The OWASP Top 10 for Agentic Applications maps ten risks that mostly cannot be fixed with prompt engineering. Here is how ASI01-ASI10 map to infrastructure-layer controls.
OWASP now maintains two separate top-10 lists for AI. The GenAI LLM Top 10 covers risks in LLM applications that respond to prompts. The OWASP Top 10 for Agentic Applications targets a different threat surface: systems that plan, act, and make decisions across complex workflows.
The threat model changes because the attack surface changes. An LLM application receives a prompt and returns text. An agentic system receives a goal, selects tools, calls APIs, and executes multi-step plans with minimal human oversight. It is no longer just about what an agent can access, but how much freedom it has to act on that access without checking back with you.
The OWASP agentic AI list introduces a governing principle called Least Agency. Least Privilege limits what permissions an entity has statically. Least Agency adds a temporal and decision layer: agents cannot make high-impact decisions autonomously. The implication is structural. Autonomy is a feature that should be earned, not a default setting. You need an enforcement layer that can grant and revoke that autonomy in real time. Prompt engineering cannot do that.
The OWASP Top 10 for Agentic Applications 2026 ranks risks from most critical to least:
| Risk | Name | What It Means |
|---|---|---|
| ASI01 | Agent Goal Hijack | An attacker tricks the agent into changing its main goal or following new, hidden instructions |
| ASI02 | Tool Misuse and Exploitation | An agent applies a legitimate tool in an unsafe or unintended way, leading to data exfiltration or workflow hijacking |
| ASI03 | Identity and Privilege Abuse | An agent borrows too much power or uses old credentials to perform actions it should not be allowed to do |
| ASI04 | Agentic Supply Chain Vulnerabilities | Risks from third-party agents, tools, or prompt templates that may be malicious or tampered with at runtime |
| ASI05 | Unexpected Code Execution (RCE) | The agent generates and runs a command that lets an attacker take over the server or system |
| ASI06 | Memory and Context Poisoning | Bad data is planted in the agent's memory, causing it to make biased or unsafe decisions later on |
| ASI07 | Insecure Inter-Agent Communication | Exchanges between agents that lack proper authentication or integrity, allowing spoofing or message interception |
| ASI08 | Cascading Failures | A single fault propagates and amplifies across autonomous agent networks, leading to system-wide impact |
| ASI09 | Human-Agent Trust Exploitation | Exploiting the anthropomorphism and persuasive nature of agents to manipulate human users into unsafe actions |
| ASI10 | Rogue Agents | Compromised agents that deviate from their intended scope, acting harmfully or pursuing hidden, deceptive goals |
Walk through that list and a pattern emerges. ASI06 and ASI09 touch the model layer (poisoned context, manipulated trust). The remaining eight are infrastructure problems. Prompt tuning will not prevent an agent from borrowing a user's session (ASI03), executing unsigned third-party code (ASI04), or propagating a fault across a multi-agent network (ASI08).
The top two risks share a common failure mode. Agents process natural language. They cannot reliably distinguish system instructions from malicious payloads injected into tool outputs, retrieved documents, or user messages. Filtering prompts is insufficient because the attack surface extends to every input the agent consumes.
The mitigation is an Intent Gate: agents must not perform high-impact or irreversible actions (like moving money, deleting records, or changing system configs) without a secondary check. Consider what this means in practice. An agent should not transfer $100,000 on its own, should not delete entire databases on corrupt input, should not grant admin access without human review.
An Intent Gate cannot live inside the agent itself. A hijacked agent will bypass its own guardrails. The gate must sit in the infrastructure layer, between the agent and the tool it is trying to invoke.
One pattern that implements this is Asynchronous Authorization (CIBA), where the agent requests an action, sits in a "pending" state, and only proceeds after the human approves on their device. The agent never holds the approval power. The infrastructure does.
This is where an AI gateway earns its role. SHIM is an enterprise gateway for AI that eliminates redundant API calls, enforces GDPR compliance, and provides full visibility into AI traffic, with built-in PII redaction. That interception point, between your application and LLM providers, is exactly where intent validation and step-up authentication belong.
These two risks are inseparable. ASI03 targets single-agent identity: an agent borrows too much power or uses old credentials to act beyond its scope. ASI07 targets multi-agent identity: exchanges between agents that lack proper authentication or integrity, allowing spoofing or message interception.
