OWASP Top 10 for Agentic Applications:2026

ASI01:2026

Agent Goal Hijack

Agent Goal Hijack occurs when an attacker embeds prompt exploits in external data or RAG context to steer an autonomous agent away from its original user objective toward malicious tasks.

Why it matters

An agent can be coerced into revealing secrets, approving unauthorized transactions, or corrupting critical system data.

Risk-reduction focus

• Enforce goal-scoping and authorization bounds at the application layer.
• Isolate external untrusted data from system prompt instructions.
• Require human approval for high-risk goal transitions.

// Vulnerable pattern: trust request-controlled target
app.Get("/records/:id", func(c fiber.Ctx) error {
  return c.JSON(repo.Find(c.Params("id")))
})

// Fixed pattern: authorize server-side
if !policy.CanRead(c.Locals("principal"), id) { return fiber.ErrForbidden }

ASI02:2026

Tool Misuse and Exploitation

Tool Misuse and Exploitation happens when an agent invokes connected tools or APIs with unvalidated parameters, enabling an attacker to trigger harmful actions like data deletion or internal API calls.

Why it matters

Attackers leverage the agent's tool access to manipulate internal databases or exfiltrate confidential records.

Risk-reduction focus

• Enforce strict parameter schemas and reject unexpected inputs.
• Apply least privilege access to tools used by agents.
• Audit and log all tool executions.

// Vulnerable pattern: trust request-controlled target
app.Get("/records/:id", func(c fiber.Ctx) error {
  return c.JSON(repo.Find(c.Params("id")))
})

// Fixed pattern: authorize server-side
if !policy.CanRead(c.Locals("principal"), id) { return fiber.ErrForbidden }

ASI03:2026

Identity and Privilege Abuse

Identity and Privilege Abuse occurs when an agent operates with excessive privileges or shared accounts, enabling unprivileged users to execute admin actions or cross tenant boundaries via the agent's identity.

Why it matters

Attackers achieve privilege escalation or breach multi-tenant user boundaries through the agent's identity.

Risk-reduction focus

• Delegate user context explicitly to the agent.
• Prohibit shared admin or root service accounts.
• Revoke transient agent tokens upon task completion.

// Vulnerable pattern: trust request-controlled target
app.Get("/records/:id", func(c fiber.Ctx) error {
  return c.JSON(repo.Find(c.Params("id")))
})

// Fixed pattern: authorize server-side
if !policy.CanRead(c.Locals("principal"), id) { return fiber.ErrForbidden }

ASI04:2026

Agentic Supply Chain Vulnerabilities

At runtime, the agent loads a tampered plugin, model, agent card, or MCP/A2A artifact. Dynamic third-party components activate without verified provenance, integrity, or attestation.

Why it matters

Untrusted components can inject instructions, exfiltrate data, or spread compromise.

Risk-reduction focus

• Allowlist and pin runtime dependencies to reviewed versions.
• Verify provenance, signatures, and attestations before activation.
• Monitor runtime integrity and revoke compromised tools or agent connections.

// Vulnerable pattern: trust request-controlled target
app.Get("/records/:id", func(c fiber.Ctx) error {
  return c.JSON(repo.Find(c.Params("id")))
})

// Fixed pattern: authorize server-side
if !policy.CanRead(c.Locals("principal"), id) { return fiber.ErrForbidden }

ASI05:2026

Unexpected Code Execution

Unexpected Code Execution occurs when an agent generates and executes dynamic code directly on host systems without sandbox isolation, allowing attackers to achieve remote code execution.

Why it matters

An attacker achieves remote code execution (RCE) and gains full control over the underlying infrastructure.

Risk-reduction focus

• Execute agent-generated code inside network-isolated sandboxes.
• Enforce strict resource and runtime limits.
• Validate and inspect system commands prior to execution.

// Vulnerable pattern: trust request-controlled target
app.Get("/records/:id", func(c fiber.Ctx) error {
  return c.JSON(repo.Find(c.Params("id")))
})

// Fixed pattern: authorize server-side
if !policy.CanRead(c.Locals("principal"), id) { return fiber.ErrForbidden }

ASI06:2026

Memory & Context Poisoning

Memory and Context Poisoning happens when malicious data is written into an agent's long-term memory or vector store, corrupting its future reasoning and decision-making capabilities.

