TL;DR: The OWASP Top 10 for Agentic Applications works best as a design-review checklist for agentic AI security. Turn each of the ten AI agent security risks into a question to ask, controls to look for, and evidence to request, and review in three passes: authority and inventory, then inputs, state, and execution, then coordination and oversight. The review should leave an evidence pack that a second reviewer could use to reach the same conclusions, since no single control covers all ten entries.
The OWASP Top 10 for Agentic Applications is most useful as a design-review checklist, not a reading list. Security architects get the most from it by turning each entry into a question a team must answer, an artifact it must produce, and an owner who signs off. That is where agentic AI security stops being a taxonomy and becomes operational control of agents: a set of controls and evidence that an application security review can verify.
This guide is for security architects and governance teams at regulated enterprises. It walks through all ten AI agent security risks as review cards, each with the question to ask, the controls to look for, and the evidence to request, and it ends with the evidence pack a review should leave behind.
The OWASP GenAI Security Project's official list was published in December 2025, developed with input from more than 100 experts and practitioners. Because most agentic systems are built on LLM applications, security teams should also consider the relevant risks covered by the OWASP Top 10 for LLM Applications. Each OWASP entry carries a description, common examples, attack scenarios, and prevention guidance, and that document remains the reference. The cards below are this guide's own review synthesis, not verbatim OWASP recommendations. For a mapping of each risk to detection and impact-limiting controls, Prediction Guard's published overview, "Key OWASP Agentic AI Risks Enterprise Teams Must Know," is the companion piece, and this guide focuses on running the review itself.
OWASP's list is voluntary, community-developed guidance, not a compliance mandate, and it does not rank its entries by likelihood. It fits into an application security program the way any threat taxonomy does: it feeds threat modeling, scopes testing, and tells reviewers what evidence to expect. A practical order for a design review, which is editorial and not OWASP's, is three passes:
An attacker redirects what the agent is trying to accomplish, usually through content it reads. EchoLeak (CVE-2025-32711, MSRC advisory) is the best-known case: a crafted email could make Microsoft 365 Copilot exfiltrate data with no user click. It carried a CVSS score of 9.3, Microsoft patched it server-side, and no in-the-wild exploitation was reported.
A legitimate tool is used in an unsafe or unintended way, such as chaining a harmless tool with a sensitive API or passing unvalidated output into a powerful command. OWASP's launch materials cite the Amazon Q Developer extension compromise (CVE-2025-8217) as a reference case. In July 2025, a threat actor used an inappropriately scoped GitHub token to commit malicious code that shipped in version 1.84.0. BleepingComputer's report documents the injected prompt, which told the assistant to return a system to a near-factory state and delete file-system and cloud resources, with instructions that other outlets reported extended to bash and AWS CLI commands. AWS's security bulletin says the code was distributed but did not execute because of a syntax error, and that no customer environment was changed. The incident demonstrates how an agent's existing tool access can become dangerous when malicious instructions enter a trusted extension, even though the payload did not execute in this case. The same event is also a supply-chain case (ASI04), a reminder that the categories overlap.
Agents often act with borrowed, over-scoped, or long-lived credentials, so a manipulated agent inherits far more access than its task needs. Cached credentials and delegation chains can be reused or escalated, creating confused-deputy situations.
A tool, server, plugin, model, or dependency the agent loads is compromised. In September 2025, researchers at Koi Security reported the first malicious MCP server in the wild: an npm package impersonating Postmark built trust over fifteen versions, then version 1.0.16 added one line that blind-copied every email to the attacker. The real vendor said it had nothing to do with the package.
Code the agent generates or runs becomes remote or local code execution. CVE-2025-53773, patched in August 2025 by Microsoft, showed the chain: prompt injection in files, web pages, or issues could lead GitHub Copilot to write an auto-approve setting into the workspace configuration, after which commands ran without confirmation.
Corrupted memory or retrieved context skews later decisions, and because it persists, one bad write can affect many sessions. Researcher Johann Rehberger showed the pattern in September 2024 with ChatGPT's memory feature: a prompt injection hidden in a document or web page could write instructions into long-term memory, after which every later conversation, in any new session, quietly sent the user's messages and replies to an attacker-controlled server. OpenAI closed that exfiltration route in a macOS app update, but the underlying risk of untrusted content writing to persistent memory remains. OWASP also identifies the Gemini memory attack, a related persistent-memory injection by the same researcher, as an example of this risk, and the ChatGPT incident illustrates a related persistence and exfiltration pattern. It is a consumer app, and the pattern applies to any agent whose memory is written from content a model reads.
