OWASP Top 10 for
Agentic Applications:
Enterprise Breakdown

The attacker changes the goal of the agent and not only injects a single bad response. Since natural language is not typed, the agent cannot tell the difference between the instruction and the retrieved content: emails, documents, web pages, calendar invites, fake agent messages, etc. are injection vectors. This is prompt injection in the agentic world – a poisoned chatbot gives a bad response, a poisoned agent performs a bad multi-step action sequence with real tools and real effects.

ASI01 has the highest real-world exploit volume of the ten entries. OWASP's own announcement called it "the ultimate exploit" the failure state when the power of an agent is turned against its owner.

ASI02 describes two different failure modes that are often confused: agent-side misuse: the agent misuses legitimate tools in unintended or harmful ways via scope creep or attacker-provided inputs that cause legitimate tools to generate harmful outputs – the agent's goal can be legitimate but the tool use is harmful; and external exploitation: the attacker exploits the tool interface itself, without the agent, to gain access or cause harm via tool exposure vulnerabilities. 74% of practitioners deploy agents with more access than their tasks require – when an agent has database write access for a read-only task, every prompt injection is a potential data destruction event, regardless of which failure mode is in play.

Non-human identities (NHIs) are the fastest growing enterprise attack vector in 2026. Every agent is an NHI – it needs API access, machine to machine authentication and credential management that traditional IAM was not designed for. 70% of agents have more access than the equivalent human role (Teleport 2026). Only 22% of the organizations treat agents as independent identity bearing entities (Gravitee 2026).

OWASP's "Least Agency" principle frames this precisely: autonomy is a feature that should be earned, not a default setting.

The key difference from LLM03 (static pre-deployment supply chain) is that ASI04 is about dynamic runtime composition: agents discover and compose components at runtime. A properly deployed MCP server can be replaced by a malicious one, or an agent can connect to a server that has never been verified by the agent. The attack surface changes during the agent's execution.

ASI05 describes two failure modes: agents used by an attacker to run attacker-controlled code and agents that run code by themselves with unintended destructive effects. If the natural language is the interface for code generation, then the input validation does not apply and a prompt injection can cause an agent to generate and run arbitrary code that the developer or user does not want to run.

ASI01 is a hijack of a single session goal. ASI06 attacks are persistent and a poisoned memory store will poison every future session until it is detected and fixed. AgentPoison (Chen et al. NeurIPS 2024) achieved 80%+ attack success rate on RAG-based agents with < 0.1% poison rate (less than 1 poisoned document per 1000 legitimate ones) is enough to reliably poison the retrieval.

The messages between agents are not authenticated by default. An attacker who can inject in the inter-agent communication channel (or compromise an agent in a network) can spread malicious instructions to the whole fleet without re-exploit each agent. This is the worm vulnerability class for agentic AI. The Moltbook incident showed propagation at scale: 506 injections spread on 1.5M agents because there was no authentication on the inter-agent messages.

In contrast to ASI07 (attacks on the communication channel) ASI08 is about failure modes of the architecture (i.e. how the topology of the agent network increases the blast radius of a single compromised agent). A compromised orchestrator can send all the downstream specialist agents to another agent. A compromised sub-agent pollutes the shared context that all the other agents use. The blast radius of a single compromise grows with the connectedness of the agent network.

Foot-In-The-Door technique: the agent gains credibility by small, innocuous-looking interactions before asking for the harmful action the user agrees to because he trusts the agent. Multi-turn attacks have 92% success rate on 8 open-weight models (Cisco, 2026), FITD 94% on 7 models. ASI09 is a single-session attack, unlike the other attacks, it is multi-turn, each innocuous in itself, the aggregate harmful.

ASI10 has two causes – and this is the technical difference that most practitioners fail to see. The first is a chained failure: ASI01 hijacks the goal, ASI02 or ASI03 has excess tool access, ASI08 has blast radius extended. The rogue state is the final result. The second cause has no external attacker at all: misalignment or behavioral drift, an agent's autonomous decision making slowly drifts away from its intended purpose over time without an injection event. The Replit incident that OWASP cites for ASI10 is this second type – no attacker, just an agent that misread context and behaved destructively. This is what makes ASI10 different from ASI01: goal hijack requires an active external manipulator; a rogue agent can be born from inside. CyberArk's framing is for both: the agent will authenticate successfully, look legitimate and act fast. 60% of organizations cannot kill a misbehaving agent once it starts to operate (Kiteworks 2026).