Agentic AI systems — LLM-driven agents that plan, use tools, call APIs, and act with real-world consequences — introduce risks that go beyond traditional LLM Top 10 concerns. The OWASP Top 10 for Agentic AI (Agentic-Top10-2026) catalogs the ten most critical categories, each rated by severity and mapped to concrete mitigations across foundational, hardening, and advanced tiers.
The 10 Agentic AI risk categories
ASI01 Agent Goal Hijack Critical
Attackers redirect an agent's objectives or decision logic through direct or indirect prompt injection, poisoned content, malicious documents, or crafted tool outputs. The agent continues operating normally from the outside while serving the attacker's intent.
ASI02 Tool Misuse & Exploitation Critical
Agents misuse legitimate tools due to prompt manipulation, goal hijack, misalignment, or unsafe delegation — calling tools with destructive parameters, chaining tools in unexpected sequences, or operating tools far beyond their intended scope.
ASI03 Identity & Privilege Abuse Critical
Agents inherit human or system credentials — session tokens, API keys, SSH keys, delegated permissions — and attackers exploit weak privilege boundaries to use those credentials beyond their intended scope, enabling lateral movement.
ASI04 Agentic Supply Chain Vulnerabilities High
Malicious or compromised tools, MCP servers, prompt templates, model files, or agent personas introduced into the runtime supply chain alter agent behaviour or expose data — often fetched dynamically at runtime with no static review.
ASI05 Unexpected Code Execution Critical
Agents that generate or execute code — for workflow automation, scripting, data processing — become remote code execution gateways when crafted prompts or poisoned inputs cause them to run attacker-controlled logic.
ASI06 Memory & Context Poisoning High
Persistent corruption of agent memory, RAG stores, embeddings, or contextual knowledge — unlike prompt injection, the effect persists across sessions, slowly shifting agent behaviour or leaking secrets over time.
ASI07 Insecure Inter-Agent Communication High
Agent-to-agent (A2A) communication channels lacking strong authentication, encryption, or schema validation enable spoofing, replay attacks, protocol downgrade, and agent-in-the-middle attacks that misdirect entire multi-agent workflows.
ASI08 Cascading Agent Failures High
Single-point faults — a poisoned memory entry, a bad plan, a compromised tool — propagate through multi-agent workflows and amplify into system-wide incidents. Especially critical in OT environments.
ASI09 Human-Agent Trust Exploitation Medium
Users anthropomorphise agents — trusting their fluency, apparent expertise, and persuasive outputs — enabling hijacked agents to manipulate humans into approving malicious commands, sharing sensitive data, or performing harmful actions.
ASI10 Rogue Agents Critical
Malicious or compromised agents that appear compliant on the surface but pursue hidden goals, hijack workflows, or systematically deviate from their intended purpose — often the end-state of a successful ASI01 or ASI06 attack.
Mapped to 25 industry frameworks
Every Agentic AI risk category above is mapped, control-by-control, to frameworks including NIST AI RMF, ISO/IEC 42001, MITRE ATLAS, AIUC-1, OWASP ASVS, EU AI Act, and 19 more — with severity, mitigation tier, and cross-references to the OWASP LLM Top 10 and DSGAI. Explore the full AI standards crosswalk or use the interactive tool below.