Agentic Security · 2026 edition
OWASP GenAI Security Project's Top 10 for autonomous AI agents, covering goal hijacking, tool misuse, identity abuse, memory poisoning, and rogue agent behavior.
Official OWASP list| Rank | Risk | Summary | Details |
|---|---|---|---|
| 01 | Agent Goal Hijack | Attackers redirect an agent's objectives or decision path through content it reads, such as documents, emails, web pages, or tool output. | Details |
| 02 | Tool Misuse and Exploitation | Agents use legitimate tools in unsafe or unauthorized ways, such as deleting data, sending messages, or chaining tools to reach unintended outcomes. | Details |
| 03 | Identity and Privilege Abuse | Agents inherit or accumulate broad credentials, act with a user's full privileges, or are impersonated, which enables privilege escalation and confused-deputy attacks. | Details |
| 04 | Agentic Supply Chain Vulnerabilities | Compromised or malicious tools, MCP servers, plugins, prompts, models, or other agents that an agent loads at runtime introduce attacker-controlled behavior. | Details |
| 05 | Unexpected Code Execution (RCE) | Agents generate or trigger code, shell commands, or deserialization that runs without adequate validation or isolation. | Details |
| 06 | Memory and Context Poisoning | Malicious or false information written into an agent's short- or long-term memory, RAG stores, or shared context corrupts its future reasoning and actions. | Details |
| 07 | Insecure Inter-Agent Communication | Messages between agents are spoofed, intercepted, replayed, or manipulated because they lack authentication, integrity, and authorization. | Details |
| 08 | Cascading Failures | An error, hallucination, or compromise in one agent propagates through connected agents and automated workflows, amplifying the impact. | Details |
| 09 | Human-Agent Trust Exploitation | People over-trust confident agent outputs or are manipulated by a compromised agent into approving harmful actions or disclosing information. | Details |
| 10 | Rogue Agents | Agents operate outside their intended policy because of compromise, misalignment, or behavioral drift, and pursue actions their operators did not authorize. | Details |
