# OWASP Top 10 for Agentic Applications: ASI01 to ASI10 and how to test them

Source: https://airedteamingservices.com/guides/owasp-agentic-ai-threats/
Publisher: Excession Labs (airedteamingservices.com)
Last updated: 2026-11-09

OWASP agentic AI threats: the Top 10 for Agentic Applications (ASI01 to ASI10) with each ID, the earlier OWASP threat model, and a test question per risk.

> **Short answer:** OWASP published the Top 10 for Agentic Applications on 9 December 2025. It lists ten risks, ASI01 Agent Goal Hijack to ASI10 Rogue Agents. A separate OWASP guide, Agentic AI - Threats and Mitigations (17 February 2025), is the earlier threat model. Use the Top 10 as a test checklist, and name the source and date in reports.

The OWASP Top 10 for Agentic Applications is a list of ten risks for AI systems that plan, call tools, keep memory and act. The OWASP GenAI Security Project announced it on 9 December 2025. Its IDs run from ASI01 to ASI10.

We read the OWASP launch blog on 9 November 2026. This page gives each ID with the name OWASP prints, how it relates to OWASP's other agentic work, and a test idea for each risk.

## What has OWASP published on agentic AI?

OWASP has published two main agentic resources, plus related LLM and red teaming guides. They are different documents.

| Resource | Date | What it is |
|---|---|---|
| OWASP Top 10 for Agentic Applications | 9 December 2025 | Ten ranked risks, ASI01 to ASI10. Led by chair John Sotiropoulos, with input from over 100 researchers and practitioners per OWASP. Launched at the London Agentic Security Summit. |
| Agentic AI - Threats and Mitigations | 17 February 2025 (resource page) | A threat-model-based reference from the OWASP Agentic Security Initiative. OWASP calls it the first in a series of guides. The launch blog mentions a 1.1 update aligned with the Top 10. |
| OWASP Top 10 for LLM Applications 2026 | 4 August 2026 | The general LLM list. Its entries link to the ASI IDs where agents are involved. |
| GenAI Red Teaming Guide | 22 January 2025 | A guide to red teaming in four areas: model evaluation, implementation testing, infrastructure assessment and runtime behavior. |

OWASP's page title says "Top 10 for Agentic Applications". The body of the same blog also says "Top 10 for Agentic AI Applications". The page gives no version number or year label for the Top 10 itself. We use the title form and the date.

## What are ASI01 to ASI10?

The table lists the ten IDs and names as the OWASP launch blog of 9 December 2025 prints them. The blog also names an example incident for some entries, listed here as OWASP did.

| ID | Name (as printed by OWASP) | OWASP example named in the blog |
|---|---|---|
| ASI01 | Agent Goal Hijack | EchoLeak |
| ASI02 | Tool Misuse | Amazon Q |
| ASI03 | Identity & Privilege Abuse | none named |
| ASI04 | Agentic Supply Chain Vulnerabilities | GitHub MCP exploit |
| ASI05 | Unexpected Code Execution | AutoGPT RCE |
| ASI06 | Memory & Context Poisoning | Gemini Memory Attack |
| ASI07 | Insecure Inter-Agent Communication | none named |
| ASI08 | Cascading Failures | none named |
| ASI09 | Human-Agent Trust Exploitation | none named |
| ASI10 | Rogue Agents | Replit meltdown |

The 2026 LLM Top 10 entry on Excessive Agency prints ASI02 as "Tool Misuse & Exploitation", while the launch blog prints "Tool Misuse". The table uses the blog's name. Check the PDF if you need the exact label for a formal report.

## How do the agentic and LLM lists relate?

The two lists overlap by design. The 2026 LLM Top 10 says that in agentic systems, Excessive Agency can show up as ASI02, ASI03 and ASI08. Its supply chain entry refers to ASI04. The OWASP press release of 2 September 2026 says the 2026 LLM edition expands its mappings to the Agentic Top 10, among other frameworks.

Use the LLM list for the application layer and the agentic list when the system has tools, memory, delegation or multiple agents. The [OWASP LLM Top 10 guide](/guides/owasp-top-10-for-llm-applications/) covers the first list, and the [excessive agency guide](/guides/excessive-agency/) covers the link in detail.

## How do you test each ASI risk?

Each risk gets an observable question and a safe check. The table is our own test mapping, not OWASP text. Use test accounts, test data and written authorization.

