Skip to content
Standards & frameworks · ASI01–ASI10

OWASP Top 10 for Agentic Applications, mapped to controls

The OWASP Top 10 for Agentic Applications is the OWASP GenAI Security Project's list of the ten most critical security risks in systems where an AI agent plans and acts on its own. The 2026 edition was published on 9 December 2025 and runs ASI01 to ASI10: goal hijack, tool misuse, identity and privilege abuse, supply chain, unexpected code execution, memory and context poisoning, insecure inter-agent communication, cascading failures, human-agent trust exploitation and rogue agents. It is a separate list from the OWASP Top 10 for LLM Applications, which it extends rather than replaces. Below, each risk is set against the AgentTrust control that addresses it — and, for five of them, against what that control does not cover.

Assess your own agentsBook a demo
Five addressed, five partial — stated per riskNot affiliated with or endorsed by OWASP
The crosswalk

Ten risks, ten controls, five stated gaps

The risk column restates OWASP's own category. The control column names something that ships and is documented. Where a control only bounds a risk rather than closing it, the limit is written out instead of left to the reader.

  1. ASI01

    Agent Goal Hijack

    Addressed
    The risk
    Instructions planted in content the agent reads — a document, a page, a ticket — redirect what it is trying to do, while it keeps using its approved tools.
    The control
    Guardrails are evaluated outside the model, against the enforcement contract rather than the agent's current instructions, so they cannot be overridden by the text the agent was given. Trust Certify's attack engine runs prompt-injection and jailbreak tests against the agent before it ships.
  2. ASI02

    Tool Misuse and Exploitation

    Addressed
    The risk
    The agent uses a legitimate, approved tool in a way it should not — wrong parameters, wrong scope, wrong volume.
    The control
    Every tool invocation is validated before execution. Tool-level enforcement contracts mark which tools are pre-approved, which need parameter validation and which require human review; on MCP, the runtime sits in front of the tool server and checks parameters against the schema before the call reaches it.
  3. ASI03

    Identity and Privilege Abuse

    Partial
    The risk
    An agent inherits credentials wider than its task needs, or escalates into permissions intended for someone else.
    The control
    Policy is bound to the agent id, so each agent is evaluated against its own contract and its own permission scope rather than the capability of the key it holds. Every action records which agent acted under which policy version.
    What it does not cover
    AgentTrust is not an identity provider. It constrains and records what an identity is permitted to do; issuing, rotating and revoking the credential stays with your IdP and secret store.
  4. ASI04

    Agentic Supply Chain Vulnerabilities

    Partial
    The risk
    A compromised tool, plugin, package or external component is used by the agent without anyone knowing it is in the path.
    The control
    The discovery engine maps which frameworks and tools each agent actually reaches, which is the inventory this risk presumes you have. Runtime contracts then bound what any tool in that path can cause, trusted or not, and every invocation is recorded with its parameters.
    What it does not cover
    No package scanning, signing or SBOM. AgentTrust limits the blast radius of a compromised component and leaves a record of it; it does not tell you the component is compromised.
  5. ASI05

    Unexpected Code Execution

    Partial
    The risk
    The agent generates and runs code or shell commands that were never meant to run.
    The control
    The decision is returned to the SDK before the downstream action executes, so an execution step can be contracted as block or escalate rather than being reached at all. Risk tiering raises the tier on operational exposure, which is what sends a code-execution action to a human instead of through.
    What it does not cover
    The sandbox is yours. AgentTrust decides whether the call happens; it does not provide the isolated runtime it happens in.
  6. ASI06

    Memory and Context Poisoning

    Partial
    The risk
    An attacker corrupts the agent's memory or its retrieval store, so the agent reasons from material that was planted.
    The control
    Validation runs evidence grounding, contradiction detection and internal consistency checks on every output, which is where a poisoned context surfaces as an unsupported or self-contradicting claim. The attack engine includes memory-poisoning tests before production.
    What it does not cover
    AgentTrust validates what the agent produces from its context. It does not own your vector store, and it cannot tell you which document was tampered with.
  7. ASI07

    Insecure Inter-Agent Communication

    Partial
    The risk
    Messages between agents in a multi-agent system are spoofed or tampered with, and a downstream agent acts on them.
    The control
    A hand-off is an action like any other: it passes the gateway, is validated against the receiving agent's contract and is recorded with both agent ids. CrewAI deployments get per-agent permission scopes so one crew member cannot act with another's authority.
    What it does not cover
    AgentTrust governs the calls that pass through it. It is not a transport and does not itself sign or encrypt the channel between two processes.
  8. ASI08

