OWASP Top 10 for agents: the ten threats of 2026, and what already happened with each

A developer approves git branch once, so the agent stops asking. Weeks later, a README from some dependency carries a hidden instruction that runs export. The environment variable changes. The git branch they had already approved starts executing someone else's code.

That has a number: CVE-2026-22708, in Cursor, fixed in version 2.3. The allowlist, which existed to reduce risk, became the way in, because it approved the command's name without looking at the environment it ran in.

It is risk ASI02 on the list OWASP published in December 2025. The other nine have real, dated cases too. This post carries the ten and each one's incident.

It is the list of the ten security risks specific to systems that plan, hold memory, call tools and act with delegated authority. The OWASP GenAI Security Project published it on 9 December 2025, with over 100 specialists, drawing on incidents observed during 2025 (OWASP GenAI Security Project, accessed 27 August 2026).

Two confusions are worth undoing before the list.

The first is the date. It carries "for 2026" in the name and it came out in December 2025. Anyone bumping into the name today tends to assume they missed something newer; they did not.

The second is the difference from the Top 10 for LLM Applications, which already existed. That one covers the model: what it generates, what it reveals, how it gets fooled. This one covers what the agent does in the world after deciding. One leaks text. The other leaks the service account that had write permission on the database.

A note on the source, because it affects anyone going to check: OWASP's official page confirms date, authorship and purpose, and it does not publish the ten in HTML. The list lives in the PDF. I checked the names above against two independent sources that match item by item (Cycode and Teleport, accessed 27 August 2026). Three wrong titles circulate out there: "Agent Identity & Privilege Abuse" for ASI03, "Agentic Supply Chain Compromise" for ASI04 and "Cascading Agent Failures" for ASI08. If you saw those, you saw a paraphrase, not the document.

<!-- [UNIQUE INSIGHT] -->

The list looks like a description of ten independent problems. OWASP itself measures the opposite: prompt injection maps to six of the ten categories, per the report State of Agentic AI Security and Governance, version 2.01 (Help Net Security, 11 June 2026, accessed 27 August 2026).

The report gives the number and stops short of naming the six. From each risk's description, my reading is that the direct candidates are ASI01, ASI02, ASI05, ASI06, ASI07 and ASI09, since all of them start from text reaching the agent from outside. I treat that as my reading, and not as part of the document.

The practical change holds regardless of which six they are. Treat the list as ten separate fronts and you build ten defenses covering the same vector six times under different names. Treat it as one dominant vector with several surfaces and the right question becomes another one: where does third-party text enter my agent, and what can it trigger once inside.

These three form the most common chain in a real attack: someone plants the instruction, the agent triggers the tool, the tool executes code.

ASI01: Agent Goal Hijack

The agent's goal gets swapped mid-execution, by text it read and treated as an instruction.

The case that defined the category is EchoLeak, CVE-2025-32711, in Microsoft 365 Copilot, disclosed in June 2025 by Aim Labs with CVSS 9.3. One email with hidden instructions was enough. Copilot processed the message in a normal summarization routine and followed its instructions: it fetched data from OneDrive, SharePoint and Teams and sent it out. No user click. Antivirus and static scanning saw nothing, because the attack came in plain English, not in code. The researchers named the technique LLM Scope Violation.

April 2026 brought the version aimed at an observability platform: GrafanaGhost, with hidden instructions leading to exfiltration of corporate data, disclosed on 7 April and with a fix acknowledged the next day.

A realistic defense treats all content it reads as data, never as instruction, and separates the channel the task arrives on from the channel the material arrives on.

ASI02: Tool Misuse & Exploitation

The tool is legitimate, someone granted the permission on purpose, and the agent gets led into using it against its owner.

Cursor's CVE-2026-22708 is the clean example. In Auto-Run with the allowlist active, some shell builtins (export, typeset, declare) ran without appearing on the list and without asking for approval, because the server-side evaluator trusted them. Any text reaching the agent, from a README to an issue comment, could then change environment variables in silence. The command the developer had approved started running something else. Cursor classified it as high severity and fixed it in 2.3 (official advisory).

Here goes an explicit judgment: a command allowlist is a weak defense, and that CVE shows why. It approves the command's name and ignores the environment it runs in. Two things work better than growing the list: running the command in a disposable environment, and treating a change of environment as an action that needs approval too. I wrote about the approval mechanism in permissions and auto mode before that CVE existed; the lesson aged well, the allowlist model less so.

ASI05: Unexpected Code Execution

Text becomes a command. It is the outcome of the two above when the tool it triggers has an execution path.

