# OWASP Top 10 for Agentic Applications:2026

Locale: `en`

Source: `/en/compliance/owasp-top-10/agent/`

Summary: OWASP Agentic Top 10:2026: autonomous decisions, tool execution, identity boundaries, and multi-agent risk.

On this page

1. [Overview](/en/compliance/owasp-top-10/agent/#topic-overview)
2. [ASI01:2026 Agent Goal Hijack](/en/compliance/owasp-top-10/agent/#agent-goal-hijack)
3. [ASI02:2026 Tool Misuse and Exploitation](/en/compliance/owasp-top-10/agent/#tool-misuse-exploitation)
4. [ASI03:2026 Identity and Privilege Abuse](/en/compliance/owasp-top-10/agent/#identity-privilege-abuse)
5. [ASI04:2026 Agentic Supply Chain Vulnerabilities](/en/compliance/owasp-top-10/agent/#agentic-supply-chain-vulnerabilities)
6. [ASI05:2026 Unexpected Code Execution](/en/compliance/owasp-top-10/agent/#unexpected-code-execution)
7. [ASI06:2026 Memory & Context Poisoning](/en/compliance/owasp-top-10/agent/#memory-context-poisoning)
8. [ASI07:2026 Insecure Inter-Agent Communication](/en/compliance/owasp-top-10/agent/#insecure-inter-agent-communication)
9. [ASI08:2026 Cascading Failures](/en/compliance/owasp-top-10/agent/#cascading-failures)
10. [ASI09:2026 Human-Agent Trust Exploitation](/en/compliance/owasp-top-10/agent/#human-agent-trust-exploitation)
11. [ASI10:2026 Rogue Agents](/en/compliance/owasp-top-10/agent/#rogue-agents)
12. [OWASP MCP Top 10, Agentic Skills Top 10, and AISVS 1.01](/en/compliance/owasp-top-10/agent/#owasp-mcp-and-aisvs)
13. [Implementation Checklist](/en/compliance/owasp-top-10/agent/#compliance-readiness-checklist)
14. [Related Frameworks](/en/compliance/owasp-top-10/agent/#related-compliance-frameworks)

# OWASP Top 10 for Agentic Applications:2026

A guide to the ten risk categories in the OWASP Top 10 for Agentic Applications:2026 framework, addressing autonomous AI decision-making, tool execution, identity boundaries, and multi-agent systems.

Edition 2026. Risk names follow the official OWASP publication.

ASI01:2026

## Agent Goal Hijack

Agent Goal Hijack occurs when an attacker embeds prompt exploits in external data or RAG context to steer an autonomous agent away from its original user objective toward malicious tasks.

**Risk at a glance**

| What can go wrong | Untrusted prompt inputs or RAG context manipulate the agent's objective and decision logic, causing it to abandon original instructions and pursue malicious goals. |
| --- | --- |
| Business effect | An agent can be coerced into revealing secrets, approving unauthorized transactions, or corrupting critical system data. |
| First control to verify | Enforce goal-scoping and authorization bounds at the application layer. |

[![ASI01:2026 Agent Goal Hijack: Attack entry, Trust boundary failure, Impact, Risk reduction](/assets/compliance/owasp-agent-agent-goal-hijack-en-v1.webp)](/assets/compliance/owasp-agent-agent-goal-hijack-en-v1.webp)

**ASI01:2026 Agent Goal Hijack**

Isolate external untrusted data from system prompt instructions. Require human approval for high-risk goal transitions.

- **Attack entry** — A document or tool result hides instructions that redirect the task.
- **Trust boundary failure** — Untrusted prompt inputs or RAG context manipulate the agent's objective and decision logic, causing it to abandon original instructions and pursue malicious goals.
- **Impact** — An agent can be coerced into revealing secrets, approving unauthorized transactions, or corrupting critical system data.
- **Risk reduction** — Enforce goal-scoping and authorization bounds at the application layer.

The diagram contrasts the unsafe route with the control that interrupts it. Select the image to inspect it at full size.

