Framework
OWASP Top 10 for Agentic AI Applications 2025
A dedicated top-10 list addressing the unique security challenges of agentic AI systems — where LLMs plan, execute multi-step tasks, invoke tools, and operate with delegated authority over enterprise systems.
The OWASP Top 10 for Agentic Applications extends the LLM Top 10 to address the distinct threat surface of autonomous, tool-using, multi-step AI agents. While the LLM Top 10 focuses on language-model applications, the Agentic Top 10 targets systems that plan, remember, invoke APIs, and execute actions on behalf of users.
The ten agentic risks
| # | Risk | Core concern |
|---|---|---|
| AA01 | Prompt Injection | External or internal untrusted content becomes instructions that the agent follows |
| AA02 | Excessive Agency | The agent is granted authority beyond what the task, context, or system reliability can justify |
| AA03 | Insecure Tool Invocation | Tools receive malformed, malicious, or unvalidated input from an agent that trusts its own reasoning |
| AA04 | Agent-to-Agent Trust Exploitation | Multi-agent systems inherit trust assumptions across agent boundaries without verification |
| AA05 | Memory Poisoning | Persistent memory or context stores are contaminated with malicious data that influences future decisions |
| AA06 | Supply Chain Compromise | Agent dependencies — plugins, MCP servers, tool registries — introduce untrusted execution paths |
| AA07 | Goal Misalignment | Agent pursues a proxy or sub-goal that diverges from the intended objective, amplified by autonomy |
| AA08 | Output Propagation | Agent outputs are consumed by downstream systems as trusted inputs without validation |
| AA09 | Credential and Session Hijacking | Agent-held credentials, tokens, or sessions are stolen and reused across systems and time |
| AA10 | Unbounded Execution | Agent runs without time, cost, or scope limits, enabling runaway resource consumption or damage amplification |
ATLAS connection
The Agentic Top 10 maps to four core ATLAS risks: Excessive Agency, Insecure Tool Invocation, Prompt Injection, and Agentic Supply Chain Compromise. ATLAS controls — including Human Approval for High-Impact Actions, Off-Agent Authorization for Tool Calls, and Prompt and Output Logging — provide the operational countermeasures.
Official source: OWASP