As technology advances rapidly, generative AI is moving beyond chat-based tools and into real-world workflows. It is increasingly capable of autonomously planning tasks, retrieving information, and performing actions, giving rise to “agentic AI.” Systems built around agentic AI to carry out real-world tasks are known as “agentic applications.”
While agentic applications offer convenience, they also introduce new cybersecurity risks. Incorrect or malicious instructions may lead to data leakage, file deletion, or even unauthorized transactions. In its OWASP Top 10 for Agentic Applications 2026, OWASP identifies the following major threats:
- ASI01 Agent Goal Hijack: Manipulated prompts, data, or messages alter an agent’s goals, plans, or decisions.
- ASI02 Tool Misuse and Exploitation: Prompt injection, goal misalignment, or ambiguous instructions cause an agent to misuse legitimate tools.
- ASI03 Identity and Privilege Abuse: Identities, credentials, delegation, or trust relationships are abused to perform unauthorized actions.
- ASI04 Agentic Supply Chain Vulnerabilities: Agents, models, tools, plug-ins, or third-party services are tampered with, impersonated, or injected with malicious content.
- ASI05 Unexpected Code Execution (RCE): Untrusted input or model output is treated as executable code, potentially resulting in remote code execution.
- ASI06 Memory and Context Poisoning: Malicious or misleading information enters conversations, memory, or RAG knowledge stores and persistently influences future decisions.
- ASI07 Insecure Inter-Agent Communication: Insufficient authentication, authorization, or integrity protection allows messages to be forged, intercepted, replayed, or tampered with.
- ASI08 Cascading Failures: Faults, hallucinations, malicious input, or poisoned information propagate and amplify across workflows, causing systemic harm.
- ASI09 Human-Agent Trust Exploitation: Users’ trust in agents is exploited to manipulate their judgment, disclosure of information, or high-risk actions.
- ASI10 Rogue Agents: Malicious, compromised, or behaviorally divergent agents depart from their intended functions or authorized scope and engage in harmful or unauthorized behavior.
To reduce these risks, OWASP advocates the principle of least agency, under which agents are granted only the tools, data, and permissions required for the current task. High-impact actions, such as transferring funds, deleting files, or publishing content externally, should still require human approval. Systems should also maintain complete records of tool usage and agent actions.
The challenge of AI is not only whether it is intelligent and useful, but also whether it can be properly constrained and supervised. Only by balancing convenience and security can AI become a truly trustworthy assistive tool.