### Why it matters

An agent can be coerced into revealing secrets, approving unauthorized transactions, or corrupting critical system data.

### Risk-reduction focus

- Enforce goal-scoping and authorization bounds at the application layer.
- Isolate external untrusted data from system prompt instructions.
- Require human approval for high-risk goal transitions.

**Go code example for a web application using Fiber v3**

```go
// Vulnerable pattern: trust request-controlled target
app.Get("/records/:id", func(c fiber.Ctx) error {
  return c.JSON(repo.Find(c.Params("id")))
})

// Fixed pattern: authorize server-side
if !policy.CanRead(c.Locals("principal"), id) { return fiber.ErrForbidden }
```

ASI02:2026

## Tool Misuse and Exploitation

Tool Misuse and Exploitation happens when an agent invokes connected tools or APIs with unvalidated parameters, enabling an attacker to trigger harmful actions like data deletion or internal API calls.

**Risk at a glance**

| What can go wrong | An agent is tricked into calling integrated tools, database APIs, or external services with unvalidated parameters. |
| --- | --- |
| Business effect | Attackers leverage the agent's tool access to manipulate internal databases or exfiltrate confidential records. |
| First control to verify | Enforce strict parameter schemas and reject unexpected inputs. |

[![ASI02:2026 Tool Misuse and Exploitation: Attack entry, Trust boundary failure, Impact, Risk reduction](/assets/compliance/owasp-agent-tool-misuse-exploitation-en-v2.webp)](/assets/compliance/owasp-agent-tool-misuse-exploitation-en-v2.webp)

**ASI02:2026 Tool Misuse and Exploitation**

Apply least privilege access to tools used by agents. Audit and log all tool executions.

- **Attack entry** — A request induces an agent to call a tool with unsafe parameters.
- **Trust boundary failure** — An agent is tricked into calling integrated tools, database APIs, or external services with unvalidated parameters.
- **Impact** — Attackers leverage the agent's tool access to manipulate internal databases or exfiltrate confidential records.
- **Risk reduction** — Enforce strict parameter schemas and reject unexpected inputs.

The diagram contrasts the unsafe route with the control that interrupts it. Select the image to inspect it at full size.

### Why it matters

Attackers leverage the agent's tool access to manipulate internal databases or exfiltrate confidential records.

### Risk-reduction focus

- Enforce strict parameter schemas and reject unexpected inputs.
- Apply least privilege access to tools used by agents.
- Audit and log all tool executions.

**Go code example for a web application using Fiber v3**

```go
// Vulnerable pattern: trust request-controlled target
app.Get("/records/:id", func(c fiber.Ctx) error {
  return c.JSON(repo.Find(c.Params("id")))
})

// Fixed pattern: authorize server-side
if !policy.CanRead(c.Locals("principal"), id) { return fiber.ErrForbidden }
```

ASI03:2026

## Identity and Privilege Abuse

Identity and Privilege Abuse occurs when an agent operates with excessive privileges or shared accounts, enabling unprivileged users to execute admin actions or cross tenant boundaries via the agent's identity.

**Risk at a glance**

| What can go wrong | An agent runs with overprivileged credentials or shared service accounts, letting normal users trigger elevated actions through the agent. |
| --- | --- |
| Business effect | Attackers achieve privilege escalation or breach multi-tenant user boundaries through the agent's identity. |
| First control to verify | Delegate user context explicitly to the agent. |

[![ASI03:2026 Identity and Privilege Abuse: Attack entry, Trust boundary failure, Impact, Risk reduction](/assets/compliance/owasp-agent-identity-privilege-abuse-en-v1.webp)](/assets/compliance/owasp-agent-identity-privilege-abuse-en-v1.webp)

**ASI03:2026 Identity and Privilege Abuse**

Prohibit shared admin or root service accounts. Revoke transient agent tokens upon task completion.

