OWASP Top 10 for Agentic Applications 2026

Attackers manipulate an agent's objectives, planning logic, or decision path through malicious content in inputs like emails, documents, RAG data, or web content.

Legitimate tools or functions are abused within their granted privileges, leading to unauthorized actions or data access.

Agents inherit or delegate credentials without proper scoping, creating attribution gaps and privilege escalation risks.

Compromised or vulnerable components in the agent tool ecosystem, including malicious tools, plugins, and compromised agent frameworks.

Agents execute code or commands that were not intended by the system design, leading to remote code execution vulnerabilities.

Attackers poison the agent's memory, context, or retrieval systems to influence future behavior or extract information.

Communication between agents lacks proper security controls, enabling interception, manipulation, or impersonation.

Failure in one agent, tool, or component propagates through the system, causing widespread disruption or security gaps.

Agents exploit user trust through manipulation, social engineering, or by presenting misleading information as factual.

Agents operate beyond their intended scope, persist inappropriately, or take unauthorized actions across sessions or systems.