OWASP Top 10 for Agentic Applications 2026 - Standardized risk classification for AI agent security.
| ID | Risk Type | Key Indicators |
|---|---|---|
| ASI01 | Agent Goal Hijack | Prompt injection, instruction override, goal manipulation |
| ASI02 | Tool Misuse & Exploitation | Unauthorized tool calls, parameter tampering, unvalidated inputs |
| ASI03 | Identity & Privilege Abuse | Auth bypass, permission escalation, missing authorization |
| ASI04 | Agentic Supply Chain | Malicious dependencies, compromised tools, package poisoning |
| ASI05 | Unexpected Code Execution | RCE, command injection, code evaluation |
| ASI06 | Memory & Context Poisoning | Data leakage, context manipulation, memory corruption |
| ASI07 | Insecure Inter-Agent Comm | Unencrypted channels, data exposure between agents |
| ASI08 | Cascading Failures | Error propagation, chain reaction vulnerabilities |
| ASI09 | Human-Agent Trust Exploit | Social engineering, deceptive responses |
| ASI10 | Rogue Agents | Malicious agent behavior, unauthorized actions |
| Detection Source | Type | Primary ASI | Secondary ASI |
|---|---|---|---|
data-leakage-detection |
Skill | ASI06, ASI07 | ASI01, ASI03 |
tool-abuse-detection |
Skill | ASI02, ASI05, ASI07 | ASI03 |
indirect-injection-detection |
Skill | ASI01 | ASI06 |
authorization-bypass-detection |
Skill | ASI03 | ASI09 |
| Prompt Injection tests | Dialogue | ASI01, ASI06 | ASI09 |
| Code Audit | Agent | ASI04, ASI05 | ASI10 |
| Finding Type | ASI Category | Rationale |
|---|---|---|
| API keys, tokens | ASI06 | Context contains sensitive data |
| System prompts | ASI01 | Enables goal hijacking |
| Credentials | ASI03 | Identity abuse risk |
| Internal configs | ASI04 | Supply chain exposure |
| PII exposure | ASI07 | Inter-agent data leak |
| Command injection | ASI05 | Unexpected code execution |
| Unauthorized tool calls | ASI02 | Tool misuse |
Action: Immediate remediation (within 24 hours)
Action: Urgent remediation (within 1 week)
Action: Address within 2-4 weeks
Action: Review as time permits
Load this skill when performing OWASP ASI classification:
load_skill(name="owasp-asi")
Then apply the mapping rules to classify findings.