The OWASP Agentic Top 10 is a list of the most critical security risks specific to AI agent applications. Published by the Open Worldwide Application Security Project, it extends the work done on LLM security risks to cover the unique threats that arise when language models are given tools and autonomy.
1. Agent Goal Hijacking: An attacker manipulates the agent into pursuing a different objective than intended. This happens through prompt injection, poisoned context, or manipulated tool responses.
2. Tool Misuse: The agent uses a legitimate tool in an unintended way. A file-read tool used to access sensitive configuration files. A search tool used to probe internal systems.
3. Identity and Privilege Abuse: The agent operates with more permissions than it needs, or impersonates a user to access resources beyond its authorization.
4. Memory Poisoning: An attacker corrupts the agent's memory or context window with false information that influences future decisions.
5. Cascading Failures in Multi-Agent Systems: A failure or compromise in one agent propagates to others, amplifying the impact.
6. Prompt Injection: Direct or indirect manipulation of the agent's instructions through crafted input.
7. Insufficient Monitoring and Logging: The system lacks visibility into what agents are doing, making it impossible to detect or investigate incidents.
8. Inadequate Sandboxing: The agent runs with access to resources it should not have, without isolation boundaries.
9. Supply Chain Vulnerabilities: Compromised tools, plugins, or MCP servers introduce malicious capabilities.
10. Uncontrolled Autonomy: The agent operates without appropriate limits on its scope, speed, or impact.
Each risk has corresponding mitigations in the safety stack:
| OWASP Risk | Authensor Mitigation | |-----------|---------------------| | Goal Hijacking | Aegis content scanning, policy enforcement | | Tool Misuse | Policy engine with argument-level rules | | Privilege Abuse | Tool authorization, context-based policies | | Memory Poisoning | Inbound content scanning | | Cascading Failures | Per-agent policies, cross-agent tracing | | Prompt Injection | Aegis detectors, input/output scanning | | Insufficient Monitoring | Sentinel behavioral monitoring, receipt chain | | Inadequate Sandboxing | Policy-based tool restriction | | Supply Chain | MCP gateway inspection | | Uncontrolled Autonomy | Rate limits, budget controls, approval workflows |
The OWASP Agentic Top 10 is a framework for threat modeling AI agent applications. Use it as a checklist when designing your agent's security posture. For each risk, identify whether your system is exposed and what mitigations are in place.
Not every agent faces every risk. A simple chatbot with no tools faces almost none of them. A multi-agent system with financial tools, database access, and external API calls faces all of them. Scale your defenses to your threat surface.
Explore more guides on AI agent safety, prompt injection, and building secure systems.
View All Guides