The OWASP Top 10 for Agentic Applications 2026 identifies ten risk areas created or amplified when AI systems plan, use tools, retain memory, communicate with other agents, execute code, and act with delegated authority. For SMBs, the core response is least agency: minimise autonomy, isolate tools, use distinct identities, validate every action at execution time, preserve audit trails, test adversarial cases, and require people for irreversible decisions.
Tech
The OWASP Top 10 for Agentic Applications 2026 identifies ten risk areas created or amplified when AI systems plan, use tools, retain memory, communicate with other agents, execute code, and act with delegated authority. For SMBs, the core response is least agency: minimise autonomy, isolate tools, use distinct identities, validate every action at execution time, preserve audit trails, test adversarial cases, and require people for irreversible decisions.
Scope and Authority
Reviewed on 30 July 2026, the OWASP Top 10 for Agentic Applications 2026 is globally peer-reviewed community security guidance. It is not a law, regulator mandate, product certification, or guarantee that a system is secure.
The ten names and descriptions below follow OWASP’s official December 2025 publication. The SMB control mapping is AI Operator’s practical interpretation. OWASP’s broader Agentic Security Initiative and Agentic AI Threats and Mitigations provide deeper threat models.
Use the voluntary NIST AI RMF to connect technical mitigations to ownership, risk assessment, measurement, and incident management.
The Ten Risks and Practical Controls
ASI01: Agent Goal Hijack
Untrusted prompts, documents, websites, messages, tool outputs, or peer agents can redirect the agent’s objective or plan.
SMB controls:
• Treat all external content as untrusted data.
• Bind each run to a declared task, allowed actions, and user.
• Detect changes between original intent and proposed action.
• Require approval for goal changes and high-impact actions.
• Test indirect prompt injection from email, files, and retrieval.
Do not ask the model alone whether its goal changed. Enforce constraints outside the model.
ASI02: Tool Misuse and Exploitation
An agent can use a legitimate tool in an unsafe way, even while remaining within technically granted permissions.
SMB controls:
• Expose narrow operations instead of full administrative APIs.
• Use read-only tools by default.
• Validate tool arguments against deterministic policy.
• Add rate, cost, and egress limits.
• Require idempotency and preview destructive changes.
• Log and reconcile side effects.
Least privilege limits access. Least agency also asks whether the autonomous action is needed at all.
ASI03: Identity and Privilege Abuse
Agents can inherit excessive user authority, reuse credentials, exploit delegation chains, or become confused deputies between systems.
SMB controls:
• Give each agent a distinct service identity.
• Use short-lived, task-scoped credentials.
• Bind delegated authority to the initiating user.
• Re-evaluate permission immediately before execution.
• Segment memory and credentials by user and task.
• Revoke access centrally.
Shared administrator keys make attribution and containment difficult.
ASI04: Agentic Supply Chain Vulnerabilities
Models, tools, MCP servers, packages, prompts, data, and hosted dependencies can change or be compromised.
SMB controls:
• Inventory and approve every agent component.
• Pin versions and verify provenance where possible.
• Review tool descriptions and permission changes.
• Monitor vendor advisories and dependency updates.
• Require incident notification and export rights.
• Maintain a fallback for mission-critical dependencies.
The NCSC secure-development guidance similarly recommends monitoring the AI supply chain and documenting data, models, prompts, assets, and failure modes.
ASI05: Unexpected Code Execution (RCE)
Agent outputs can reach interpreters, shells, templates, browsers, or tools that execute code unexpectedly.
SMB controls:
• Avoid code execution unless the workflow truly requires it.
• Use isolated, disposable sandboxes.
• Run without production credentials.
• Apply filesystem and network egress restrictions.
• Validate structured input instead of passing natural language to a shell.
• Scan outputs and require review before promotion.
A coding assistant in a sandbox and an agent running commands on a finance server are different risk classes.
ASI06: Memory and Context Poisoning
Attackers or faulty workflows can insert persistent content into memory, retrieval stores, summaries, or profiles so future runs use corrupted context.
SMB controls:
• Separate short-term task context from durable memory.
• Authenticate memory writes and record their source.
• Review high-impact or cross-user memory changes.
• Version, expire, and delete memory.
• Scan retrieved content for instructions.
• Test whether one user’s content affects another.
Treat memory as a data store with write permissions, not as harmless conversation history.
ASI07: Insecure Inter-Agent Communication
Multi-agent systems can accept forged messages, lose the original user’s authority, or trust another agent’s claim without verification.
SMB controls:
• Authenticate agent-to-agent messages.
• Carry user, purpose, scope, and trace identifiers.
• Validate message schemas.
• Re-authorise actions at each trust boundary.
• Limit delegation depth.
• Reject unverifiable or over-scoped requests.
An internal agent label is not an identity.
ASI08: Cascading Failures
One bad output, unavailable tool, or compromised agent can propagate through a chain and amplify impact.
SMB controls:
• Set maximum steps, retries, cost, and delegation.
• Use circuit breakers.
• Isolate failures by workflow and tenant.
