The OWASP Agentic Top 10, explained
The OWASP Agentic Top 10 is the OWASP GenAI Security Project's list of the ten most significant security risks specific to AI agents — systems that plan, call tools, hold memory, and act with delegated authority rather than just answering questions. Where the LLM Top 10 covers risks of the model itself, the Agentic list covers what goes wrong once the model can do things.
ThreatPulse classifies every agent threat it ingests against this list at synthesis time. Each entry below explains the risk in plain English, shows how it appears in practice, summarizes the defenses, and links to the live, currently tracked threats mapped to it.
ASI01Agent Goal Hijacking
An attacker changes what the agent is trying to do.
Goal hijacking is any attack that redirects an agent's objective without the operator's knowledge — most often through prompt injection in content the agent reads (web pages, documents, emails, tool outputs, repository files), but also through poisoned task descriptions, manipulated planning steps, or corrupted intermediate results in a multi-agent pipeline.
Read the explainer and see live threats →ASI02Tool Misuse and Exploitation
Legitimate tools are driven to harmful ends.
Agents act through tools — shells, browsers, file systems, HTTP clients, SaaS APIs, payment rails.
Read the explainer and see live threats →ASI03Identity and Privilege Abuse
Agents impersonate, inherit, or escalate identity.
Agents authenticate to services, act on behalf of humans, and delegate to other agents.
Read the explainer and see live threats →ASI04Agentic Supply Chain Vulnerabilities
Tampered tools, models, prompts, and packages.
An agent's supply chain includes everything a conventional application's does — packages, containers, CI — plus models, system prompts, skills, MCP servers, and tool definitions fetched from public registries.
Read the explainer and see live threats →ASI05Unexpected Code Execution
The agent runs code the operator never intended.
Coding agents and any agent with an interpreter tool are remote-code-execution primitives by design.
Read the explainer and see live threats →ASI06Memory and Context Poisoning
Persistent memory and RAG corrupted for lasting control.
Agents that remember across sessions — via long-term memory stores, vector databases used for retrieval-augmented generation, or persistent instruction files — can be persistently compromised.
Read the explainer and see live threats →ASI07Insecure Inter-Agent Communication
Agent-to-agent messages are spoofed or hijacked.
Multi-agent systems pass natural-language messages between agents, often over protocols that are younger than the agents themselves.
Read the explainer and see live threats →ASI08Cascading Failures
One bad agent takes down the pipeline.
In a system of cooperating agents, each agent's output is the next agent's trusted input.
Read the explainer and see live threats →ASI09Human-Agent Trust Exploitation
The agent misleads the person approving its actions.
Operators approve what the agent shows them.
Read the explainer and see live threats →ASI10Rogue Agents
An agent acting outside its intended scope.
A rogue agent no longer does what its operator intends — because it was compromised, because its objective drifted over a long horizon, or because a safeguard was bypassed.
Read the explainer and see live threats →