Framework
OWASP Top 10 para Aplicaciones Agénticas 2025
Una lista específica de los diez principales riesgos de seguridad en sistemas de IA agéntica, donde los LLM planifican, ejecutan tareas multi-paso, invocan herramientas y operan con autoridad delegada.
Lectura práctica
Una lista específica de los diez principales riesgos de seguridad en sistemas de IA agéntica, donde los LLM planifican, ejecutan tareas multi-paso, invocan herramientas y operan con autoridad delegada.
The OWASP Top 10 for Agentic Applications extends the LLM Top 10 to address the distinct threat surface of autonomous, tool-using, multi-step AI agents. While the LLM Top 10 focuses on language-model applications, the Agentic Top 10 targets systems that plan, remember, invoke APIs, and execute actions on behalf of users.
The ten agentic risks
| # | Risk | Core concern |
|---|---|---|
| AA01 | Prompt Injection | External or internal untrusted content becomes instructions that the agent follows |
| AA02 | Excessive Agency | The agent is granted authority beyond what the task, context, or system reliability can justify |
| AA03 | Insecure Tool Invocation | Tools receive malformed, malicious, or unvalidated input from an agent that trusts its own reasoning |
| AA04 | Agent-to-Agent Trust Exploitation | Multi-agent systems inherit trust assumptions across agent boundaries without verification |
| AA05 | Memory Poisoning | Persistent memory or context stores are contaminated with malicious data that influences future decisions |
| AA06 | Supply Chain Compromise | Agent dependencies — plugins, MCP servers, tool registries — introduce untrusted execution paths |
| AA07 | Goal Misalignment | Agent pursues a proxy or sub-goal that diverges from the intended objective, amplified by autonomy |
| AA08 | Output Propagation | Agent outputs are consumed by downstream systems as trusted inputs without validation |
| AA09 | Credential and Session Hijacking | Agent-held credentials, tokens, or sessions are stolen and reused across systems and time |
| AA10 | Unbounded Execution | Agent runs without time, cost, or scope limits, enabling runaway resource consumption or damage amplification |
ATLAS connection
The Agentic Top 10 maps to four core ATLAS risks: Excessive Agency, Insecure Tool Invocation, Prompt Injection, and Agentic Supply Chain Compromise. ATLAS controls — including Human Approval for High-Impact Actions, Off-Agent Authorization for Tool Calls, and Prompt and Output Logging — provide the operational countermeasures.