MKLab · tech talk
The OWASP Agentic Top 10
All ten risks of the 2026 edition, explained and animated: what changes when the model stops answering and starts acting.
Space to begin
I · The stage
An agent is more than a model.
The cast for this talk: an agent with a goal and a plan, the tools it calls, the memory it keeps, the credentials it carries, the peers it talks to, the components it loads at runtime, and the human who approves. Learn this machine once. Ten risks, and every one attacks a different part of it.
II · Why agents change the math
Small faults, long levers.
A chat answer that goes wrong is one bad response. An agent that goes wrong plans, decides and acts across steps and systems, on your behalf. Agents amplify existing vulnerabilities: the same injection, the same leak, the same bad dependency now has hands. That is the whole reason this list exists.
ASI01 · Agent goal hijack
Steal the goal, own the plan.
An agent cannot reliably tell instructions from content, and content comes from everywhere: prompts, tool outputs, artifacts, peer messages, poisoned data. Where classic prompt injection bends one response, a goal hijack redirects the objective itself, and every step the agent takes afterwards serves the wrong master. Pin the goal, validate it often, and treat every input as content, never as command.
ASI02 · Tool misuse and exploitation
Legitimate tools, illegitimate work.
Nothing here is malware. The agent misuses tools it was given: an ambiguous instruction, an injected suggestion, an unsafe delegation, and a read-transform-send chain becomes an exfiltration pipeline. The risk lives in how tools are chosen, chained and parameterized. Constrain arguments, scope each tool, and watch the chains, not just the calls.
ASI03 · Identity and privilege abuse
Whose badge is it wearing?
Agents inherit credentials, delegate to each other, and act across systems built for human identities. In that attribution gap, privileges accrete along delegation chains and least privilege becomes impossible to enforce. Give every agent its own governed identity, short-lived credentials, and a trail that says who, or what, actually acted.
ASI04 · Agentic supply chain
It composes itself at runtime.
A classic supply chain is what you build with. An agentic one is what your agent loads while it runs: tools, personas, MCP servers, registries, other agents. A compromised component does not wait for your next release, it joins the execution chain mid-task. Provenance, pinning and verification have to happen at runtime too.
ASI05 · Unexpected code execution
The chain that compiles itself.
No single call looks dangerous. But a sequence of legitimate tool calls can assemble and execute attacker-defined code: scripts, deserialized objects, template engines, in-memory eval, reaching the host, persisting, escaping the sandbox. Treat execution as its own privilege: sandboxes, no-exec defaults, and runtime controls beyond ordinary tool checks.
ASI06 · Memory and context poisoning
Poison the memory, steer the future.
Agents remember: histories, summaries, embeddings, stores that carry context across tasks. Seed that memory with something false or hostile, and every later plan reasons from it, drifting a little further each cycle. Validate what gets written, tag where it came from, and quarantine what cannot be trusted.
ASI07 · Insecure inter-agent communication
Agents talk. Who is listening?
Multi-agent systems run on messages: intents, delegations, results. Without authentication and integrity, those messages can be intercepted, spoofed or rewritten mid-flight, and one forged intent steers a whole team. Sign the messages, verify the senders, and validate the meaning, not only the transport.
ASI08 · Cascading failures
One fault, system-wide.
The origin is another entry: a tainted dependency, a poisoned memory, a spoofed message. This one is about the spread: one faulty decision fanning out across agents, sessions and queues until a local defect is a systemic incident. Bulkheads, circuit breakers and blast-radius limits turn cascade into containment.
ASI09 · Human-agent trust exploitation
The confident voice is not a credential.
Fluent, helpful, authoritative: agents earn human trust fast, and that trust can be exploited. The manipulated human performs the final, audited action, and the agent's role disappears from forensics. Automation bias does the rest. Keep verification rituals: evidence before approval, and skepticism as policy, not attitude.
ASI10 · Rogue agents
Every action legitimate. The pattern is not.
A rogue agent has drifted from its intended scope: compromised, misaligned or parasitic, taking actions that each look fine while the emergent behavior is harmful. Rules that judge single actions cannot see it. Watch behavior against a baseline, keep containment ready, and make every agent stoppable.
III · Read them together
Two lists, one system.
This list stands on the LLM Top 10: a goal hijack begins as an injection, the agentic supply chain extends the classic one, memory poisoning is the persistent cousin of a poisoned context. Your agent is still an LLM application underneath. Secure the component with one list, the actor with the other.
IV · The posture
Give it less. Watch it more.
The through-line of all ten: least privilege for identities and tools, provenance for everything loaded, bulkheads around every blast radius, and humans who verify instead of merely approve. Agents amplify what you already have, weaknesses included. Constrain the reach, and the same autonomy that worried you becomes just capacity.
V · Sources and license
Adapted, with credit.
This talk condenses, adapts and animates the OWASP Top 10 for Agentic Applications, 2026 edition, © the OWASP GenAI Security Project, licensed CC BY-SA 4.0. Changes were made. OWASP has not endorsed this talk. This presentation, and only this presentation, is likewise licensed CC BY-SA 4.0. Everything else on mklab.se remains all rights reserved.
- OWASP · GenAI Security Project
- OWASP · Top 10 for Agentic Applications 2026
- Creative Commons · CC BY-SA 4.0 license
- MKLab · This adaptation, same license
MKLab · EST. MMXXV
That was all ten, again.
This is the end of the presentation. Thank you for watching. The LLM Top 10 talk is this one's sibling, and the agentic workflows talk shows the sunny side of agents.