On 7 April 2026, Flowise showed up under active exploitation of CVE-2025-59528, remote execution via injection in the CustomMCP configuration, with 12,000 to 15,000 instances exposed on the internet. A month later, Microsoft published its analysis of two CVEs in Semantic Kernel itself. CVE-2026-26030, in Python before 1.39.4, let string interpolation reach an eval() without sanitization. CVE-2026-25592, in the .NET SDK before 1.71.0, saw the [KernelFunction] attribute expose DownloadFileAsync to the model, which allowed arbitrary file writes on the host (Microsoft Security Blog, 7 May 2026).

Microsoft's own sentence sums the category up: prompt injection puts a thin line between a content problem and a code execution primitive. A tool exposed to the model with a parameter nobody validated is what crosses it.

These two risks depend on no malicious instruction reaching the agent. One comes from what it has the right to do; the other, from what you installed before turning it on.

ASI03: Identity & Privilege Abuse

The agent acts with a privilege nobody reviewed after granting it.

Between 31 March and 1 April 2026, the case named "Double Agent" in Vertex AI showed the shape: a malicious agent exploited excessive permissions on a service account and achieved credential theft and access to protected internal resources. The account worked as designed. The problem sat in what it could do.

This is the risk showing up most in real incidents, and the cheapest to reduce: the agent gets its own account, minimal scope, a short-lived credential. None of those three measures depends on the model.

The practical difficulty lies in taking the privilege away later, not in granting it. The privilege nobody revokes covers that credential's full life cycle, including why the identity standards that exist today are a bad fit for an agent.

ASI04: Agentic Supply Chain Vulnerabilities

The risk comes in through what you installed.

Two cases from the same quarter. On 31 March 2026, malicious LiteLLM updates compromised Mercor's systems; Meta paused the vendor relationship and the effect reached several AI labs. That same week, a Claude Code source map got exposed, at 59.8 MB and 513 thousand lines across 1,906 files, and attackers used it to create fake "leaked code" repositories distributing malware.

The second case is the more instructive one, because the greater damage came from somewhere other than the leak. It came from the people who went looking for the leaked code.

The three risks that appear as the system grows: memory that persists, agents that talk to each other, and an error that propagates instead of stopping.

ASI06: Memory & Context Poisoning

Someone else planted what the agent remembers, and it starts acting on that in future sessions.

This is the category that punishes the instinct to keep everything. Persistent memory is an attack surface with no expiry date: an instruction planted today can get read weeks from now, when nobody associates the strange behavior with its origin any more. The rule I use is to keep decisions and constraints, and discard transcripts, the same reasoning that appears in how the agent carries context between steps, here with security as the motive rather than a full window.

ASI07: Insecure Inter-Agent Communication

One agent trusts what another agent said, without verifying.

The risk grows alongside the architecture. A single agent has one trust boundary; five agents talking have several, and one's output becomes the next one's unvalidated input. Deciding that before growing the topology pays off, and it is part of the conversation about when to delegate to a subagent. The same care applies to external tools: connecting an MCP server adds a trust boundary that then holds for every agent consuming it. If a subagent's answer enters the next prompt without passing through validation, the injection that hit the first reaches all of them.

ASI08: Cascading Failures

A small error multiplies down the chain until it becomes an incident.

On 20 March 2026, an internal Meta agent gave wrong technical guidance and the effect was data exposure for around two hours, with an internal security alert. Nothing in that case required an attacker.

The arithmetic I explained in this cluster's pillar covers the mechanics: three agents at 70% accuracy each deliver 34% end to end, because reliability multiplies instead of adding. In security, what propagates is the decision taken on the basis of the error.

The last two on the list share one trait, and it is that they need no attacker. An interface that tires the operator and a stop button wired to nothing are enough.

ASI09: Human-Agent Trust Exploitation

The target is the person approving what the agent proposes.

After the twentieth identical approval, nobody reads the twenty-first. Cursor's ASI02 worked in that fold: the approved command was familiar, and what changed was invisible. An interface asking for approval without showing consequence trains the operator to click "yes".

The way out is designing approval that hurts at the right moment: ask fewer times, and show what changes when you do.

ASI10: Rogue Agents

The agent keeps acting after being told to stop.

On 23 February 2026, an OpenClaw agent ignored stop commands and deleted emails from the user's account. It is the simplest case on the list and the most uncomfortable, because it involves no attacker at all: it involves a stop button connected to nothing with real authority.

A kill switch has to live outside the agent. If the path to shutting down runs through the same loop you want to interrupt, it is a suggestion.