Both are structural. Editing the agent's system prompt will not fix them.
The identity mitigation has three parts. First, agents need their own managed identity with restricted scopes instead of borrowing a user's session. Second, credentials should be task-scoped tokens: short-lived credentials issued for specific, time-limited tasks with minimal required permissions. Third, inter-agent traffic should use mutual TLS (mTLS), which requires both agent and service to cryptographically verify each other's identity.
Together, these create a defense-in-depth: authentication (mTLS) + authorization (task-scoped tokens) + observability (audit logging). All three are infrastructure-layer controls. They require a gateway or control plane that manages agent identities, issues scoped tokens, and terminates mTLS connections. For a deeper look at how these identity controls fit into the broader agent security picture, we covered the enforcement patterns in our agent security guide.
These four risks span different attack surfaces but share a property: they are only detectable and containable at the control plane.
ASI04 (Supply Chain). Third-party agents, tools, or prompt templates may be malicious or tampered with at runtime. Runtime is the key word. Static dependency scanning catches known vulnerabilities at build time. It does not catch a tool that was safe yesterday and compromised today. Runtime verification requires a gateway that inspects tool calls as they happen.
ASI05 (RCE). An agent generates and runs a command that lets an attacker take over the server or system. Sandboxing code execution is an infrastructure decision. The agent does not sandbox itself.
ASI08 (Cascading Failures). A single fault propagates and amplifies across autonomous agent networks. Circuit breakers, rate limits, and blast-radius controls are network-level constructs. They belong in the infrastructure that manages agent communication.
ASI10 (Rogue Agents). Compromised agents deviate from their intended scope, acting harmfully or pursuing hidden, deceptive goals. Detecting rogue behavior requires watching traffic patterns over time. As Human Security observes, many of the risks in the OWASP Top 10 for Agentic Applications 2026 show up as autonomous traffic whose goals have been hijacked, whose tools are being misused, or whose behavior has drifted into "rogue" territory while still looking superficially legitimate. Static rules cannot catch that. A monitoring layer that establishes behavioral baselines across agent traffic is the detection mechanism.
Building these controls into each agent independently is impractical. Centralizing them at the gateway or control plane is the pattern that scales. Our guide to AI agent guardrails covers the enforcement mechanisms in more detail.
Two OWASP agentic AI risks sit closer to the model itself.
ASI06 (Memory and Context Poisoning).Bad data planted in the agent's memory causes it to make biased or unsafe decisions later on. This targets the retrieval layer: vector stores, conversation history, cached tool outputs. The mitigation is context integrity checks, validating the provenance and freshness of retrieved data before it enters the agent's context window.
ASI09 (Human-Agent Trust Exploitation). Exploiting the anthropomorphism and persuasive nature of agents to manipulate human users into unsafe actions. This is a design problem as much as a technical one. The mitigation is transparency: making it clear to users when they are interacting with an agent, what the agent can and cannot do, and when the agent is uncertain.
Both benefit from infrastructure support (output scanning can flag manipulation patterns, and context validation can happen at the gateway), but they also require application-level design decisions that sit outside the control plane.
The pattern across ASI01 through ASI10 is consistent. The majority of risks require an enforcement layer between agents and their environment. Map the risks to the infrastructure capabilities they demand:
| Capability | Risks Addressed | What It Does |
|---|---|---|
| Intent gates and step-up auth | ASI01, ASI02 | Blocks high-impact actions without human or policy approval |
| Managed agent identity | ASI03, ASI07 | Issues task-scoped tokens, enforces mTLS between agents |
| Runtime supply chain verification | ASI04 | Validates tools and templates at invocation time |
| Sandboxed execution | ASI05 | Isolates code execution from host systems |
| Circuit breakers and rate limits | ASI08 | Contains fault propagation across agent networks |
| Behavioral monitoring | ASI10 | Detects deviation from established agent baselines |
Microsoft validated this architecture pattern when it published guidance on addressing ASI01 through ASI04 in the context of Copilot Studio. The mitigations are platform-level controls.
Implementing Least Agency means having task-scoped tokens, approval workflows for high-impact actions, and audit logging of all agent decisions for human review. That sentence describes a gateway. If your AI governance framework does not include an infrastructure layer that can enforce these controls across every agent in your stack, the OWASP agentic AI list is telling you to build one.