The OWASP Top 10 for Agentic Applications 2026 names the ten security risks specific to AI systems that plan, use tools, hold memory and act.
Published 9 December 2025, ASI01 through ASI10 give security teams a shared vocabulary for agentic threats. This page maps each risk to the control that addresses it and the evidence object that proves the control actually fired — because a mitigation with no receipt is a claim.
Get an Agent Trust Gap BriefThe ten risks
Published 9 December 2025 by the OWASP GenAI Security Project. It extends rather than replaces the OWASP Top 10 for LLM Applications — most agentic systems are also LLM applications and inherit those risks too. Each row below links to a full page: how the risk shows up, the controls that address it, the evidence object that proves the control fired, and the honest limitation.
| Risk | Evidence that the control fired |
|---|---|
| ASI01 Agent Goal Hijack An agent's objective is redirected mid-task by content it reads, so it pursues a goal nobody set. | A policy_decision naming the mission scope evaluated, plus a refusal_receipt when the hijacked objective hits the boundary. |
| ASI02 Tool Misuse and Exploitation An agent uses a legitimate tool in a way nobody intended, or is induced to invoke one it should never have reached. | An execution_receipt carrying the tool, the argument hash, the policy version and the gates passed — so misuse is reconstructable rather than inferred. |
| ASI03 Identity and Privilege Abuse An agent acts with more authority than intended, or with authority that cannot be traced to a person. | An agent_passport plus actor_identity on every receipt, naming both the agent and the accountable human. |
| ASI04 Agentic Supply Chain Vulnerabilities Compromise arrives through something the agent depends on — a tool server, a model, a prompt template, a retrieved document. | Hashed policy_version, tool definition hashes, and a receipt chain that shows exactly which version was in force at execution. |
| ASI05 Unexpected Code Execution Generated or tool-invoked code runs with more reach than anyone intended. | An execution_receipt naming the sandbox profile and the effect owner, so 'where did this run' is a lookup rather than an investigation. |
| ASI06 Memory and Context Poisoning Planted content enters an agent's memory or retrieved context and shapes decisions long after it arrives. | A replay_job that reconstructs which context was present at decision time, plus provenance fields on the memory record. |
| ASI07 Insecure Inter-Agent Communication Agents trust each other's output because it arrived from inside the system. | actor_identity and mission_identity on every hop, so the chain from originating human to final effect is reconstructable. |
| ASI08 Cascading Failures One agent's failure propagates through the agents that depend on it. | A revocation record with measured time_to_effect_seconds, plus breaker-state on the receipt. |
| ASI09 Human-Agent Trust Exploitation The human oversight that is supposed to be the control becomes the weakest part of it. | An approval record with payload_hash_bound, single_use, expires_at and consumed_at, plus reviewer telemetry. |
| ASI10 Rogue Agents An agent operating outside intended scope — compromised, misconfigured, or drifted. | revocation plus kill_switch_state, and a preserved receipt chain for the forensic reconstruction. |
Why this list matters more than the frameworks
Of the three governance frameworks enterprises actually get asked about — the EU AI Act, NIST AI RMF and ISO/IEC 42001 — none was designed for agentic systems. They were written for models and management systems, not for software that plans, holds memory, calls tools and spends money on your behalf.
ASI01–ASI10 is currently the closest thing this category has to a shared vocabulary for what actually goes wrong. That is why it is worth mapping controls to it directly rather than waiting for the broader frameworks to catch up — and why ApexClaw publishes that mapping openly in the control crosswalk.
A pattern across all ten
Read the ten together and the same shape recurs: the control that failed was frequently never present. The agent was not permitted to act — nothing stopped it. Those look identical until someone asks for proof, and then they are entirely different answers.
Which is why the practical response to this list is rarely ten separate mitigations. It is three structural moves: give every agent an identity with a named owner, put a deterministic gate between the decision and the effect, and make every consequential action emit evidence — including the refusals. Most of ASI01–ASI10 becomes containable once those three exist.
Map your gaps against ASI01–ASI10Common questions
What is the OWASP Agentic Top 10?
A taxonomy of the ten most significant risks specific to agentic applications, ASI01 through ASI10. It replaces extending the LLM Top 10 by analogy.
Is it certifiable?
No. There is no OWASP certification for it. Its value is shared vocabulary and a checklist for control coverage.
How does it differ from the LLM Top 10?
The LLM Top 10 concerns model input and output. The agentic list concerns systems that act — goal hijack, privilege abuse, rogue agents, cascading failures.
Which risk is most commonly unaddressed?
ASI10, rogue agents — agents operating outside governance entirely because no inventory exists to notice them.
How do you evidence coverage?
Per-risk control mapping plus refusal receipts showing the controls actually fire.
Every public agent incident maps to a control that existed before the incident did. The failure was never novel; the missing gate was.