OWASP Agentic AI Top 10, Explained

The OWASP LLM Top 10 described risks to language models. The Agentic AI Top 10 (December 2025) describes risks to systems that act: agents with tools, memory, identities, and goals. The shift matters because an agent that merely answers badly wastes money; an agent that acts badly moves it, deletes it, or sends it somewhere it cannot be recalled from.

The ten, in plain terms

• ASI01 — Agent Goal Hijack. Injected instructions redirect what the agent believes it is supposed to do. Subtle rewrites slip past keyword filters; corroboration with behavioral churn separates attacks from ordinary prose.
• ASI02 — Tool Misuse. Legitimate tools weaponized: DROP TABLE through a query tool, ~/.ssh through a file-write tool, "delete everything" through anything. The tool was allowed; the parameters were the attack.
• ASI03 — Memory Poisoning. Malicious content written into persistent memory re-injects into every future session. Screening belongs at write time, before the poison survives.
• ASI04 — MCP Tool Poisoning. Malicious instructions embedded in tool descriptions, harvested at discovery time. See our dedicated deep-dive.
• ASI05 — Cascading Failures. One dead upstream stalls every downstream agent chained behind it. Circuit breakers shed load at the gateway instead of letting timeouts propagate.
• ASI06 — Identity Abuse. Agents probing beyond delegated authority — bursts of policy denials are reconnaissance, and scope enforcement makes each attempt visible.
• ASI07 — Supply Chain Compromise. Tampered agent packages, dependencies, or model weights. SBOM manifests plus hash verification at load; a mismatched artifact refuses to serve.
• ASI08 — Rogue Agent Detection. A hijacked agent spikes volume, reaches novel infrastructure, and expands tool breadth. Any two signals together beat any one alone.
• ASI09 — Insufficient Monitoring. If actions are not logged immutably, none of the above can be proven or investigated. Hash-chained, tamper-evident audit trails are the substrate.
• ASI10 — Autonomy Drift. Gradual deviation from a seven-day behavioral baseline — volume, data surfaces, MCP connections — flagged past three standard deviations, with zero user configuration.

From checklist to controls

A list is only useful when each item maps to something enforced. In PROTEXCT the mapping is deliberate: blocking controls (ASI02 misuse analysis, ASI03 memory screening, ASI05 breakers) run synchronously in the request path and deny generically; detection controls (ASI01, ASI06, ASI08, ASI10) run fire-and-forget off the hot path, emitting alerts without adding latency; and ASI07/ASI09 are properties of the deployment itself — pinned artifacts and chained logs rather than runtime checks.

Where teams usually get stuck

• Scanning prompts but not tool catalogs (that is ASI04).
• Logging to a mutable store, making every incident unfalsifiable (that is ASI09).
• Alerting on single signals, drowning operators in noise — composites with cooldowns are what make detection operable.
• Treating drift as a configuration problem. Baselines should learn themselves; asking users to define "normal" guarantees they will not.

The unifying lesson: an agent's blast radius is defined by its tools, its memory, its identity, and its history. Secure those four surfaces and the top ten stops being a list of fears and becomes a set of engineering requirements.