OWASP Agentic Top 10
from risk list to controls

ASI01: Agent Goal Hijack

Injected instructions or poisoned content redirect the agent's goals — the attacker's intent runs instead of the operator's.

Control: Treat every fetched item (web pages, files, emails, tool outputs) as data, never as instructions. Separate instruction from content channels, and scope what the agent may decide on its own.

Evidence: An injection test suite that runs in CI against every agent release, with results attached to the deployment record.

ASI02: Tool Misuse and Exploitation

The agent calls legitimate tools in unintended ways — deleting data, sending unauthorized API requests, exfiltrating through allowed channels.

Control: Least-privilege scopes per tool, parameter validation at the tool boundary, and human approval gates for destructive or irreversible actions.

Evidence: A tool permission matrix per agent: which tools, which scopes, which actions require approval.

ASI03: Identity & Privilege Abuse

Agents inherit human credentials or share service accounts, so actions are unattributable and over-privileged.

Control: A distinct, verifiable identity per agent with short-lived credentials and permissions decoupled from any employee's account.

Evidence: An agent identity inventory with credential lifetimes — no shared service accounts, no long-lived tokens.

ASI04: Agentic Supply Chain

Malicious or tampered skills, plugins, MCP servers, and registries become the attack surface — the February 2026 ClawHavoc incident and the GitSpawn class both entered through this door.

Control: Signed registries only, an AIBOM for every deployed skill pack, version pinning, and review before install — treat skills like code dependencies.

Evidence: A signed manifest per deployed skill pack, with provenance recorded at install time.

ASI05: Unexpected Code Execution

Agent-generated or agent-invoked code turns into unintended execution on the host — the AutoGPT RCE class.

Control: Run agent-invoked code in sandboxed, isolated environments (containers or VMs) with egress controls; never on the host with developer privileges.

Evidence: Sandbox configuration export plus periodic escape-test results.

ASI06: Memory & Context Poisoning

Corrupted memories, embeddings, or RAG stores bias future behavior long after the initial interaction — the Gemini memory attack pattern.

Control: Validate memory writes, tag every memory with provenance, and audit or reset persistent memory on a schedule.

Evidence: A memory provenance log: what was stored, from which source, when.

ASI07: Insecure Inter-Agent Communication

Spoofed or manipulated agent-to-agent messages misdirect entire workflows.

Control: Mutual authentication and message signing between agents; schema validation on every message boundary.

Evidence: A channel inventory listing every agent-to-agent link and its authentication status.

ASI08: Cascading Failures

A single fault propagates across agents, tools, and pipelines into system-wide impact — the multi-agent collusion scenario documented in the HuggingFace breach.

Control: Blast-radius limits per workflow, circuit breakers between agents, and rate caps that stop runaway loops.

Evidence: A failure drill report: what happens when one agent in the chain is compromised or stuck.

ASI09: Human-Agent Trust Exploitation

Confident, polished agent explanations mislead operators into approving harmful actions.

Control: Approval interfaces that show exactly what is being approved — action, scope, data — and out-of-band confirmation for high-risk operations.

Evidence: An approval log that captures the full context presented to the human at approval time.

ASI10: Rogue Agents

Agents drift from their declared mission, conceal behavior, or act self-directed — the Replit meltdown pattern.

Control: Runtime monitoring of behavior against the declared mission, drift detection, and a tested kill switch per agent.

Evidence: Drift alerts and a termination drill: prove you can stop an agent in production, today.