OWASP Agentic AI Top 10: Production Control Map

OWASP Agentic AI Top 10 is the search name many teams use for OWASP's "Top 10 for Agentic Applications 2026." OWASP describes the framework as a peer-reviewed list of critical risks for autonomous AI systems, developed with more than 100 experts and intended to give builders and defenders practical guidance. It was published on December 9, 2025, so it is a current baseline for 2026 agent releases. Source

The list is useful because agents do more than generate text. They plan, call tools, keep memory, message other agents and take actions that can change data or spend money. OWASP's own launch note frames the entries around incidents involving goal hijacking, tool misuse, privilege abuse, supply-chain compromise, memory poisoning, cascading failures and rogue behavior. Source

This article is our production control map, not a claim that Codesprint has operated or audited a particular client agent fleet. Use it to turn the OWASP list into owners, controls and release tests for your own system.

The ten risks at a glance

• ASI01, Agent Goal Hijack: Can external content change the agent's objective?

• ASI02, Tool Misuse and Exploitation: Can the agent use a valid tool for an invalid purpose?

• ASI03, Identity and Privilege Abuse: Can a low-trust session reach privileged credentials or actions?

• ASI04, Agentic Supply Chain Vulnerabilities: Can a tool, MCP server, package or prompt source be swapped?

• ASI05, Unexpected Code Execution: Can natural language become an unplanned executable path?

• ASI06, Memory and Context Poisoning: Can hostile data persist and affect later sessions?

• ASI07, Insecure Inter-Agent Communication: Can one agent spoof or replay a request to another?

• ASI08, Cascading Failures: Can one bad signal trigger an automated chain reaction?

• ASI09, Human-Agent Trust Exploitation: Can polished output push a person into a bad approval?

• ASI10, Rogue Agents: Can the system detect concealment, misalignment or self-directed action?

OWASP's launch note names these ten entries and gives incident examples for each category. The production question is the part your team must answer with evidence, not with a policy statement. Source

Map every workflow before buying a control

Start with a workflow inventory, not a model inventory. For each agent, record its goal, input sources, available tools, credentials, memory stores, human approvals, outbound messages and irreversible actions. Then map those facts to the ASI codes. A support agent that can only read a help center has a different map from a coding agent with shell access.

Our recommendation is to create one row per workflow, not one row per model. The same model can be low risk in a drafting workflow and high risk in a payment workflow. Assign an owner for each row and mark the ASI codes that can actually occur. A risk that cannot occur still needs a short reason, such as "no persistent memory exists."

Keep the map near the code and update it when tools, prompts, models, retrieval sources or permissions change. OWASP's cheat sheet says agents should be retested after material changes to prompts, tools, memory, retrieval, policies or model providers. OWASP AI Agent Security Cheat Sheet

ASI01 to ASI03: goals, tools and identity

Goal hijack begins when untrusted content is treated as an instruction. OWASP's cheat sheet calls out direct and indirect prompt injection through user input, websites, documents and emails. Our control pattern is to separate instructions from data, label external content as untrusted, and require the execution layer to enforce policy even if the model sounds confident. OWASP AI Agent Security Cheat Sheet

Tool misuse is not fixed by asking the model to behave. The cheat sheet recommends minimum tools, per-tool permission scoping, separate tool sets for different trust levels and explicit authorization for sensitive operations. It also says authorization belongs in the execution component outside the agent's context, with fail-closed behavior for unknown tools. OWASP AI Agent Security Cheat Sheet

For identity and privilege abuse, do not let one broad token serve every agent and every user. Bind each tool call to the actor, resource, parameters, approval state and expiry. Our release test is simple: a low-trust session must not reach an admin credential even when the model requests it, and a changed parameter must require a new approval.

ASI04 and ASI05: supply chain and code execution

Agentic supply chains include more than npm packages. MCP servers, tool manifests, retrieval sources, prompt templates, model providers and inter-agent registries can all change behavior. OWASP's resource page describes the Top 10 as a practical starting point for agents that plan and act across complex workflows, which is why the inventory has to include runtime components as well as application code. Source

Our recommendation is to pin tool and server versions, review permission changes like code changes, and alert when a tool description or schema changes. Keep secrets out of prompts and tool descriptions. Treat a new tool source as untrusted until its publisher, update path and permission scope are reviewed.

Unexpected code execution needs a hard boundary. Do not let model output write directly to a shell, migration, workflow dispatch or payment call. Use typed actions, schema validation, sandboxed execution and allowlisted side effects. If generated code must run, run it without production credentials and review the egress path before any network access.

ASI06 to ASI08: memory, messages and cascades

Memory poisoning matters because bad content can outlive the first conversation. OWASP's cheat sheet recommends validating and sanitizing memory, isolating it by user or session, setting expiration and size limits, auditing for sensitive data and adding integrity checks for long-term memory. For a deeper control list, see our AI agent memory poisoning guide. OWASP AI Agent Security Cheat Sheet

Inter-agent messages need identity and replay protection, not only encryption. OWASP says receivers should authenticate communicating agents and enforce the sender's permissions before executing a request. Its guidance also warns that a valid signature does not grant permission for the requested action, and that replay checks need a bounded validity window and single-use message identifiers. OWASP AI Agent Security Cheat Sheet

Cascading failures need limits at every hop. OWASP recommends trust boundaries between agents, communication validation, execution isolation and circuit breakers. Add chain-depth, retry, token and cost limits so one compromised or confused agent cannot create unlimited downstream work. Our AI agent cost control guide covers budget limits that complement these security controls. OWASP AI Agent Security Cheat Sheet

ASI09 and ASI10: approvals and rogue behavior

Human approval is only useful when the person sees the real action. OWASP recommends explicit approval for high-impact or irreversible actions, action previews, autonomy boundaries, audit trails, interruption and rollback. Show the actor, tool, target, parameters, cost and data leaving the system before approval. OWASP AI Agent Security Cheat Sheet

Do not treat a confident explanation as evidence. The approval screen should be generated from the typed action request, not from the model's prose. Our checklist also tests whether the same approval can be reused after a parameter changes; the correct answer is no.

Rogue-agent risk is harder because the problem may appear as concealment or drift rather than a single exploit. OWASP's cheat sheet recommends logging decisions, tool calls and outcomes, tracking unusual behavior, and recording structured metadata for high-risk actions. Alerts should cover approval bypass attempts, privilege changes, abnormal tool frequency and sudden increases in high-risk actions. OWASP AI Agent Security Cheat Sheet

Turn the map into a release gate

A useful OWASP mapping ends in repeatable tests. OWASP's abuse-case matrix includes prompt override, unauthorized tool requests, privilege escalation, memory poisoning, data exfiltration, recursive tool abuse, approval bypass and multi-agent chaining. It recommends running adversarial suites in CI/CD and blocking releases when high-risk tool policies, approval logic or credential scopes change without updated tests. OWASP AI Agent Security Cheat Sheet

Our minimum release evidence includes the tested agent version, model provider, tool policy, retrieval configuration, abuse cases, expected denials, timeouts, circuit-breaker results and accepted residual risk. Save that evidence with the release. A screenshot of a chat answering correctly is not a security test.

For teams adopting the OWASP Agentic AI Top 10 for the first time, start with three gates: no broad tool scopes, no persistent memory without validation, and no high-impact action without a parameter-bound approval. Those gates cover common paths across ASI02, ASI03, ASI06 and ASI09 while the fuller program matures.

Codesprint helps teams review agent workflows, tool permissions and release gates before production. Contact us if you want a practical review of your agent map.