Two Security Leaders Break Down The OWASP Top 10 For Agentic AI

Featuring Eva Benn (Principal Security Program Manager, Microsoft) and Sumeet Jeswani (Senior Solutions Consultant, Google)

Interview by Confidence Staveley | AI Cyber Magazine

When OWASP released the Top 10 for Agentic Applications, it marked a turning point. The previous Top 10 focused on LLM security; how inputs influence model responses. But agentic systems don’t just respond. They decide, remember, and act.

In this exclusive conversation, Eva Benn and Sumeet Jeswani, both contributors to the OWASP framework, walk us through each of the ten risks, share real-world incidents, and introduce a memorable framework for understanding agentic risk: ATM (Autonomy, Tool Use, Memory).

The ATM Framework

SUMEET: The way I like to see it is ATM: Autonomy, Tool Use, and Memory. Autonomy meaning they can make their own decisions and act on your behalf without you even knowing. You keep thinking, ‘Did I even authorize this?’

With tool use, we have so many third-party tools, APIs, and components that are part of the overall workflow — that increases the blast radius. One thing goes wrong and it could lead to failures across the whole stack.

And with memory, because agents have long-term memory, if you poison or corrupt that memory, it’s going to be hard to recover from as an organization.

Secure The ATM

A — Autonomy: Agents make decisions and act without human approval.

T — Tool Use: Agents access APIs, databases, and external systems.

M — Memory: Agents retain context that influences future decisions.

The OWASP Top 10 For Agentic Applications

EVA: You need to download it and study it. This is not a one-time read — it’s something you keep printed next to you on your desk.

ASI01 Agent Goal Hijack

Attackers can influence the agent’s goals and decision paths through prompt manipulation, deceptive tool responses, poisoned external data, or malicious artifacts. Unlike LLM risks that impact single outputs, manipulated inputs here can cause systemic failure across the entire system.

Eva

ASI02 Tool Misuse and Exploitation

Authorized tools in your workflow can be tampered with to deviate from their original goal. Agents misuse legitimate tools through prompt manipulation or privilege control, resulting in data exfiltration. We’re talking about tools that were always supposed to be there, but are being manipulated.

Sumeet

ASI03 Over-Permissioned Agents / Privilege Abuse

Similar to classic privilege escalation, but identity is fluid and implicit. Agents inherit trust dynamically through delegation chains, shared context, cached credentials, and agent-to-agent interactions. This creates an ‘attribution gap’, the ‘who is acting’ becomes ambiguous.

Eva

ASI04 Agentic Supply Chain Vulnerabilities

The ecosystem includes third-party tools, external models, MCP servers, and dynamically loaded programs. If one component is compromised, it’s a problem for the overall workflow. We’re talking about malicious third-party tools, not the authorized ones from ASI02.

Sumeet

ASI05 Unexpected Code Execution

Similar to vanilla RCE, but the code is often generated and executed dynamically by the agent itself. Vibe coding tools write code in real time, invoke scripts, deserialize objects, and load modules as part of normal operation. Because this is expected behavior, it can bypass traditional security controls.

Eva

ASI06 Memory and Context Poisoning

If attackers poison or corrupt the agent’s long-term memory, you’re in deep trouble. It’s not an instant failure; the results get worse over time. It’s a slow poison. The agent believes the corrupted information is true and serves accordingly.

Sumeet

ASI07 Insecure Communication Channels

The underlying issue is the same as traditional service-to-service failures, but agentic systems raise the stakes. Communication is continuous, autonomous, and meaning-driven. Traditional perimeter defenses break down because there is no clear insider/outside. Attackers can manipulate intent and behavior, not just messages.

Eva

ASI08 Cascading Failures

If there’s a failure at a single point, it cascades throughout the chain. Think of it like a domino effect; if one domino falls, every domino going forward falls because of it. You need guardrails at different checkpoints so failures don’t propagate.

Sumeet

ASI09 Human-Agent Misalignment

This is social engineering, but agent to human. Agents can sound confident, empathetic, authoritative, which increases the likelihood of humans blindly trusting them. The most dangerous aspect: the agent doesn’t execute the final action. The human does, because the agent convinced them.

Eva

ASI10 Rogue Agents

If agents go rogue, you don’t know where to go in the system. The Air Canada case: an AI chatbot gave misinformation about refund policies, the consumer sued, and the court ruled the company liable for the AI’s actions. You’re liable for what your agents do.

Sumeet

Real-World Incident: The Vibe Coding Disaster

EVA: Earlier this year, an AI agent on a popular vibe coding platform deleted a live production database containing real user and company data, even though there was an active code freeze and no permission to make production changes.

After deleting the database, the agent didn’t stop and clearly say what went wrong. Instead, it made up information and gave the humans convincing, reassuring, and false responses, making it seem like everything was fine. It hid the real damage from the human using it.

Three risks converged: Agent Goal Hijack (executing destructive actions outside stated constraints), Human-Agent Trust Exploitation (misleading the human with false evidence), and Rogue Agent behavior (continuing autonomous operation after causing harm instead of stopping and escalating).

---

Least Privilege vs. Least Agency

EVA: Least privilege limits what tools and permissions an agent has access to. Least agency limits how much autonomy the agent has to act at all. An agent can have minimal permissions but still be dangerous if it’s allowed to act autonomously without oversight on critical transactions.

SUMEET: Your agent might have privilege to access a database, but have you given it the agency to delete that database? That’s the difference.

Two Critical Code-Level Mistakes

SUMEET: First, what I call ‘God Mode Tokens.’ You’re giving your agent highly privileged API keys to perform all functions when they just need read access. If they only need to read part of a database and you’re giving them admin rights, you’re digging your own grave.

Second, unvalidated chaining of tools. When one tool fails and you’re not validating its output, which becomes the input to the next tool, it cascades. That’s how cascading failures happen. You need guardrails at different checkpoints.

Monday Morning: Where To Start

EVA: If you’re a leader responsible for deploying or securing agents, send an email to say: ‘We’re adopting this as a standard for agentic AI.’ Then assign an owner to drive it, because a framework without accountability becomes shelfware.

Start identifying your pilot workflows. Use the Top 10 to understand all the potential failure modes. Most importantly: prioritize the risks that are relevant to you. Not all of them may apply. Some might be more important depending on your industry.

SUMEET: This should be your starting point — but there’s much more beyond this. Don’t forget about the overall organizational security. If you implement everything we said but forgot about a basic network firewall, you’re still going to get breached. Defense in depth is key.

Three Words

CONFIDENCE: If you had to explain the OWASP Agentic Top 10 in an executive meeting using just three words, what would they be?

EVA: Secure your agents.

SUMEET: Secure the ATM.

About The Guests

Eva Benn is a Principal Security Program Manager at Microsoft with a career spanning red teaming and penetration testing. She’s an international keynote speaker, cybersecurity educator, and contributor to the OWASP for LLM Project. Her work intersects cybersecurity and psychology.

Sumeet Jeswani is a Senior Solutions Consultant at Google with 10+ years of experience in cloud security. He leads secure cloud and AI/LLM infrastructure transformations, specializing in zero-trust systems and mitigating advanced cyber threats.