International · Risk taxonomy
OWASP Top 10 for Agentic Applications: governance guide
The OWASP Top 10 for Agentic Applications 2026 names the ten most critical security risks in AI agents that plan, call tools, keep memory and act across steps. The OWASP GenAI Security Project published it on 9 December 2025, with entries numbered ASI01 to ASI10. It extends the OWASP Top 10 for LLM Applications rather than replacing it: most agents are LLM applications too, so both lists apply.
In the FairMind catalogue: 10 requirements mapped to 56 workflows and 29 evaluations.
Source: OWASP GenAI Security Project: Top 10 for Agentic Applications for 2026
OWASP Agentic Top 10: what it asks of AI systems
The parts most relevant to governing AI systems and agents, summarised from the OWASP Top 10 for Agentic Applications 2026.
- ASI01Agent goal hijack
- Content the agent reads, such as documents, emails or tool output, redirects its objective.Mapped to: Evaluation and testing, FairMind agent self-assurance, Threat modelling, guardrails and vulnerabilities
- ASI02Tool misuse and exploitation
- The agent uses legitimate tools in unsafe ways or chains them beyond their intended purpose.Mapped to: Agent identity, access and permission bounding, Evaluation and testing, FairMind agent self-assurance, Threat modelling, guardrails and vulnerabilities
- ASI03Identity and privilege abuse
- Agents inherit, reuse or escalate credentials and permissions beyond what the task needs.Mapped to: AI inventory and intake, Accountability and oversight bodies, Agent identity, access and permission bounding, Threat modelling, guardrails and vulnerabilities
- ASI04Agentic supply chain vulnerabilities
- Compromised tools, plugins, MCP servers, models or other agents enter the agent at build or run time.Mapped to: AI inventory and intake, Agent identity, access and permission bounding, Third parties and suppliers, Threat modelling, guardrails and vulnerabilities
- ASI05Unexpected code execution
- Code the agent writes or triggers runs without adequate isolation.Mapped to: Agent identity, access and permission bounding, Responsible design and secure development, Threat modelling, guardrails and vulnerabilities
- ASI06Memory and context poisoning
- Stored memory, retrieved context or embeddings are poisoned so later decisions go wrong.Mapped to: Data governance and provenance, FairMind agent self-assurance, Threat modelling, guardrails and vulnerabilities
- ASI07Insecure inter-agent communication
- Messages between agents are spoofed, intercepted or tampered with.Mapped to: AI inventory and intake, Agent identity, access and permission bounding, Evaluation and testing, Responsible design and secure development, Threat modelling, guardrails and vulnerabilities
- ASI08Cascading failures
- A fault in one agent or step spreads across connected agents and workflows.Mapped to: Evaluation and testing, Human oversight and intervention, Incidents, concerns and reporting, Monitoring and logging, Responsible design and secure development, Threat modelling, guardrails and vulnerabilities
- ASI09Human-agent trust exploitation
- People over-trust confident agent output and approve harmful actions.Mapped to: Accountability and oversight bodies, Agent identity, access and permission bounding, FairMind agent self-assurance, Human oversight and intervention, Prohibited, manipulative and misuse risks, Threat modelling, guardrails and vulnerabilities
- ASI10Rogue agents
- Agents act outside their intended behaviour, persist, or evade oversight.Mapped to: AI inventory and intake, Human oversight and intervention, Monitoring and logging, Release, change and retirement, Threat modelling, guardrails and vulnerabilities
Evidence FairMind helps you produce
FairMind links technical evidence to OWASP Agentic Top 10 obligations for a human reviewer to accept. It is not legal advice and does not decide compliance.
- 29 evaluations mapped to ASI01 to ASI10, each with a declared metric, threshold and evaluator status
- Agent permission bounding and MCP server onboarding records, approved at the gate
- Agent registry and identity records, with an autonomy tier for each use case
- Kill-switch drills, runaway containment and incident records linked to the entries they address
OWASP Agentic Top 10 questions
How is the Agentic Top 10 different from the LLM Top 10?
The LLM Top 10 covers risks in applications that generate content. The Agentic Top 10 covers the risks that appear when a system plans, calls tools, keeps memory and acts across steps. An agent built on an LLM inherits both lists, so most teams map to both.
Is the OWASP Agentic Top 10 a compliance standard?
No. It is a voluntary risk taxonomy published under a Creative Commons licence. Teams use it to threat model agents and to show reviewers which agentic risks they test for. AIUC-1 covers similar ground as a certifiable standard with auditable requirements.
How does FairMind map the Agentic Top 10?
The catalogue maps all 10 entries to 14 common controls and 56 workflows. One workflow run counts toward every ASI entry and every other framework requirement it covers, and a person approves the record at the gate before it is filed.