Why it matters

The agent produces biased decisions, outputs false guidance, or executes latent malicious instructions.

Risk-reduction focus

• Validate data integrity and permissions before storing in memory.
• Isolate memory stores between different tenants.
• Periodically audit memory quality and purge stale context.

// Vulnerable pattern: trust request-controlled target
app.Get("/records/:id", func(c fiber.Ctx) error {
  return c.JSON(repo.Find(c.Params("id")))
})

// Fixed pattern: authorize server-side
if !policy.CanRead(c.Locals("principal"), id) { return fiber.ErrForbidden }

ASI07:2026

Insecure Inter-Agent Communication

Insecure Inter-Agent Communication occurs when messages exchanged across a multi-agent network lack mutual authentication or encryption, allowing adversaries to spoof agents or tamper with commands.

Why it matters

An attacker impersonates peer agents, tampers with inter-agent messages, or injects malicious requests into the network.

Risk-reduction focus

• Encrypt transport with mTLS or TLS and verify signed messages and sender identity.
• Enforce message schemas between agents.
• Verify agent identity before processing commands.

// Vulnerable pattern: trust request-controlled target
app.Get("/records/:id", func(c fiber.Ctx) error {
  return c.JSON(repo.Find(c.Params("id")))
})

// Fixed pattern: authorize server-side
if !policy.CanRead(c.Locals("principal"), id) { return fiber.ErrForbidden }

ASI08:2026

Cascading Failures

A planner, tool, memory store, or peer agent emits a faulty or poisoned signal. Delegation, retries, and feedback loops propagate it without effective failure isolation.

Why it matters

The fault spreads across agents or workflows, causing outages, data corruption, resource exhaustion, or unsafe privileged actions.

Risk-reduction focus

• Isolate failure domains with scoped access and least privilege.
• Validate outputs and high-impact actions before propagating them downstream.
• Use circuit breakers, quotas, and fan-out limits to contain amplification.

// Vulnerable pattern: trust request-controlled target
app.Get("/records/:id", func(c fiber.Ctx) error {
  return c.JSON(repo.Find(c.Params("id")))
})

// Fixed pattern: authorize server-side
if !policy.CanRead(c.Locals("principal"), id) { return fiber.ErrForbidden }

ASI09:2026

Human-Agent Trust Exploitation

Human-Agent Trust Exploitation leverages the anthropomorphic and persuasive nature of AI agents to deceive human operators into approving harmful actions or revealing credentials.

Why it matters

Users unsuspectingly disclose credentials, authorize wire transfers, or execute untrusted files.

Risk-reduction focus

• Display clear indicators when interacting with AI agents.
• Require out-of-band verification for critical transactions.
• Train users on social engineering risks involving agents.

// Vulnerable pattern: trust request-controlled target
app.Get("/records/:id", func(c fiber.Ctx) error {
  return c.JSON(repo.Find(c.Params("id")))
})

// Fixed pattern: authorize server-side
if !policy.CanRead(c.Locals("principal"), id) { return fiber.ErrForbidden }

ASI10:2026

Rogue Agents

A compromised or misaligned agent pursues an undeclared goal while individual actions appear legitimate. Behavioral-integrity and governance controls fail to detect or contain sustained deviation from declared function and scope.

Why it matters

The agent can disclose data, spread misinformation, hijack workflows, sabotage operations, collude, or self-replicate.

Risk-reduction focus

• Attest each agent identity and its declared tools, goals, and behavior.
• Continuously monitor deviations from behavioral and governance baselines.
• Provide rapid quarantine, credential revocation, and kill switches.

// Vulnerable pattern: trust request-controlled target
app.Get("/records/:id", func(c fiber.Ctx) error {
  return c.JSON(repo.Find(c.Params("id")))
})

// Fixed pattern: authorize server-side
if !policy.CanRead(c.Locals("principal"), id) { return fiber.ErrForbidden }