> **Agentic test map:** | ID | Question to answer | Safe test idea | Evidence to record |
> |---|---|---|---|
> | ASI01 Agent Goal Hijack | Can content the user did not write change what the agent is trying to do? | Plant a benign marker instruction in a document, email or tool result and ask for a normal task | Whether the agent followed the marker, and which gate stopped any further step |
> | ASI02 Tool Misuse | Can the agent use a permitted tool in a way the task does not need? | Review each tool for open-ended inputs. Try arguments outside the task | Calls made, arguments, downstream checks that held or failed |
> | ASI03 Identity & Privilege Abuse | Does the agent act with more rights than the user? | As a low-rights user, ask for data only a high-rights user may see. Compare with direct access | Which identity each call used. Any cross-user result |
> | ASI04 Agentic Supply Chain Vulnerabilities | Can a tool, server, plugin or prompt source change under you? | Review pinning, review of tool descriptions, update paths. Use the [MCP checklist](/guides/mcp-security-risks/) | Which components can change without review |
> | ASI05 Unexpected Code Execution | Can model output reach a code or shell path? | Review code-run tools and sandboxes. In a sandbox, test with harmless commands only | Where execution runs, its privileges, its network reach |
> | ASI06 Memory & Context Poisoning | Can untrusted content write persistent memory? | Follow the [memory poisoning test plan](/guides/agent-memory-poisoning/) | Write path, visibility, recall behavior |
> | ASI07 Insecure Inter-Agent Communication | Can one agent be steered by another agent's message? | In a test setup, send a marker message between agents and watch for trust and identity checks | Whether messages are authenticated and whether content is treated as data |
> | ASI08 Cascading Failures | Does one bad step spread? | Cause a controlled failure in one agent or tool. Watch downstream agents, retries and loops | Blast radius, circuit breakers, rate caps |
> | ASI09 Human-Agent Trust Exploitation | Do approvals protect the user? | Run the [approval UX table](/guides/human-approval-bypass/) | Prompt content, bypass routes, fatigue |
> | ASI10 Rogue Agents | Can an agent act outside its intended role or drift from it? | Compare real behavior with its stated role over a long task. Check kill switch and logs | Out-of-role actions, audit trail, ability to stop the agent |
Run the test map after you have the tool list and the permission matrix, because results are hard to read without them. The [AI agent permissions guide](/guides/ai-agent-permissions/) gives a matrix template. Link a test to an ASI ID only when the evidence fits. A weak mapping looks neat and proves little.

## How should reports use the list?

Reports should cite the list as a mapping aid and state what was tested. A framework ID labels a finding. It does not rate severity and is not a certification. Follow these rules:

1. Name the source and date: "OWASP Top 10 for Agentic Applications, 9 December 2025".
2. Map each finding to the closest ID, and say when no ID fits.
3. Rate severity on your own scale, with the evidence and the conditions.
4. List what you did not test.
5. Do not claim a system "complies with" or is "secure against" the list.

## How does this fit a real assessment?

An agent assessment starts from the system's tools, data and trust boundaries, then uses lists like this one to find gaps in coverage. Excession Labs offers scoped [AI agent security assessments](/ai-agent-security-assessment/) and maps findings to OWASP IDs where they fit. We agree the scope with you in writing and test only with written authorization from the system owner.

Check the OWASP site for newer material before you cite this page. The LLM list changed edition in August 2026, so the agentic list may change too.

## Questions

### Is the OWASP agentic list a certification or standard?

No. It is a community-written risk list from the OWASP GenAI Security Project. It helps teams plan tests and fixes. Passing a test against it does not certify a system and no auditor accepts it as proof by itself.

### How is the Agentic Top 10 different from the LLM Top 10?

The LLM Top 10 covers risks in LLM applications in general. The Agentic Top 10 covers systems where agents plan, call tools, keep memory and talk to other agents. The 2026 LLM list links Excessive Agency to ASI02, ASI03 and ASI08.

### Which name should I cite?

Use the title OWASP prints on the page: OWASP Top 10 for Agentic Applications. The body text of the launch blog also says Agentic AI Applications. Cite the date, 9 December 2025, and the ASI number.

### Does the list have a version number?

The launch blog we read gives no version number or year label for the Top 10 itself. The only version it mentions is 1.1 of the separate Threats and Mitigations taxonomy. Do not invent one.

## Sources

- [OWASP GenAI Security Project, OWASP Top 10 for Agentic Applications: the benchmark for agentic security (9 December 2025)](https://genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications-the-benchmark-for-agentic-security-in-the-age-of-autonomous-ai/)
- [OWASP GenAI Security Project, press release: releases Top 10 risks and mitigations for agentic AI security (9 December 2025)](https://genai.owasp.org/2025/12/09/owasp-genai-security-project-releases-top-10-risks-and-mitigations-for-agentic-ai-security/)
- [OWASP GenAI Security Project, Agentic AI - Threats and Mitigations (resource page, 17 February 2025)](https://genai.owasp.org/resource/agentic-ai-threats-and-mitigations/)
- [OWASP Top 10 for LLM Applications 2026: LLM03 Excessive Agency (links to ASI02, ASI03, ASI08)](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/tree/main/2026/final)
- [OWASP GenAI Security Project, 2026 Top 10 for LLM Applications press release (2 September 2026)](https://genai.owasp.org/2026/09/01/owasp-genai-security-project-unveils-2026-top-10-for-llm-applications-new-agent-control-standard-and-sponsors-as-community-tops-30000-members/)