OWASP Agentic AI Top 10 Explained: ASI01–ASI10

If your application only answers questions, the LLM list covers you. The moment it can take actions, you need both. Our guide to model extraction attacks shows one LLM Top 10 risk in depth.

The OWASP Agentic AI Top 10, explained: ASI01 to ASI10 in real pipelines

Here is each risk in the OWASP Agentic AI Top 10 in plain terms, followed by what it looks like in the codebases and pipelines we see every day.

ASI01: Agent Goal Hijack

An attacker changes what the agent is trying to achieve through injected instructions in a document, an email, a web page, or another agent’s message. Agents struggle to tell instructions apart from content, so planted text can redirect a whole multi-step plan.

In your pipeline: an agent that summarizes pull requests reads a PR description containing hidden instructions, and starts approving or leaking instead of summarizing.

ASI02: Tool Misuse and Exploitation

The agent uses a tool it is allowed to use, but in a harmful way: deleting data, calling a costly API in a loop, or sending information out. No privilege is escalated; legitimate access is simply pointed at the wrong target.

In your pipeline: a coding agent with shell access runs a cleanup command against the wrong directory.

ASI03: Identity and Privilege Abuse

Agents inherit credentials, sessions, and roles, and attackers exploit those delegation chains to reach what they could not reach directly. The root cause is identity systems built for humans, applied to software that acts on its own.

In your pipeline: an agent configuration holds a long-lived token with organization-wide scope, shared across several tools.

ASI04: Agentic Supply Chain Vulnerabilities

The models, tools, plugins, MCP servers, skills and prompts that agents load come from third parties, and any of them can be malicious or tampered with. Unlike classic dependencies, agents often assemble these components at runtime.

In your pipeline: a developer installs a typosquatted agent skill whose instructions tell the agent to read credentials and post them externally.

ASI05: Unexpected Code Execution (RCE)

The agent generates or triggers code that runs where it should not: shell commands, deserialized objects, template engines, eval on model output. The result can be full host or container compromise.

In your pipeline: LLM output flows straight into eval, or an agent loads an untrusted dataset with pickle.load.

ASI06: Memory and Context Poisoning

Attackers seed the agent’s long-term memory, summaries or RAG stores with malicious data, so every future decision is skewed. Unlike a one-off prompt injection, the corruption persists across sessions.

In your pipeline: a RAG retriever ingests external documents without sanitization, and one poisoned page shapes every answer that follows.

ASI07: Insecure Inter-Agent Communication

Agents exchange messages without authentication, integrity checks, or validation, so messages can be spoofed, intercepted, or altered. The same instruction can also be read differently by different agents.

In your pipeline: a planner agent accepts tasks from any service on the internal network that speaks its protocol.

ASI08: Cascading Failures

One fault (a hallucination, a poisoned memory, a compromised tool) spreads across agents and workflows faster than humans can react. OWASP applies this category when the damage fans out beyond the original breach.

In your pipeline: one agent writes a bad config, a second deploys it, a third rolls it out to every region. We debated how to contain that blast radius in our Blast Radius SafeDev Talk.

ASI09: Human-Agent Trust Exploitation

People trust confident, well-explained agent output, and attackers or flawed designs exploit that trust to steer decisions. The human performs the final action, so the agent’s role can disappear from the audit trail.

In your pipeline: a reviewer approves an agent’s pull request because the explanation sounds right, without checking the diff.

ASI10: Rogue Agents

An agent drifts from its intended function and keeps acting harmfully, deceptively, or beyond scope. Each action may look legitimate; the overall behavior is not. ASI10 is about losing control after the drift starts, not about the initial intrusion.

In your pipeline: an agent keeps using permissions after its task ends, quietly expanding what it touches.

Of the ten risks, ASI04 is the one most teams already face every day: coding agents choosing and installing packages with nobody reviewing what gets in. We dug into exactly that in a recent SafeDev Talk. Take a look!