- **Attack entry** — A low-privilege request is executed under a powerful agent identity.
- **Trust boundary failure** — An agent runs with overprivileged credentials or shared service accounts, letting normal users trigger elevated actions through the agent.
- **Impact** — Attackers achieve privilege escalation or breach multi-tenant user boundaries through the agent's identity.
- **Risk reduction** — Delegate user context explicitly to the agent.

The diagram contrasts the unsafe route with the control that interrupts it. Select the image to inspect it at full size.

### Why it matters

Attackers achieve privilege escalation or breach multi-tenant user boundaries through the agent's identity.

### Risk-reduction focus

- Delegate user context explicitly to the agent.
- Prohibit shared admin or root service accounts.
- Revoke transient agent tokens upon task completion.

**Go code example for a web application using Fiber v3**

```go
// Vulnerable pattern: trust request-controlled target
app.Get("/records/:id", func(c fiber.Ctx) error {
  return c.JSON(repo.Find(c.Params("id")))
})

// Fixed pattern: authorize server-side
if !policy.CanRead(c.Locals("principal"), id) { return fiber.ErrForbidden }
```

ASI04:2026

## Agentic Supply Chain Vulnerabilities

At runtime, the agent loads a tampered plugin, model, agent card, or MCP/A2A artifact. Dynamic third-party components activate without verified provenance, integrity, or attestation.

**Risk at a glance**

| What can go wrong | Dynamic third-party components activate without verified provenance, integrity, or attestation. |
| --- | --- |
| Business effect | Untrusted components can inject instructions, exfiltrate data, or spread compromise. |
| First control to verify | Allowlist and pin runtime dependencies to reviewed versions. |

[![ASI04:2026 Agentic Supply Chain Vulnerabilities: Attack entry, Trust boundary failure, Impact, Risk reduction](/assets/compliance/owasp-agent-agentic-supply-chain-vulnerabilities-en-v1.webp)](/assets/compliance/owasp-agent-agentic-supply-chain-vulnerabilities-en-v1.webp)

**ASI04:2026 Agentic Supply Chain Vulnerabilities**

Allowlist and pin runtime dependencies; verify signatures and attestations before activation.

- **Attack entry** — At runtime, the agent loads a tampered plugin, model, agent card, or MCP/A2A artifact.
- **Trust boundary failure** — Dynamic third-party components activate without verified provenance, integrity, or attestation.
- **Impact** — Untrusted components can inject instructions, exfiltrate data, or spread compromise.
- **Risk reduction** — Allowlist and pin runtime dependencies; verify signatures and attestations before activation.

The diagram contrasts the unsafe route with the control that interrupts it. Select the image to inspect it at full size.

### Why it matters

Untrusted components can inject instructions, exfiltrate data, or spread compromise.

### Risk-reduction focus

- Allowlist and pin runtime dependencies to reviewed versions.
- Verify provenance, signatures, and attestations before activation.
- Monitor runtime integrity and revoke compromised tools or agent connections.

**Go code example for a web application using Fiber v3**

```go
// Vulnerable pattern: trust request-controlled target
app.Get("/records/:id", func(c fiber.Ctx) error {
  return c.JSON(repo.Find(c.Params("id")))
})

// Fixed pattern: authorize server-side
if !policy.CanRead(c.Locals("principal"), id) { return fiber.ErrForbidden }
```

ASI05:2026

## Unexpected Code Execution

Unexpected Code Execution occurs when an agent generates and executes dynamic code directly on host systems without sandbox isolation, allowing attackers to achieve remote code execution.

**Risk at a glance**

| What can go wrong | An agent generates and executes Python scripts, shell commands, or queries directly on the host server without isolation. |
| --- | --- |
| Business effect | An attacker achieves remote code execution (RCE) and gains full control over the underlying infrastructure. |
| First control to verify | Execute agent-generated code inside network-isolated sandboxes. |

[![ASI05:2026 Unexpected Code Execution (RCE): Attack entry, Trust boundary failure, Impact, Risk reduction](/assets/compliance/owasp-agent-unexpected-code-execution-en-v1.webp)](/assets/compliance/owasp-agent-unexpected-code-execution-en-v1.webp)

**ASI05:2026 Unexpected Code Execution (RCE)**

Enforce strict resource and runtime limits. Validate and inspect system commands prior to execution.

