Framework
OWASP Top 10 for Agentic Applications 2026
A community-driven reference for the security risks of agentic AI systems, where LLMs plan, execute multi-step tasks, invoke tools and operate with delegated authority.
The OWASP Top 10 for Agentic Applications is the OWASP GenAI Security Project’s community reference for agentic AI security. It addresses the threat surface that the LLM Top 10 does not cover on its own: systems that plan, remember, invoke APIs and execute actions with delegated authority.
Edition note. ATLAS previously labelled this framework “2025” and used identifiers (AA01–AA10) that do not match the official material. The official designation is the 2026 edition, and its entries use the ASI identifier family. As a verified example, ASI06 addresses Memory & Context Poisoning.
This entry does not reproduce the official item list. ATLAS maps the agentic risk areas to its own catalogue and points to the primary source for the authoritative identifiers and wording.
Mapping to the ATLAS Risk Catalogue
| OWASP agentic risk area | ATLAS entry | Mapping type |
|---|---|---|
| Prompt Injection | Prompt Injection | exact |
| Excessive Agency | Excessive Agency | exact |
| Insecure Tool Invocation | Insecure Tool Invocation | exact |
| Supply Chain Compromise | Agentic Supply Chain Compromise | partial |
| Memory and Context Poisoning | Vector and Embedding Weaknesses | related |
| Channel and Protocol Trust | MCP Channel Trust | related |
ATLAS connection
The agentic risks map to ATLAS entries and operational controls. Relevant controls include Off-Agent Authorization for Tool Calls, Human Approval for High-Impact Actions, and Input and Output Validation for AI Agent Components.
Official source: OWASP