    Cascading Failures

    Addressed
    The risk
    A small error early in a plan propagates and amplifies through later steps until the outcome is far out of proportion to the mistake.
    The control
    Confidence is scored per step from seven weighted signals, so a weak step is caught where it happens rather than at the end. Retry is an explicit decision outcome instead of an unbounded loop, the reasoning engine detects decision loops before production, and the reliability engine measures variance across thousands of repeated runs rather than one passing demo.
  9. ASI09

    Human-Agent Trust Exploitation

    Addressed
    The risk
    People over-trust what the agent tells them, and the agent becomes the channel for the social engineering.
    The control
    Escalation hands a decision to a human review queue carrying the specific validation failures, the confidence breakdown by signal and the risk factors that caused it. The reviewer is shown why the system is unsure, which is the difference between a review and a rubber stamp.
  10. ASI10

    Rogue Agents

    Addressed
    The risk
    A compromised or misaligned agent keeps acting while looking entirely legitimate.
    The control
    Discovery plus an observe-only baseline produces the inventory this risk is invisible without — see shadow AI. After that, block rate and risk-tier distribution per agent id make a drifting agent visible as a change in its own numbers, and the hash-chained ledger means its history cannot be edited to match the story.

Source for the risk identifiers and titles: OWASP Top 10 for Agentic Applications for 2026, OWASP GenAI Security Project, 9 December 2025. The control mapping and the stated limits are AgentTrust's, not OWASP's, and this page is neither affiliated with nor endorsed by OWASP.

Where the controls live

Three products, ten risks

Nothing in the crosswalk is a capability built for it. Each control is part of one of the three layers and is documented there.

Trust Certify
Pre-production testing — prompt injection, jailbreak, tool abuse, memory poisoning and role escalation, plus repeated runs for variance and reasoning-loop detection. Carries ASI01, ASI06 and ASI08 before an agent ships.
Trust Runtime
The inline decision — validation, confidence, risk, and approve, block, escalate, request_evidence or retry before the action executes. Carries ASI01 through ASI05, ASI07 and ASI09 at the moment they would occur.
Trust Audit
The record — an append-only ledger with hash-chain verification on the enterprise tier, explainability per decision, and block-rate and risk-tier trends per agent. Carries ASI10 and is the evidence for all ten.

The API reference for the validation call is documented here, and the decision outcomes are here.

The other list

This is not the OWASP Top 10 for LLM Applications

They are two documents from the same project, and conflating them is the most common error in writing about either.

The LLM Top 10 is numbered LLM01 to LLM10 and addresses the model and the application built around it — prompt injection, insecure output handling, excessive agency and so on. The agentic list is numbered ASI01 to ASI10 and addresses systems that plan and take actions: tool chains, memory, multi-agent hand-offs, autonomy. The agentic list extends the LLM one; it does not supersede it, and the entries do not map one to one.

We have written at length about one entry on the older list — OWASP LLM06, Excessive Agency — and the three capability-level controls that prevent it. It is a useful companion to this page and it is about a different list.

Before you ask

The obvious questions

What is the OWASP Top 10 for Agentic Applications?
It is the OWASP GenAI Security Project's list of the ten most critical security risks in applications where an AI agent plans and acts autonomously. The 2026 edition was published on 9 December 2025 and runs ASI01 to ASI10, covering goal hijack, tool misuse, identity and privilege abuse, supply chain, unexpected code execution, memory and context poisoning, insecure inter-agent communication, cascading failures, human-agent trust exploitation and rogue agents.
Is this the same as the OWASP Top 10 for LLM Applications?
No. They are two separate lists, and the agentic list extends the LLM one rather than replacing it. The LLM Top 10 is numbered LLM01 to LLM10 and is about the model and the application around it; the agentic list is numbered ASI01 to ASI10 and is about systems that plan and take actions. An entry in one does not map one-to-one onto an entry in the other.
Can a governance layer close all ten?
No, and this page says which five it does not. Identity issuance, package provenance, the execution sandbox, the retrieval store and the transport between processes are owned by other parts of a stack. A runtime governance layer constrains what an agent may do with what it has, and records what it did — which bounds those four without closing them.
Where does an assessment start?
With an inventory. Eight of the ten risks are stated per agent, so an agent nobody has listed cannot be assessed against any of them. Running the pipeline with enforcement switched off produces that list from execution rather than from a survey.
Is AgentTrust affiliated with OWASP?
No. The risk identifiers and titles are OWASP's; the mapping to controls, and the limits stated against five of them, are ours. The list itself is published by the OWASP GenAI Security Project and should be read in full at the source.

For the governance control set these risks sit inside, see agentic AI governance. For the inventory problem that precedes all ten, see shadow AI.