- **Attack entry** — External content induces generation and execution of untrusted code.
- **Trust boundary failure** — An agent generates and executes Python scripts, shell commands, or queries directly on the host server without isolation.
- **Impact** — Untrusted code runs with process privileges and can compromise data or systems.
- **Risk reduction** — Execute agent-generated code inside network-isolated sandboxes.

The diagram contrasts the unsafe route with the control that interrupts it. Select the image to inspect it at full size.

### Why it matters

An attacker achieves remote code execution (RCE) and gains full control over the underlying infrastructure.

### Risk-reduction focus

- Execute agent-generated code inside network-isolated sandboxes.
- Enforce strict resource and runtime limits.
- Validate and inspect system commands prior to execution.

**Go code example for a web application using Fiber v3**

```go
// Vulnerable pattern: trust request-controlled target
app.Get("/records/:id", func(c fiber.Ctx) error {
  return c.JSON(repo.Find(c.Params("id")))
})

// Fixed pattern: authorize server-side
if !policy.CanRead(c.Locals("principal"), id) { return fiber.ErrForbidden }
```

ASI06:2026

## Memory & Context Poisoning

Memory and Context Poisoning happens when malicious data is written into an agent's long-term memory or vector store, corrupting its future reasoning and decision-making capabilities.

**Risk at a glance**

| What can go wrong | False data or embedded exploits corrupt an agent's short-term memory, vector stores, or long-term knowledge base. |
| --- | --- |
| Business effect | The agent produces biased decisions, outputs false guidance, or executes latent malicious instructions. |
| First control to verify | Validate data integrity and permissions before storing in memory. |

[![ASI06:2026 Memory & Context Poisoning: Attack entry, Trust boundary failure, Impact, Risk reduction](/assets/compliance/owasp-agent-memory-context-poisoning-en-v1.webp)](/assets/compliance/owasp-agent-memory-context-poisoning-en-v1.webp)

**ASI06:2026 Memory & Context Poisoning**

Isolate memory stores between different tenants. Periodically audit memory quality and purge stale context.

- **Attack entry** — False information is persisted in memory or a knowledge store.
- **Trust boundary failure** — False data or embedded exploits corrupt an agent's short-term memory, vector stores, or long-term knowledge base.
- **Impact** — The agent produces biased decisions, outputs false guidance, or executes latent malicious instructions.
- **Risk reduction** — Validate data integrity and permissions before storing in memory.

The diagram contrasts the unsafe route with the control that interrupts it. Select the image to inspect it at full size.

### Why it matters

The agent produces biased decisions, outputs false guidance, or executes latent malicious instructions.

### Risk-reduction focus

- Validate data integrity and permissions before storing in memory.
- Isolate memory stores between different tenants.
- Periodically audit memory quality and purge stale context.

**Go code example for a web application using Fiber v3**

```go
// Vulnerable pattern: trust request-controlled target
app.Get("/records/:id", func(c fiber.Ctx) error {
  return c.JSON(repo.Find(c.Params("id")))
})

// Fixed pattern: authorize server-side
if !policy.CanRead(c.Locals("principal"), id) { return fiber.ErrForbidden }
```

ASI07:2026

## Insecure Inter-Agent Communication

Insecure Inter-Agent Communication occurs when messages exchanged across a multi-agent network lack mutual authentication or encryption, allowing adversaries to spoof agents or tamper with commands.

