OWASP Top 10 for Agentic Applications
The OWASP Top 10 for Agentic Applications, published by the OWASP GenAI Security Project on 9 December 2025, names the ten most critical risks for AI agents, numbered ASI01 to ASI10: goal hijack, tool misuse, identity and privilege abuse, agentic supply chain, unexpected code execution, memory and context poisoning, insecure inter-agent communication, cascading failures, human-agent trust exploitation and rogue agents.
The ten risks
| ID | Risk | What it means |
|---|---|---|
| ASI01 | Agent Goal Hijack | The agent’s objective is redirected, usually by injected instructions |
| ASI02 | Tool Misuse | The agent uses legitimate tools in harmful ways |
| ASI03 | Identity & Privilege Abuse | The agent’s access is used to reach what the user could not |
| ASI04 | Agentic Supply Chain Vulnerabilities | Compromised tools, plugins, models or other agents |
| ASI05 | Unexpected Code Execution | The agent writes or runs code that does harm |
| ASI06 | Memory & Context Poisoning | Stored context is altered to influence later decisions |
| ASI07 | Insecure Inter-Agent Communication | Messages between agents are spoofed, read or changed |
| ASI08 | Cascading Failures | One agent’s error or compromise spreads through others |
| ASI09 | Human-Agent Trust Exploitation | People are manipulated into approving harmful actions |
| ASI10 | Rogue Agents | Agents acting outside their intended scope |
Using it in a review
For each agent, list what it can reach and what it can do, then walk the ten risks against that list. The useful questions are concrete: which tools can this agent call, with whose permissions, what happens if its input is hostile, and who has to approve before anything irreversible happens.
How HYDN tests it
AI red teaming runs goal-driven campaigns against agents, multi-agent systems and human-in-the-loop workflows, using the HYDN AI Attack Engine and tailored scenarios. Findings are mapped to this list.
Frequently asked questions
What makes an application 'agentic'?
It plans, uses tools, remembers context and acts with some autonomy, often alongside other agents. That gives it ways to cause harm that a chatbot answering questions does not have.
Which risks matter most?
It depends on what your agents can reach. Agents with access to money, customer data or production systems make tool misuse, privilege abuse and goal hijack the priorities.