A control with zero recorded refusals is unproven.
Where do execution receipts fit?
They are the evidence layer for most of the ten: attribution for ASI03 and ASI10, tamper-evidence for ASI06, refusal receipts proving gates fire for ASI01 and ASI02.
Last verified 2026-08-11.
A control with zero recorded refusals is unproven. Agentic security is measured in evidence that gates fired, not in policy documents.