**Risk at a glance**

| What can go wrong | Exchanges between agents in a multi-agent network lack mutual authentication, encryption, or message integrity checks. |
| --- | --- |
| Business effect | An attacker impersonates peer agents, tampers with inter-agent messages, or injects malicious requests into the network. |
| First control to verify | Encrypt transport with mTLS or TLS and verify signed messages and sender identity. |

[![ASI07:2026 Insecure Inter-Agent Communication: Attack entry, Trust boundary failure, Impact, Risk reduction](/assets/compliance/owasp-agent-insecure-inter-agent-communication-en-v2.webp)](/assets/compliance/owasp-agent-insecure-inter-agent-communication-en-v2.webp)

**ASI07:2026 Insecure Inter-Agent Communication**

Enforce message schemas between agents. Verify agent identity before processing commands.

- **Attack entry** — A peer-agent message is forged or altered in transit.
- **Trust boundary failure** — Exchanges between agents in a multi-agent network lack mutual authentication, encryption, or message integrity checks.
- **Impact** — An attacker impersonates peer agents, tampers with inter-agent messages, or injects malicious requests into the network.
- **Risk reduction** — Encrypt transport with mTLS or TLS and verify signed messages and sender identity.

The diagram contrasts the unsafe route with the control that interrupts it. Select the image to inspect it at full size.

### Why it matters

An attacker impersonates peer agents, tampers with inter-agent messages, or injects malicious requests into the network.

### Risk-reduction focus

- Encrypt transport with mTLS or TLS and verify signed messages and sender identity.
- Enforce message schemas between agents.
- Verify agent identity before processing commands.

**Go code example for a web application using Fiber v3**

```go
// Vulnerable pattern: trust request-controlled target
app.Get("/records/:id", func(c fiber.Ctx) error {
  return c.JSON(repo.Find(c.Params("id")))
})

// Fixed pattern: authorize server-side
if !policy.CanRead(c.Locals("principal"), id) { return fiber.ErrForbidden }
```

ASI08:2026

## Cascading Failures

A planner, tool, memory store, or peer agent emits a faulty or poisoned signal. Delegation, retries, and feedback loops propagate it without effective failure isolation.

**Risk at a glance**

| What can go wrong | Delegation, retries, and feedback loops propagate it without effective failure isolation. |
| --- | --- |
| Business effect | The fault spreads across agents or workflows, causing outages, data corruption, resource exhaustion, or unsafe privileged actions. |
| First control to verify | Isolate failure domains with scoped access and least privilege. |

[![ASI08:2026 Cascading Failures: Attack entry, Trust boundary failure, Impact, Risk reduction](/assets/compliance/owasp-agent-cascading-failures-en-v1.webp)](/assets/compliance/owasp-agent-cascading-failures-en-v1.webp)

**ASI08:2026 Cascading Failures**

Isolate failure domains; enforce downstream validation, circuit breakers, and fan-out limits.

- **Attack entry** — A planner, tool, memory store, or peer agent emits a faulty or poisoned signal.
- **Trust boundary failure** — Delegation, retries, and feedback loops propagate it without effective failure isolation.
- **Impact** — The fault spreads across agents or workflows, causing outages, data corruption, resource exhaustion, or unsafe privileged actions.
- **Risk reduction** — Isolate failure domains; enforce downstream validation, circuit breakers, and fan-out limits.

The diagram contrasts the unsafe route with the control that interrupts it. Select the image to inspect it at full size.

### Why it matters

The fault spreads across agents or workflows, causing outages, data corruption, resource exhaustion, or unsafe privileged actions.

### Risk-reduction focus

- Isolate failure domains with scoped access and least privilege.
- Validate outputs and high-impact actions before propagating them downstream.
- Use circuit breakers, quotas, and fan-out limits to contain amplification.

**Go code example for a web application using Fiber v3**

```go
// Vulnerable pattern: trust request-controlled target
app.Get("/records/:id", func(c fiber.Ctx) error {
  return c.JSON(repo.Find(c.Params("id")))
})

// Fixed pattern: authorize server-side
if !policy.CanRead(c.Locals("principal"), id) { return fiber.ErrForbidden }
```

ASI09:2026

## Human-Agent Trust Exploitation

Human-Agent Trust Exploitation leverages the anthropomorphic and persuasive nature of AI agents to deceive human operators into approving harmful actions or revealing credentials.