• Validate intermediate results.
• Make side effects idempotent.
• Provide manual fallback and reconciliation.
Monitor sequences, not only individual calls.
ASI09: Human-Agent Trust Exploitation
People can over-trust polished outputs, approve without evidence, or be manipulated by an agent’s tone and authority.
SMB controls:
• Show sources, uncertainty, and proposed side effects.
• Design approval screens around decisions, not chat.
• Highlight changes, recipients, amounts, and irreversible actions.
• Train reviewers on automation bias.
• Sample approval quality.
• Avoid anthropomorphic claims that overstate capability.
Human review is not effective when the interface encourages reflexive approval.
ASI10: Rogue Agents
An agent can behave outside its intended objectives through misalignment, drift, compromise, replication, or uncontrolled autonomy.
SMB controls:
• Register every production agent and owner.
• Enforce capability and runtime boundaries outside the model.
• Monitor goal, tool, and identity drift.
• Require signed releases and versioned configuration.
• Maintain kill switches and credential revocation.
• Prohibit self-deployment and unapproved agent creation.
An agent that can change its own controls should be treated as a privileged system.
Prioritise by Workflow, Not by List Position
OWASP’s numbering is a shared taxonomy, not an SMB implementation order. Score each risk:
• Exposure: Can the workflow encounter the threat?
• Reach: Which tools, data, and people can be affected?
• Reversibility: Can the action be undone?
• Detectability: Would the business know?
• Existing control: Is prevention or containment already tested?
For a read-only knowledge assistant, context poisoning and trust exploitation may dominate. For a finance agent, identity, tool misuse, code execution, and cascading failures deserve immediate attention.
A 30-Day Control Plan
Week 1: Inventory and constrain
List agents, owners, goals, tools, credentials, memory, dependencies, and side effects. Remove unnecessary write access.
Week 2: Enforce
Add distinct identities, deterministic policy checks, task-scoped credentials, approvals, egress limits, step budgets, and circuit breakers.
Week 3: Observe and test
Instrument traces, goal and tool events, memory writes, approvals, retries, and side effects. Build one adversarial case for each applicable OWASP risk.
Week 4: Exercise and decide
Run prompt-injection, tool-failure, credential-revocation, memory-poisoning, and cascading-failure exercises. Keep the agent constrained until critical cases pass.
Evidence and Artifacts
• Agent and component inventory.
• Goal and capability statement.
• Tool and permission matrix.
• Identity and delegation design.
• Supply-chain and version record.
• Memory-write policy.
• Inter-agent message schema.
• Runtime budgets and circuit breakers.
• Adversarial evaluation set.
• Audit trail and monitoring dashboard.
• Incident and rollback plan.
• Risk acceptance and release approval.
Common Failure Modes
OWASP becomes a checkbox. The team marks every risk “addressed” without testing a control.
Prompt filtering is the only defence. Tool, identity, and execution controls remain open.
The agent inherits the user’s full session. Narrow tasks receive broad authority.
Memory has no owner or retention. Corruption persists across users and time.
The human approval screen hides side effects. Trust exploitation becomes a design feature.
All ten risks receive equal effort. Critical workflow exposures remain underfunded.
SMB OWASP Checklist
• [ ] Define and lock the agent’s task and allowed actions.
• [ ] Treat retrieved and external content as untrusted.
• [ ] Expose narrow tools with least privilege.
• [ ] Give agents distinct, revocable identities.
• [ ] Inventory and pin supply-chain components.
• [ ] Isolate all required code execution.
• [ ] Authenticate and version memory writes.
• [ ] Authenticate inter-agent communication.
• [ ] Set step, retry, cost, and delegation limits.
• [ ] Design approvals around evidence and side effects.
• [ ] Monitor goal, tool, identity, and configuration drift.
• [ ] Maintain a tested kill switch.
• [ ] Add applicable risks to regression evaluations.
• [ ] Reassess after every material change.
Pair these security controls with the ownership model in the AI agent governance guide.
FAQs
Is the OWASP Agentic Top 10 a compliance standard?
No. It is community security guidance. It can inform risk assessment, controls, vendor review, and testing, but it does not create legal compliance or certify a product.
Does the LLM Top 10 still matter for agents?
Yes. Agentic systems retain LLM risks and add autonomy, tools, memory, delegation, and multi-step side effects. Use both scopes where relevant.
Which OWASP agentic risk should an SMB fix first?
Prioritise the risk with the greatest combination of exposure, reach, irreversibility, and weak detection in the specific workflow. Write-enabled agents usually require identity and tool controls early.
Can human approval solve all ten risks?
No. Reviewers can be manipulated, overloaded, or shown incomplete evidence. Use technical identity, policy, isolation, monitoring, and recovery controls as well.
What does least agency mean?
It means avoiding unnecessary autonomy. If a deterministic rule, read-only lookup, draft, or narrow tool can achieve the result, do not grant broader planning and action authority.
Get a 20-Minute AI Workflow Audit
AI Operator can threat-model one workflow, identify applicable OWASP risks, and produce a prioritised control and test plan.