OWASP doesn't yet have a numbered "Agentic AI Top 10" the way it has the classic web application Top 10. What exists is ongoing work from the GenAI Security Project mapping threats specific to autonomous agents, systems that plan, use tools, and act without a human approving every step. In practice, that mapping already converges on a recognizable set of risks, the ones security teams run into once they start testing real agents in production.
Here are the 10 that show up most.
The risks
- Goal hijacking. A malicious instruction (via a prompt, a document, or another tool's output) redirects what the agent is trying to accomplish, without the agent noticing the shift.
- Excessive agency. The agent gets more permission than the task requires "so it doesn't break later," and that slack becomes attack surface once it acts outside expectations.
- Tool misuse. The agent chains tool calls in ways nobody tested, combining individually safe actions into a dangerous sequence.
- Memory and context poisoning. Malicious data persisted in the agent's long-term memory contaminates future decisions, long after the original interaction.
- Identity spoofing. A fake component or agent impersonates a trusted agent inside a multi-agent flow.
- Rogue agent in a multi-agent system. A single compromised agent in a chain influences the decisions of the others, propagating the problem.
- Human-in-the-loop manipulation. The agent builds a justification convincing enough for a human to approve an action they shouldn't.
- Cascading hallucination. One agent's error becomes "trusted" input for the next step in the chain, amplifying the damage at each stage.
- Resource exhaustion. Uncontrolled loops or calls take down services, blow through API budgets, or saturate rate limits.
- Lack of traceability. When something goes wrong, there isn't enough of a trail to reconstruct why the agent made that decision.
Half of these risks aren't new, it's the same old story of excessive permissions and missing audit trails. What's new is the speed: an agent finds the wrong path far faster than a human would.
Where to start
You can't mitigate all 10 at once, and trying usually means mitigating none of them well. The usual starting point is mapping which agents exist today, which tools and endpoints each one can touch, and testing that surface with the same rigor you'd apply to an API exposed to external users, because in practice that's exactly what it is.
These risks don't live only in the model layer. They show up in the APIs the agent calls, so the defense needs to live there too: understand the real surface, prioritize by business impact, and prove the fix works before an autonomous agent finds the path nobody tested.