**Risk at a glance**

| What can go wrong | An adversary uses an agent's persuasive, human-like interaction to trick users into executing harmful actions. |
| --- | --- |
| Business effect | Users unsuspectingly disclose credentials, authorize wire transfers, or execute untrusted files. |
| First control to verify | Display clear indicators when interacting with AI agents. |

[![ASI09:2026 Human-Agent Trust Exploitation: Attack entry, Trust boundary failure, Impact, Risk reduction](/assets/compliance/owasp-agent-human-agent-trust-exploitation-en-v1.webp)](/assets/compliance/owasp-agent-human-agent-trust-exploitation-en-v1.webp)

**ASI09:2026 Human-Agent Trust Exploitation**

Require out-of-band verification for critical transactions. Train users on social engineering risks involving agents.

- **Attack entry** — A persuasive recommendation induces a person to approve a risky action.
- **Trust boundary failure** — An adversary uses an agent's persuasive, human-like interaction to trick users into executing harmful actions.
- **Impact** — Users unsuspectingly disclose credentials, authorize wire transfers, or execute untrusted files.
- **Risk reduction** — Display clear indicators when interacting with AI agents.

The diagram contrasts the unsafe route with the control that interrupts it. Select the image to inspect it at full size.

### Why it matters

Users unsuspectingly disclose credentials, authorize wire transfers, or execute untrusted files.

### Risk-reduction focus

- Display clear indicators when interacting with AI agents.
- Require out-of-band verification for critical transactions.
- Train users on social engineering risks involving agents.

**Go code example for a web application using Fiber v3**

```go
// Vulnerable pattern: trust request-controlled target
app.Get("/records/:id", func(c fiber.Ctx) error {
  return c.JSON(repo.Find(c.Params("id")))
})

// Fixed pattern: authorize server-side
if !policy.CanRead(c.Locals("principal"), id) { return fiber.ErrForbidden }
```

ASI10:2026

## Rogue Agents

A compromised or misaligned agent pursues an undeclared goal while individual actions appear legitimate. Behavioral-integrity and governance controls fail to detect or contain sustained deviation from declared function and scope.

**Risk at a glance**

| What can go wrong | Behavioral-integrity and governance controls fail to detect or contain sustained deviation from declared function and scope. |
| --- | --- |
| Business effect | The agent can disclose data, spread misinformation, hijack workflows, sabotage operations, collude, or self-replicate. |
| First control to verify | Attest each agent identity and its declared tools, goals, and behavior. |

[![ASI10:2026 Rogue Agents: Attack entry, Trust boundary failure, Impact, Risk reduction](/assets/compliance/owasp-agent-rogue-agents-en-v1.webp)](/assets/compliance/owasp-agent-rogue-agents-en-v1.webp)

**ASI10:2026 Rogue Agents**

Attest identity and declared behavior; monitor deviations and enable rapid quarantine, credential revocation, and kill switches.

- **Attack entry** — A compromised or misaligned agent pursues an undeclared goal while individual actions appear legitimate.
- **Trust boundary failure** — Behavioral-integrity and governance controls fail to detect or contain sustained deviation from declared function and scope.
- **Impact** — The agent can disclose data, spread misinformation, hijack workflows, sabotage operations, collude, or self-replicate.
- **Risk reduction** — Attest identity and declared behavior; monitor deviations and enable rapid quarantine, credential revocation, and kill switches.

The diagram contrasts the unsafe route with the control that interrupts it. Select the image to inspect it at full size.

### Why it matters

The agent can disclose data, spread misinformation, hijack workflows, sabotage operations, collude, or self-replicate.

### Risk-reduction focus

- Attest each agent identity and its declared tools, goals, and behavior.
- Continuously monitor deviations from behavioral and governance baselines.
- Provide rapid quarantine, credential revocation, and kill switches.

