OWASP Agentic AI Top 10 — Securing AI Agents That Act
AI agents plan, remember and act through tools with delegated authority. The OWASP Top 10 for Agentic Applications is the first peer-reviewed list of the risks unique to them — starting with Agent Goal Hijack (ASI01) and Tool Misuse (ASI02).
Mutex Systems builds AI agents for GRC and SOC work and tests them against this list, so we design agents with the guardrails the list calls for.
- Category
- Testing Methodology
- Jurisdiction
- International
- Issuing Body
- OWASP GenAI Security Project
- Current Version
- “2026” edition, published 9 December 2025 (ASI01–ASI10)
- Who It's For
- Organisations deploying AI agents that can read data, call APIs, send messages or change systems — in operations, customer service, security and compliance.
Core Domains
A Practical Engagement Path
- 01
Map agency
List every tool, permission and data source each agent can use.
- 02
Threat model
Apply the Agentic Top 10 and MITRE ATLAS agent techniques.
- 03
Test
Attempt goal hijack, tool abuse and memory poisoning in a safe environment.
- 04
Guardrails & oversight
Least privilege, approval steps and monitoring for every risky action.
Agents designed to fail safely
Every agent we build or test has defined limits on what it may read, propose and do, with human approval for anything consequential.
- Permission and tool-scope review
- Prompt-injection and goal-hijack testing
- Monitoring of agent actions in your SOC
Govern agents like any other privileged user
grComply records each agent, its permissions and its risks under your AI governance, and its own AI drafts always need human approval before they count.
- Agent register with permissions and owners
- Agentic risks in the risk register
- Mapping to ISO 42001 and EU AI Act oversight obligations
- Confirm-before-complete evidence of human review
grComply is Mutex Systems' own multi-tenant GRC automation platform — the framework library, hybrid scanning, risk and audit workflow, and AI-assisted compliance behind every point above are live in production today.
See How grComply WorksCommon Questions About OWASP Agentic Top 10
What is agent goal hijack?
Malicious content — in an email, web page or document the agent reads — changes the agent’s objective, so it takes actions the user never intended.
Why is a separate list needed for agents?
Agents act. Risks that are only embarrassing in a chatbot become real damage when the model can send payments, change records or call other agents.
How do you secure AI agents?
Give agents the minimum permissions, separate reading from acting, require human approval for consequential actions, log every action, and test regularly for injection and tool abuse.
Ready to Start Your OWASP Agentic Top 10 Programme?
Send us your current posture and timeline. Within two working days you will receive a written response and a proposed scoping call.