OWASP Agentic Top 10 · ASI10

Rogue Agents

An agent acting outside its intended scope.

What it is

A rogue agent no longer does what its operator intends — because it was compromised, because its objective drifted over a long horizon, or because a safeguard was bypassed. The category covers detection and containment of agents that have gone off-task, including ones that resist being stopped or conceal what they are doing.

How it shows up

A long-running automation agent, poisoned weeks earlier, begins quietly modifying access rules. An agent instructed to 'complete the task no matter what' disables the monitoring that would have flagged it. A compromised agent in a fleet recruits peers.

How to defend against it

Keep an out-of-band kill switch, monitor agent behavior against a baseline of expected actions, bound autonomy with hard limits on time, spend, and privilege, and make every agent's activity attributable and auditable.

Related threat types: Rogue Agents, Agent Worms, Cascading Failures

Threats currently tracked under ASI10

Showing 1–4 of 4 threats, newest first

Cross-Domain Resource Abuse in MCP Tool Invocations (mitigated by AEGIS)

lowAgentResource Exhaustion

MCPdenial-of-serviceresource-abusemultimodalpolicy-enforcementresearch-paperdefensive-toolingASI10 · Rogue AgentsSurface: Tool LayerPropagation: None

This is a research paper describing a defensive framework (AEGIS), not an active exploit or newly disclosed vulnerability. It highlights a known class of risk where MCP agents can request excessive resources (e.g., huge search radii, long videos) across multiple modalities, potentially degrading service, and proposes a policy-enforcement layer to mitigate it.

Updated Aug 24, 2026

Spring AI MCP Streamable HTTP Server Unbounded Session Accumulation DoS

highAgentResource Exhaustion

MCPSpring AIdenial-of-serviceunauthenticatedsession-exhaustionstreamable-httpmemory-exhaustionASI10 · Rogue AgentsSurface: ProtocolPropagation: Single Hop

Spring AI's MCP Streamable HTTP server transport (WebFlux/WebMvc) fails to limit or authenticate sessions, allowing a remote unauthenticated attacker to open unbounded sessions until the server exhausts memory and crashes. This is a straightforward denial-of-service issue rather than an agent-logic compromise, but it can take down MCP-based agent infrastructure for all legitimate clients.

Updated Aug 21, 2026 · CVSS 7.5

MCP Ruby SDK Session Exhaustion via Unbounded StreamableHTTPTransport Sessions

mediumAgentResource Exhaustion

mcpruby-sdkdossession-managementstreamable-httpunbounded-memoryASI10 · Rogue AgentsSurface: ProtocolPropagation: None

The official MCP Ruby SDK fails to expire sessions in its StreamableHTTPTransport, allowing an attacker to repeatedly send initialize requests and accumulate ServerSession objects indefinitely. This can exhaust server memory and cause a denial of service against any MCP server built on this SDK. The issue is fixed in version 0.23.0.

Updated Jul 30, 2026 · CVSS 5.3

MCP Ruby SDK Stdio Transport Unbounded Read Memory Exhaustion

mediumAgentResource Exhaustion

mcpruby-sdkstdio-transportdenial-of-servicememory-exhaustionunbounded-readASI10 · Rogue AgentsSurface: ProtocolPropagation: Single Hop

The official MCP Ruby SDK (versions prior to 0.23.0) contains a denial-of-service vulnerability where its stdio transport reads input without a byte limit. A malicious peer (client or server) connected over stdio can send data without a newline terminator to exhaust the host process's memory, crashing or degrading the MCP server or client. This is a straightforward availability issue, not a code-execution or data-exfiltration flaw, and is fixed in 0.23.0.

Updated Jul 30, 2026 · CVSS 6.2