**Go code example for a web application using Fiber v3**

```go
// Vulnerable pattern: trust request-controlled target
app.Get("/records/:id", func(c fiber.Ctx) error {
  return c.JSON(repo.Find(c.Params("id")))
})

// Fixed pattern: authorize server-side
if !policy.CanRead(c.Locals("principal"), id) { return fiber.ErrForbidden }
```

## OWASP Top 10 for MCP 2025, OWASP Agentic Skills Top 10 (2026), and OWASP AISVS 1.01

[![OWASP MCP Top 10 2025 and AISVS 1.01: MCP tool and privilege risks (MCP01-MCP05), Context and control risks (MCP06-MCP10), Data, model and infrastructure (AISVS C1-C6), Runtime, agents and monitoring (AISVS C7-C12)](/assets/compliance/guide-owasp-agent-mcp-and-aisvs-en-v5.webp)](/assets/compliance/guide-owasp-agent-mcp-and-aisvs-en-v5.webp)

**OWASP MCP Top 10 2025 and AISVS 1.01**

MCP Top 10 (v0.1 Beta) with 213 active AISVS requirements in 12 chapters

- **MCP tool and privilege risks (MCP01-MCP05)**
  - Token and secret exposure, scope creep, tool poisoning, dependency tampering, command injection
- **Context and control risks (MCP06-MCP10)**
  - Intent flow subversion, weak authentication, missing audit and telemetry, shadow MCP servers, context injection and over-sharing
- **Data, model and infrastructure (AISVS C1-C6)**
  - Training data, input validation, model lifecycle, infrastructure, access control, supply chain
- **Runtime, agents and monitoring (AISVS C7-C12)**
  - Model behavior, memory and vectors, agentic security, MCP security, adversarial robustness, monitoring

For agentic systems that reach tools and data through the Model Context Protocol (MCP) and modular agent skills, STH pairs OWASP Top 10 for Agentic Applications (2026) testing with the OWASP Top 10 for Model Context Protocol 2025 (published as v0.1 Beta), the OWASP Agentic Skills Top 10 (2026), and the OWASP Artificial Intelligence Security Verification Standard (AISVS) 1.01.

- **OWASP Top 10 for MCP 2025** lists MCP01:2025 Token Mismanagement & Secret Exposure, MCP02:2025 Privilege Escalation via Scope Creep, MCP03:2025 Tool Poisoning, MCP04:2025 Software Supply Chain Attacks & Dependency Tampering, MCP05:2025 Command Injection & Execution, MCP06:2025 Intent Flow Subversion (titled Prompt Injection via Contextual Payloads on the project Top 10 tab), MCP07:2025 Insufficient Authentication & Authorization, MCP08:2025 Lack of Audit and Telemetry, MCP09:2025 Shadow MCP Servers, and MCP10:2025 Context Injection & Over-Sharing.
- **Recommended controls** The MCP project repository also publishes two recommended-control notes, Client-Side Tool Risk Gating and MCPS Cryptographic Security Layer. They are project guidance, not mandatory requirements.
- **OWASP Agentic Skills Top 10 (2026)** documents 10 behavior-layer skill risks across OpenClaw, Claude Code, Cursor, Codex, and VS Code ecosystems: AST01 Malicious Skills, AST02 Supply Chain Compromise, AST03 Over-Privileged Skills, AST04 Insecure Metadata, AST05 Untrusted External Instructions, AST06 Weak Isolation, AST07 Update Drift, AST08 Poor Scanning, AST09 No Governance, and AST10 Cross-Platform Reuse.
- **OWASP AISVS 1.01** defines 214 requirement identifiers in 12 chapters (213 are active because 10.2.6 is retired, and C10 has 39 active) with L1, L2, and L3 verification levels and Appendix C on AI-Assisted Secure Coding, covering C1 Training Data Integrity & Traceability (13 requirements), C2 Input Validation (12 requirements), C3 Model Lifecycle Management & Change Control (15 requirements), C4 Infrastructure, Configuration & Deployment Security (14 requirements), C5 Access Control & Identity for AI Components & Users (11 requirements), C6 Supply Chain Security for Models (7 requirements), C7 Model Behavior, Output Control & Safety Assurance (14 requirements), C8 Memory, Embeddings & Vector Database Security (11 requirements), C9 Orchestration & Agentic Security (37 requirements), C10 Model Context Protocol (MCP) Security (40 identifiers, 39 active), C11 Adversarial Robustness (19 requirements), and C12 Monitoring, Logging & Anomaly Detection (21 requirements).

