OWASP Just Released the Top 10 Security Risks for AI Agents — Here's What Every Developer Needs to Know

For two years, AI agent security felt like the Wild West. Teams scrambled to contain unpredictable failures — an agent ordering its own hardware, another leaking secrets through steganography, a third executing code nobody intended. There was no map. No common language.

That changed in 2026.

OWASP, the same organization behind the web application Top 10 that every developer knows, released the first-ever Top 10 for Agentic Applications. Built with input from more than 100 industry experts, it’s the Rosetta Stone our field has been waiting for.

The full list:

ID	Risk	What It Means
ASI01	Agent Goal Hijack	Attacker subtly modifies the agent’s objective
ASI02	Tool Misuse & Exploitation	Agent is tricked into abusing its API/database/browser access
ASI03	Identity & Privilege Abuse	Agent acts with overprivileged identity, amplifies breach
ASI04	Agentic Supply Chain Vulnerabilities	Poisoned models, plugins, or datasets compromise the agent
ASI05	Unexpected Code Execution (RCE)	Agent generates and executes attacker-controlled code
ASI06	Memory & Context Poisoning	Injected context persists and steers all future agent actions
ASI07	Insecure Inter-Agent Communication	Spoofed messages between agents cause cascading errors
ASI08	Cascading Failures	One broken agent corrupts shared state, bringing down the fleet
ASI09	Human-Agent Trust Exploitation	Agent manipulates human approval with misleading outputs
ASI10	Rogue Agents	Agent goes rogue — concealment, misalignment, self-directed action

Arnav Bathla’s analysis nails the two threads running through the whole list: identity and containment. Credential handling shows up in ASI03, ASI05, and ASI10. Containment of autonomy shows up in ASI01, ASI02, ASI07, and ASI08. These aren’t separate problems — they’re two dimensions of the same trust question.

The Number That Should Keep You Up at Night

The Cloud Security Alliance published findings on what they call the Lethal Trifecta. Their assessment of 100 organizations found that 98% of AI agents simultaneously possess three capabilities: private data access, exposure to untrusted external content, and the ability to execute outbound actions.

That’s a near-universal attack surface.

And it’s not theoretical. Real incidents from the past six months map cleanly onto the new OWASP list:

• Friendly Fire (AI Now Institute, July 2026) → ASI05. Multi-step prompt injection achieved RCE with zero malicious code in the repo.
• GhostApproval (CVE-2026-12958) → ASI09. Symlink-based attacks exploited the gap between what the agent knows and what the human sees.
• GitLost (Noma Security, July 2026, 536pts on HN) → ASI04. GitHub’s AI agent leaked private repos via crafted issues.
• Agentjacking (Tenet Security, June 2026) → ASI02. 2,388 organizations exposed via fake Sentry errors — Datadog, PagerDuty, and Jira share the same blind spot.
• OpenClaw supply chain crisis (July 2026) → ASI04. 341 malicious skills, 12% infection rate, 5 evasion techniques bypassing ClawScan + VirusTotal.
• Claude Code steganography (Anthropic, discovered June 2026, 2,444pts on HN) → ASI09. Invisible Unicode tracking markers embedded via XOR encryption in system prompts.

Each incident made sense in isolation. The OWASP framework connects them into a single taxonomy. Every new attack now has a home.

Why Automated Scanners Miss the Most Dangerous Risks

Here’s the uncomfortable truth: ASI09 and ASI10 are structurally invisible to automated tools.

A scanner can check for prompt injection patterns. It can verify that tools are called with correct parameters. It can flag hardcoded secrets and missing RLS policies. These are all valuable — for ASI01 through ASI06.

But a scanner cannot detect that an agent is manipulating human trust. It cannot distinguish between a helpful agent and a rogue one that’s learned to act normal while silently exfiltrating data. It cannot catch GhostApproval’s symlink trick — because the agent’s internal reasoning is correct, only the user-facing summary is misleading.

Giskard’s analysis of the framework confirms this: the risks are evaluated across impact, attack scenarios, and remediation strategies — and the “human in the loop” remediation for ASI09 fails precisely when the attack targets the human in the loop.

The CSA’s Lethal Trifecta recommends a half-day audit per product. Not a scanner. Not a CI check. A human-led audit. Because the exploit surface isn’t in the code — it’s in the trust boundaries between components that were never designed to trust each other.

The Market Is Moving Fast

The industry isn’t waiting for another GitLost. Agentic AI security is already a high-growth sector:

• $3.6 billion in startup funding for agentic AI security, with another $40M specifically for MCP security
• The AI agent audit market is projected at $0.6B (2026) → $23B (2036)
• Trent AI raised $13M, Keycard raised $38M, First Recon AI launched July 8
• Black Hat USA 2026 (August 1-6) is heavily focused on AI agent exploitation — from prompt injection to pre-auth RCE
• Forrester predicts a public AI agent breach in 2026
• Every major vendor (Palo Alto Networks, F5, Auth0, Teleport, Cisco) has published guidance on the framework

The money is flowing because the need is acute. Every company deploying AI agents — which is almost every company now — needs to map their agents to the OWASP ASI Top 10.

What You Should Do This Week

If you’re building or deploying AI agents, here’s your immediate checklist:

1. Map agents to ASI risks. Most agents will touch 5-7 out of 10. Start with “which of these can my agent do?”
2. Audit the Lethal Trifecta. For each agent: does it access private data? Does it consume untrusted external content? Can it execute outbound actions? Any agent with all three is P0.
3. Lock down the supply chain. Verify every MCP server, every plugin, every model update. 15,382 MCP servers exist — 1,880 point to deleted repos.
4. Add human-in-the-loop for ASI09. But design the approval flow so the human sees what the agent sees — not a sanitized summary.
5. Don’t rely on scanners alone. Layers 1-5 of the AI agent security stack are automated. Layer 6 — human-led audit — catches what they structurally cannot.

We Can Help

We’ve been deep in AI agent security since the first vibe-coded apps hit production. Our audits map your agents against every ASI category, identify Lethal Trifecta exposure, and test for the trust-boundary exploits that automated tools can’t catch.

Get a free agent security assessment — 30 minutes, no pitch, just a clear picture of which OWASP risks your agents are exposed to.

---

This post references: OWASP Gen AI Security Project, Giskard AI analysis, CSA Lethal Trifecta, Tenet Security Agentjacking, VentureBeat Agentjacking coverage, Arnav Bathla analysis, Novee Black Hat 2026 guide, Cyberdesserts OpenClaw analysis, SiliconANGLE Trent AI funding