The OWASP Agentic Top 10, tested on one agent.
Short answer. The OWASP Top 10 for Agentic Applications lists the ten most critical security risks for AI agents. The OWASP GenAI Security Project published it in December 2025 and numbered the risks ASI01 to ASI10. It covers what goes wrong once a model can act: hijacked goals, misused tools, borrowed identities, poisoned supply chains and memory, unsafe code execution, agents that trust each other or are trusted too much, cascading failures and rogue behavior. This page shows each risk as it appears on a real agent, and what an Ex-Guardian review does about it.
ASI01Agent Goal Hijack
An email, a ticket, a web page or a tool description carries instructions, and the agent takes them as its goal.
We plant those instructions in the content the agent really reads, then record what it did with them.findings.md
ASI02Tool Misuse and Exploitation
The agent uses a tool it is allowed to use in a way nobody meant: wrong arguments, wrong target, or chained with another tool to move data out.
We map which tools combine into a path out of your data, and try it with the agent's own rights.findings.md
ASI03Identity and Privilege Abuse
The agent runs as its builder, a shared service account or an admin, so every injection inherits those rights.
We list the account, groups, tokens and scopes it really uses, and test what a hijacked session can reach.inventory.json
ASI04Agentic Supply Chain Vulnerabilities
An MCP server, package or skill changes after the review: a rewritten tool description, a typosquatted name, an unpinned update.
We fingerprint every tool description and schema, check versions are pinned, and run a rug-pull on your server to confirm the change is blocked. The lab test is in our MCP security guide.tool-baseline.json
ASI05Unexpected Code Execution
A tool runs shell commands, evaluates code or deserializes input the model wrote.
We list every tool that executes code, the account it runs as and whether it is sandboxed.inventory.json
ASI06Memory and Context Poisoning
A note, a memory entry or a retrieved document written once keeps steering the agent in later sessions.
We list every memory and retrieval source the agent reads and writes, and who else can write to them.risk-map.json
ASI07Insecure Inter-Agent Communication
Agents pass tasks and results to each other without authenticating the sender or checking the content.
Not in the review yet. Agent-to-agent links are listed in the inventory and marked Not tested in the report.inventory.json
ASI08Cascading Failures
One faulty step or a looping tool call spreads to the agents and systems downstream.
We check step limits, spend caps, timeouts and the kill switch, and whether anyone is alerted when they trip.fixes.md
ASI09Human-Agent Trust Exploitation
A person approves an action because the agent asked for it, without seeing the real arguments.
We check which actions need a human, and whether the approval shows what will really be sent, changed or deleted.findings.md
ASI10Rogue Agents
The agent drifts from what was approved: new tools, new data, a disabled guard, calls outside its normal set.
We write the SIEM rules that fire on that drift, ready for Splunk or Microsoft Sentinel.rules/
Attacked: we run the attack on your configuration. Checked: we verify the control and its settings. Watched: we write the alert rules. Risk names from the OWASP Top 10 for Agentic Applications 2026, CC BY-SA 4.0.
Where runtime controls stop.
Microsoft's open-source Agent Governance Toolkit maps its own controls to the ten risks and reports seven covered in full and three in part (its OWASP mapping). Its limitations page also states that it does not detect indirect prompt injection that corrupts the agent's reasoning, and that with no policy loaded every action is allowed.
The same holds for any runtime guard. It enforces the policy it was given, on each call. The review checks that the policy is loaded, strict and fail-closed on your agent, then attacks what a per-call policy cannot see: content that steers the agent, and chains of allowed actions that add up to a leak. For the MCP side, the MCP authorization guide shows how to test token audience and scopes on a server.
Skills, hooks and config files: the AST10 layer.
The OWASP Agentic Skills Top 10 covers the files that tell coding and desktop agents how to behave: skill manifests, hooks and settings such as .claude/settings.json. A repository can ship them, and they run with the developer's rights.
When the agent under review uses skills or local MCP servers, we check where each one comes from, what it is allowed to touch, whether it is pinned, and whether it pulls instructions from a live URL (AST01 Malicious Skills, AST03 Over-Privileged Skills, AST05 Untrusted External Instructions, AST07 Update Drift).
Evidence your SOC can read.
The evidence pack holds the session traces, tool hashes and queries behind each finding. We are aligning its trace format with the draft OWASP Agent Control Standard (v0.1.0), which records every hook and decision as OpenTelemetry spans and OCSF events, and describes the agent's models, tools and dependencies as an AgBOM in CycloneDX.
About the OWASP Agentic Top 10.
What is the OWASP Top 10 for Agentic Applications?
A list of the ten most critical security risks for AI agents, published by the OWASP GenAI Security Project in December 2025 and numbered ASI01 to ASI10: goal hijack, tool misuse, identity and privilege abuse, supply chain, unexpected code execution, memory and context poisoning, inter-agent communication, cascading failures, human-agent trust exploitation and rogue agents.
Is it the same as the OWASP Top 10 for LLM Applications?
No. The LLM Top 10 covers applications built on a language model, such as prompt injection and sensitive information disclosure. The Agentic Top 10 covers what changes when the model can act: tools, identities, memory, other agents and autonomy. An agent review needs both.
Does a runtime governance toolkit cover the Agentic Top 10?
In part. A runtime toolkit enforces a policy on each call. Its own documentation lists what it does not see, such as indirect prompt injection and chains of individually allowed actions. A review checks that the policy is loaded, strict and fail-closed on your agent, then attacks those gaps.
Is Ex-Guardian endorsed by OWASP?
No. Ex-Guardian is independent. It uses the OWASP lists as public references and maps each finding to them.