### Implementation Checklist

Select items your organization has completed. The percentage shows selected items only and does not assess security or compliance.

0%

ASI01:2026 - Isolate untrusted external and RAG content from system instructions, and bound the agent's goal scope
          
          
            
            ASI02:2026 - Enforce strict tool parameter schemas and audit-log every tool invocation
          
          
            
            ASI03:2026 - Run agents under the delegated end-user identity, never a shared privileged service account
          
          
            
            ASI04:2026 - Inventory third-party agents, plugins, and prompt templates, and verify their signatures
          
          
            
            ASI05:2026 - Execute agent-generated code in network-isolated sandboxes with resource and runtime limits
          
          
            
            ASI06:2026 - Validate data before it is written to memory or vector stores, and isolate stores per tenant
          
          
            
            ASI07:2026 - Authenticate and encrypt inter-agent messages using mTLS or signed tokens
          
          
            
            ASI08:2026 - Cap recursion depth and tool-call counts, and deploy circuit breakers to isolate failing agents
          
          
            
            ASI09:2026 - Disclose AI interaction clearly to users and verify critical transactions out of band
          
          
            
            ASI10:2026 - Monitor agent behaviour in real time and keep an emergency kill switch ready to revoke tokens

No items selected

Select items above to track your progress.

[Request Pentest Quote](/en/#contact)

## Related Compliance Frameworks and Security Standards

- [
                OWASP Top 10 for LLM Applications:2026
                
              ](/en/compliance/owasp-top-10/llm/)
- [
                NCSA AI Security Guidelines: lifecycle and governance
                
              ](/en/compliance/ncsa-ai-security-guidelines/)
- [
                NCSA Zero Trust Guidelines
                
              ](/en/compliance/ncsa-zero-trust-guidelines/)
- [
                Does ISO/IEC 27001:2022 require penetration testing?
                
              ](/en/compliance/iso-27001/)

## Official OWASP reference

[Open the official OWASP edition ](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/)

## Official source documents

Original English-language OWASP publications, hosted on sth.sh for convenience. Check the source links for the latest editions.

[
            
              
              
              ![First-page preview of OWASP Top 10 for Agentic Applications 2026](/assets/process/compliance-sources/sth-source-owasp-agentic-top-10-2026-v1.webp)
            
          ](/assets/documents/sth-source-owasp-agentic-top-10-2026-v1.pdf)

### OWASP Top 10 for Agentic Applications 2026

By OWASP GenAI Security Project

Unmodified English-language original, Version 2026, published December 2025, 57 pages.

[Open document (PDF) ](/assets/documents/sth-source-owasp-agentic-top-10-2026-v1.pdf)
              [Download ](/assets/documents/sth-source-owasp-agentic-top-10-2026-v1.pdf)
              
              [Source ](https://genai.owasp.org/wp-content/uploads/dlm_uploads/2025/12/OWASP-Top-10-for-Agentic-Applications-2026-12.6.pdf)
              [CC BY-SA 4.0](https://creativecommons.org/licenses/by-sa/4.0/)

## PDF document

[Open in new tab ](/en/compliance/owasp-top-10/agent/)
              [Download](/en/compliance/owasp-top-10/agent/)

Open full-size image to zoom

## Need a pentest that satisfies these requirements?

Tell us about your systems and the requirements you must meet. The STH team will assess the approach and prepare a quotation.

[Request a Pentest quote](/en/#contact)

Last updated 5 November 2026