The OWASP Agentic AI Top 10: What Enterprise Security Teams Need to Know

Beyond the LLM Top 10

Most enterprise security teams are familiar with the OWASP Top 10 for Large Language Model Applications. It covers the foundational vulnerabilities: prompt injection, insecure output handling, training data poisoning, and the rest. It has become the standard reference for anyone deploying LLM-powered systems.

But the OWASP LLM Top 10 was designed for a world where AI systems primarily receive a prompt and return a response. The agentic AI landscape is fundamentally different. Agents take actions. They call tools. They make decisions across multiple steps. They operate with degrees of autonomy that create entirely new attack surfaces.

That is why OWASP released a separate Agentic AI Top 10, focused specifically on the risks that emerge when AI systems act autonomously in the real world.

The Agentic Difference

A language model that generates a harmful response is a problem. An AI agent that takes harmful actions is a crisis.

Consider the difference: a chatbot that can be tricked into saying something inappropriate is embarrassing. An agent that can be tricked into executing unauthorized API calls, exfiltrating data through its tool integrations, or making binding financial commitments creates immediate, material business risk.

The Microsoft 365 Copilot vulnerability (CVE-2025-32711, CVSS 9.3) demonstrated this perfectly. A single crafted email could trigger automatic data exfiltration with no user interaction required. The agent's ability to take actions transformed a prompt injection from a theoretical concern into an active data breach.

Key Risk Categories for Enterprise Teams

Excessive Agency

Agents that can do more than they should. When the gap between what an agent can do and what it should do is too wide, every other vulnerability becomes more dangerous. Prompt injection against an agent with excessive permissions is not just a chatbot fail. It is a privilege escalation attack.

What to test: Define the minimum set of actions your agent needs. Then systematically attempt to induce actions outside that boundary. Multi-turn approaches are especially effective here because attackers can gradually expand the scope of requests.

Insecure Tool Use

Agents interact with external systems through tools and APIs. If those integrations lack proper input validation, authentication, or authorization, an attacker who compromises the agent's intent effectively inherits its access.

What to test: Attempt to manipulate the agent into calling tools with unexpected parameters, accessing resources beyond its intended scope, or chaining tool calls in ways that bypass individual tool-level security checks.

Agent-to-Agent Manipulation

In multi-agent architectures, compromising one agent can cascade to others. A poisoned tool output from one agent becomes a trusted input for the next. This is the AI equivalent of lateral movement in traditional security.

What to test: In multi-agent systems, test whether adversarial input to one agent can influence the behavior of downstream agents. Test whether agents properly validate inputs from other agents rather than treating them as trusted.

Commitment and Authority Risks

The Air Canada ruling established that companies are legally liable for commitments made by their AI agents. An agent that fabricates a refund policy, quotes incorrect pricing, or makes warranty commitments creates binding obligations whether or not a human approved them.

What to test: Systematically attempt to induce your agent to make commitments outside its authority. Test across product claims, pricing, policies, timelines, and guarantees. This falls at the intersection of security, quality, and compliance.

Mapping OWASP to Your Testing Program

For enterprise security teams building or updating their AI testing program, the OWASP Agentic AI Top 10 provides a structured starting point. But coverage requires more than checking boxes.

Each risk category demands multi-turn testing. Single-prompt scans might catch the most obvious instances of excessive agency or insecure tool use, but they will miss the sophisticated attack chains that represent real-world threats.

Each category also crosses traditional security boundaries. An agent that fabricates a product feature is simultaneously a quality failure (wrong information), a security concern (potential for social engineering), and a compliance risk (misleading claims under consumer protection law).

Framework Alignment

The OWASP Agentic AI Top 10 does not exist in isolation. Enterprise teams should map their testing programs across multiple frameworks:

• OWASP LLM Top 10 for foundational model-layer vulnerabilities
• OWASP Agentic AI Top 10 for agent-specific action and autonomy risks
• NIST AI RMF (AI 600-1) for governance structure and risk management
• MITRE ATLAS for adversarial tactics, techniques, and procedures
• EU AI Act requirements for high-risk AI systems (enforceable August 2026)
• ISO/IEC 42001 for AI management system certification

A testing platform that covers all of these dimensions provides not just security assurance but audit-ready evidence for compliance programs including SOC 2 and the EU AI Act.

The Bottom Line

The OWASP Agentic AI Top 10 is a signal that the security community recognizes agents are different from chatbots. The risks are more complex, the attack surfaces are larger, and the consequences of failure are more severe.

Enterprise security teams that treat agent testing as an extension of model testing will miss the most critical vulnerabilities. The agents-take-actions paradigm requires testing approaches that are multi-turn, multi-dimensional, and continuous. Anything less is a checkbox exercise that creates false confidence.