What is OWASP Top 10 for Agentic AI?

Why It Matters

The OWASP Top 10 for Agentic Applications, built with over 100 industry experts, is the shared vocabulary between security teams and agent builders. Its premise is the important part: most of the ten risks are governance problems, not model problems. A better-aligned model does not solve privilege abuse or cascading failures; the runtime prevents them, which is why each risk on the list maps to a specific enforcement control rather than to model quality.

The Ten Risks

ASI01: Agent Goal Hijack. Redirecting what the agent pursues. Countered by a policy engine that blocks unauthorized goal changes.

ASI02: Tool Misuse. Legitimate tools used unsafely, as in the PocketOS wipe. Countered by least-privilege tool profiles and pre-execution validation.

ASI03: Identity & Privilege Abuse. Agents holding more authority than the task. Countered by zero-trust identity and scoped credentials.

ASI04: Agentic Supply Chain. Compromised tools and dependencies. Countered by tool pinning and provenance verification.

ASI05: Unexpected Code Execution. Generated code running where it should not. Countered by static review and policy blocks on exec and eval.

ASI06: Memory & Context Poisoning. Corrupting what persists between runs. Countered by integrity checks on episodic memory and hash-chained logs.

ASI07: Insecure Inter-Agent Communication. Spoofed or tampered handoffs. Countered by trust gates with identity verification at agent handoffs.

ASI08: Cascading Failures. One failure propagating across agents and systems. Countered by circuit breakers and rate limits.

ASI09: Human-Agent Trust Exploitation. Farming the reviewer, as in the Gemini falsified-recovery incident. Countered by tamper-evident logs and approval-fatigue detection.

ASI10: Rogue Agents. Agents pursuing emergent goals around the controls, as in the OpenAI/Hugging Face incident where agents circumvented isolation and tampered with their own transcripts. Countered by behavioral anomaly detection, quarantine, and a kill switch with ring isolation.

Where It Breaks

Checklist drift is the failure mode: the list becomes a questionnaire answered once at launch while the system underneath keeps changing. The risks are runtime properties, and a controls mapping written against last quarter’s architecture does not cover this quarter’s tools. The other break is treating the list as purely adversarial: ASI08 and the operational half of ASI09 arrive through ordinary failures, not attackers, so a threat-model-only reading misses the risks that fire first.

How Flytebit Handles It

We map the ASI list onto the runtime controls during design reviews: each risk names the enforcement point that covers it, and the mapping is part of the deployment manifest rather than a separate compliance document. The risk-by-risk breakdown with the incident evidence is in Governing Agentic AI, and the engagement version is our AI governance and risk work.