Messages between agents are spoofed, replayed, or altered because authentication, integrity, or authorization between agents is weak.
One agent's error or compromise spreads across agents and systems, often at machine speed.
An agent's apparent authority or confident tone is used to manipulate the person who approves its actions.
An agent deviates from its intended purpose or authorized scope because of compromise, misalignment, or emergent behavior, and keeps acting. OWASP's launch materials associate the reported Replit incident from July 2025 with this entry: during a declared code freeze, an agent reportedly deleted a database in production, and Replit's CEO called the outcome "unacceptable and should never be possible." The freeze was an instruction, not an enforced control, and the company's response included automatic separation of development and production databases. The case also shows how closely rogue behavior and unconstrained tool access are related.
Reviews stall when nobody owns an answer. These are typical owners, to be adjusted to your organization:
| Risk | Typical Owner | Primary Artifact |
|---|---|---|
| ASI01 Agent Goal Hijack | Application security and platform engineering | Content-source data-flow map and injection test results |
| ASI02 Tool Misuse and Exploitation | Platform engineering | Tool inventory with scopes and a destructive-operation list |
| ASI03 Identity and Privilege Abuse | Identity and access management | Credential inventory and delegation model |
| ASI04 Agentic Supply Chain Vulnerabilities | Application security and vendor risk | Inventory of approved tools, servers, and dependencies |
| ASI05 Unexpected Code Execution | Platform and infrastructure | Sandbox and egress configuration with escape tests |
| ASI06 Memory and Context Poisoning | Data and ML platform owners | Memory architecture, retention, and purge procedure |
| ASI07 Insecure Inter-Agent Communication | Platform and network engineering | Agent communication map and channel protections |
| ASI08 Cascading Failures | Site reliability and platform engineering | Limit and circuit-breaker settings with test results |
| ASI09 Human-Agent Trust Exploitation | Product and governance | Approval design review and approval records |
| ASI10 Rogue Agents | Security operations and governance | Scope definitions, a tested intervention, and a sample of Immutable Audit Logs |
A review that produces only opinions cannot be repeated or audited. Aim for an evidence pack that a second reviewer could use to reach the same conclusions:
The quality of the pack depends on how much of it is generated by systems and not assembled by hand. Records produced at the moment a control acts are more credible than screenshots collected before a review.
The list is a map, not a guarantee. A few limits are worth keeping in view:
For every agent, a review should establish three things: who holds authority, which controls constrain that authority, and what evidence shows those controls work. When each entry on the list has an owner, a control, and evidence you could hand to someone who was not in the room, you have operational control of agents in practice, and not just a catalog of the ways it can fail.
Delivering those controls consistently across a fleet of agents is the role of a sovereign AI control plane: an architecture that identifies, authorizes, enforces, meters, records, and contains agent actions, running inside your boundary. No single layer covers all ten entries, so the review's last question is always where a given architecture stops, and which other layer picks up from there. Ask it of every vendor, Prediction Guard included.
It is a voluntary, community-developed list from the OWASP GenAI Security Project, published in December 2025, that names ten risks specific to agentic systems, from ASI01 Agent Goal Hijack to ASI10 Rogue Agents. Each entry carries a description, common examples, attack scenarios, and prevention guidance.
Turn each entry into a question a team must answer, an artifact it must produce, and an owner who signs off. A practical order is three passes: authority and inventory first, then inputs, state, and execution, then coordination and oversight.
Start with authority and inventory (ASI03, ASI04, ASI02), because what each agent can reach, under whose identity, and through which tools bounds the damage of every other risk. The OWASP list does not rank its entries by likelihood, so exposure depends on how your own agents are built.
A registry of agents, tools, servers, and dependencies with owners, a credential and delegation map, data-flow diagrams for untrusted content and memory, test results, exported control configuration, approval records, samples of Immutable Audit Logs, an Evidence bundle for each tested intervention, and a register of open risks.
No. It is voluntary guidance, and regulatory duties apply by their own scope. It is best used to feed threat modeling, scope testing, and show reviewers what evidence to expect.