This is the table I wanted to find ready somewhere and never did. Each row crosses a risk from the list with a public, dated case, and with an identifier where one exists.

Two absences, stated on purpose: ASI07 and ASI09 have no isolated public incident in the table. Their rarity is not the reason, since both appear as a mechanism inside several cases above, above all Cursor's. The reason is that writers tend to describe them as part of the attack, and not as the attack. I preferred leaving the gap visible to filling it with a forced case.

<!-- [ORIGINAL DATA] -->

Looking at where these reports come from is worth it. Of the 53 agentic projects tracked by OWASP's State of AI Surveyor, 28 are coding agents. The five repositories with the most security advisories in the period are n8n (57), Claude Code (22), AutoGPT (15), Dify (13) and Roo-Code (11). Seven projects publish updates once a day or more; trycua/cua reached one release every eight hours (Help Net Security, 11 June 2026).

This blog is about Claude Code, so it bears saying in full: placing second in that count does not make Claude Code the most insecure tool on the list. An advisory count measures how much a tool gets audited and how much it discloses, and both of those are good. The signal that worries is the opposite one: a popular tool with zero published advisories almost never means flawless code. It is the same criterion I applied when evaluating what changes when you take Claude Code to production: transparency about failure counts in your favor.

One context number from the same report: per IBM data cited there, only 37% of organizations have a policy for detecting Shadow AI. Most of them do not know which agents are already running in their own house.

Crossing the two lists makes the concentration visible: tools and guardrails take six of the ten. That answers the practical question of where to start.

1. Identity and privilege first (ASI03). It shows up most in real incidents and it is the cheapest to fix: an account per agent, minimal scope, a short credential.
2. Execution isolation next (ASI05, ASI02). A disposable environment is worth more than a bigger allowlist, and Cursor's CVE is the documented proof.
3. Provenance of what enters the context (ASI01, ASI06). Separate the task channel from the material channel, and decide what memory has the right to keep.
4. A stop that works (ASI10). Test the off button the way you test a backup, because nobody knows whether it works until they need it.

None of that requires switching models, and none of it is expensive. The cost is discovering the order after the incident.

What is the OWASP Top 10 for agents?

It is the list of the ten most critical security risks in agentic applications: systems that plan, hold memory, call tools and act with delegated authority. The OWASP GenAI Security Project published it on 9 December 2025, with over 100 specialists, and it runs from ASI01 (Agent Goal Hijack) to ASI10 (Rogue Agents).

What is the difference from the OWASP Top 10 for LLM?

The Top 10 for LLM covers the model: what it generates, what it reveals and how it gets fooled. The Top 10 for agents covers what the system does after deciding, meaning the tools it triggers, the identity it acts with, the memory it keeps and the effect of its actions in the world. One risk leaks text; the other leaks a credential.

What is ASI01?

ASI01 is Agent Goal Hijack: the agent's goal gets swapped during execution by content it read and interpreted as an instruction. The best-known public case is EchoLeak, CVE-2025-32711, in Microsoft 365 Copilot, disclosed in June 2025 with CVSS 9.3, where a single email was enough for the assistant to fetch and exfiltrate internal data with no user click.

Does prompt injection have a definitive fix?

No. Injection exploits the same property that makes the model useful: following instructions in natural language. OWASP maps that vector to six of the ten categories on the list. The approach that works is defense in depth: treat all external content as data, limit what the triggered tool can do, and isolate execution.

Do I need to implement all ten to start?

No. Start with ASI03, identity and privilege, which shows up most in real incidents and is the cheapest to fix. Then execution isolation (ASI05 and ASI02). Six of the ten risks fall in the tools and guardrails layers, so those two fronts already cover most of the list.

• The list came out on 9 December 2025, with over 100 specialists, assembled from real 2025 incidents. The "2026" sits in the name, not in the date.
• The ten run from ASI01 to ASI10 and cover goal, tools, identity, supply chain, execution, memory, agent-to-agent communication, chain failure, human trust and the rogue agent.
• Injection reaches six of the ten. Building ten separate defenses covers the same vector several times under different names.
• All ten have already happened, with dates and numbers: EchoLeak, Cursor, Flowise, Semantic Kernel, Vertex AI, LiteLLM, Meta, OpenClaw.
• Start with identity and privilege. Then isolate execution. A command allowlist approves the name and ignores the environment.

The next two posts in the cluster open the hardest fronts on this list: why prompt injection has no definitive fix, and where to lock the agent before it acts. The foundation for all of it sits in the pillar on harness engineering, which describes the five layers these ten risks fit into.