OWASP Top 10 for
Agentic Applications

Attackers manipulate an agent's natural-language input to affect and alter its intended goals, exfiltrating data, manipulating outputs or hijacking workflows. Unlike classic prompt injection which targets a single model response, goal hijacking redirects the agent's entire mission — causing it to pursue attacker-defined objectives across an extended autonomous session.

Agents misuse legitimate tools through prompt manipulation or privilege control, resulting in data exfiltration, unsafe operations, output manipulation, or workflow hijacking. The danger is that every tool the agent has access to becomes a potential attack primitive — a legitimate email-sending tool becomes an exfiltration channel; a legitimate database query tool becomes a mass-deletion weapon.

Weak scoping and dynamic delegation allow privilege escalation and cross-agent impersonation through cached credentials, inherited roles, or unintended delegated scopes. In multi-agent systems, agents frequently delegate tasks to sub-agents — and if identity context isn't carefully scoped, a compromised sub-agent can inherit and abuse the parent's elevated privileges.

Poisoned or impersonated tools, dynamically loaded prompts, models, or connections to MCPs or external agents propagate malicious logic at runtime, compromising agents through dynamic dependencies and unverified sources. Unlike traditional supply chain attacks that occur at build time, agentic supply chain attacks can occur dynamically during runtime as agents load new tools, connect to MCPs, or spawn sub-agents.

Unsafe code generation, agent deserialization, or shell execution triggered by crafted prompts or poisoned inputs. Agents that generate and execute code, or that deserialize structured data from untrusted sources, can be manipulated into running arbitrary commands on the underlying system — a direct path to full infrastructure compromise.

Adversaries poison RAG stores, memory, or context windows to plant false knowledge, bias logic, or trigger hidden or risky behaviors across sessions or agents. Unlike single-turn prompt injection, memory injection is persistent — the poisoned information lives in the agent's long-term memory and influences every future session until explicitly purged.

Lack of encryption, authentication, or semantic validation of exchanges between agents enables message tampering, replay, or goal manipulation in multi-agent systems. As agentic architectures grow more complex — with orchestrators spawning dozens of sub-agents — the communication channels between agents become an increasingly attractive attack surface.

A single fault or malicious event propagates across interlinked agents, amplifying harm through chained autonomous actions. In tightly coupled multi-agent systems, a single compromised or malfunctioning agent can trigger a chain reaction — each downstream agent acting on corrupted output from the previous one, multiplying the impact of the original failure.

Attackers exploit user over-trust in agent outputs through deception, emotional manipulation, or fake explainability, driving unsafe or fraudulent human approvals. As agents become more capable and persuasive, users increasingly defer to their judgment — creating opportunities for attackers who can influence agent output to obtain human rubber-stamps on harmful actions.

Compromised or malicious agents deviate from intended goals, collude, self-replicate, or hijack workflows, acting as autonomous insider threats within agent ecosystems. Rogue agents are the most dangerous category — they represent agents that have been fully compromised and are actively working against their principals, using all their legitimate access and capabilities for malicious purposes.