The OWASP Top 10 For Securing Them

By Evgeniy Kokuykin, Eva Benn, Idan Habler, Helen Oakley, Ron F. Del Rosario, John Sotiropoulos, and Keren Katz

 

The emergence of autonomous and agentic AI marks a genuine watershed moment. For organizations, the challenge is no longer whether AI will be used, but how to respond proportionately to new forms of autonomy without constraining innovation or exposing themselves to unmanaged risk.

The OWASP Top 10 for Agentic Applications is designed as a navigational compass, helping organizations understand what matters, when it matters, and why, as they move through the agentic AI adoption curve.

This isn’t just a list of risks. It’s a framework connected to the larger Agentic Security Initiative (ASI), reviewed and refined through engagement with the UK National Cyber Security Centre, the Financial Conduct Authority, and practitioners from Airbus, Rentokil, and Nash Consulting. The initiative has collaborated with NIST, AWS, Microsoft, Oracle, JPMorgan, and the Alan Turing Institute; ensuring the guidance reflects both operational reality and forward-looking research.

Proportional Security Across the Adoption Curve

Organizations face different risks depending on where they are in their agentic journey. The Top 10 recognizes that not every risk applies equally at every stage.

For organizations experimenting with copilots or single-agent augmentation, multi-agent orchestration concerns may be irrelevant. At early stages, fundamentals dominate: supply-chain pressures, configuration integrity, and emerging protocols like the Model Context Protocol (MCP).

By contrast, organizations moving toward multi-agent or autonomous decision-making systems in production face qualitatively different risks. The Top 10 is structured to signpost relevance, helping teams focus effort where it delivers the greatest risk-reduction.

A Connected Body Of Guidance

The Top 10 doesn’t stand alone. It serves as an entry point to the wider ASI body of work:

Threat Modelling Guide — Fine-tune applicability within your own architectures.

Securing Agentic Applications — Expand mitigations into concrete engineering playbooks.

State of Agentic AI & Governance — Support organizational adoption and executive decision-making.

Together, these form an executable framework for securing innovation at the speed of change.

Why This Matters Now

These resources exist because the risks are already materializing. Last year brought a run of incidents with a simple takeaway: as the agentic stack grows more capable, it becomes dependent on a larger set of moving parts.

In that environment, a compromised component can cause system outages, exfiltrate sensitive data, and trigger unintended actions through tools that were granted legitimate authority. What makes this especially dangerous in agentic systems is that these components are not passive, they sit next to planning logic, memory, and tool credentials. A supply chain compromise can influence not just data, but decisions and actions.

Unlike traditional applications, agents are designed to act on behalf of users and systems. A single compromised dependency can quietly inherit real operational authority.

Real Incidents, Real Lessons

CVE-2025-3248

Langflow Remote Code Execution. A critical unauthenticated RCE vulnerability in Langflow, a popular Python framework for building agentic workflows. Trend Micro reported active exploitation delivering a botnet. In agentic deployments, Langflow often functions as a control layer for how agents reason and which tools they invoke. When compromised, the attacker effectively steps into the agent’s role.

July 2025

Amazon Q VS Code Extension Compromise. An update to the Amazon Q VS Code extension reportedly shipped with a malicious prompt embedded via changes to an open-source repository. A compromised extension could lead an assistant to invoke harmful commands that appear legitimate, the assistant follows instructions received through a trusted update path, using tools it was explicitly permitted to access.

CVE-2025-53967

Framelink Figma MCP Server RCE. A vulnerability in the widely-used Framelink Figma MCP server (approximately 600k downloads) enables unauthenticated remote code execution. The agent’s tool interface becomes the execution surface, allowing normal design-to-code actions to be repurposed for arbitrary command execution. This represents both an agentic supply chain exposure and a rogue execution surface.

What These Incidents Teach Us

Securing agentic supply chains requires more than traditional dependency scanning. Organizations should assume that agents will inherit trust from the components they rely on, and plan accordingly:

Treat agent frameworks, extensions, and protocol servers as privileged control planes.

Limit the authority granted to tools.

Monitor for behavioral drift rather than isolated exploits.

Design for rapid containment when an agent begins acting outside its intended scope.

These attacks rarely trigger warnings, each individual action is consistent with expected behavior. The failure is only visible through the Agentic Top 10 lens, where cascade failures, privilege drift, and trust exploitation are treated as first-class hazards rather than edge cases.

Turning the Framework into Practical Outcomes

How do organizations move from awareness to action? Implementing the Top 10 requires shifting from seeing agents as narrow technical components to recognizing them as a strategic risk surface that can materially shape, influence, and at times directly control production environments.

The first step is developing a comprehensive understanding of the agentic ecosystem; not as a static inventory but as a living supply chain. Agent behavior is shaped by enterprise APIs, MCP servers, RAG pipelines, model plugins, and internal orchestration layers. These components evolve frequently, often without centralized governance, and each introduces a trust boundary that can be influenced or compromised.

To accurately assess exposure, establish foundational visibility: what agents exist, the code and descriptors they dynamically load, the external registries they trust, and the privileges they inherit. Once this understanding exists, the Top 10 becomes a framework for prioritizing mitigations based on organizational context.

Getting Started: 90-Day Roadmap

For teams seeking practical guidance on operationalizing the framework, the ASI has developed a 90-day roadmap:

Watch: “A Practical Playbook For Adopting The OWASP Top 10 For Agentic Applications” — youtu.be/MHy118Ei87M

A Collective Response

The OWASP Agentic Security Initiative is deliberately rewriting how autonomous AI is secured, making it a collective response that extends across industry, academia, and government.

This represents a shift away from reactive, control-centric thinking toward an integrated framework that helps organizations use AI security as a lever to accelerate innovation safely, responsibly, and with confidence.

Organizations can join this coalition and contribute at: genai.owasp.org/initiatives/agentic-security-initiative

Resources

OWASP Top 10 for Agentic Applications: genai.owasp.org

ASI Agentic Exploits & Incidents Tracker: GitHub (OWASP LLM Applications)

90-Day Adoption Roadmap: youtu.be/MHy118Ei87M

OWASP Agentic Security Initiative Contributors

Evgeniy Kokuykin is Co-Lead of the Agentic Security Initiative within the OWASP GenAI Security Project and CEO of HiveTrace.

Eva Benn is a Principal Security Program Manager at Microsoft and contributor to the OWASP for LLM Project.

Idan Habler is a Co-Lead of the OWASP Securing Agentic Applications initiative and the OWASP MCP Cheatsheets.

Helen Oakley is an executive leader at the intersection of AI and cybersecurity and a co-lead of initiatives within the OWASP GenAI Security Project. She is the creator of the OWASP AIBOM Generator and the OWASP Agentic AI CTF (FinBot).

Ron F. Del Rosario co-founded the Agentic Security Initiative (ASI) and is a Core Team Member of the OWASP Gen AI Security Project. Ron currently serves as Vice President, Head of AI Security at SAP Intelligent Spend.

John Sotiropoulos is an AI security practitioner who has safeguarded national-scale AI programmes. He serves on the OWASP GenAI Security Project Board, co-leads the OWASP Agentic Security Initiative, and chairs the OWASP Top 10 for Agentic Applications.

Keren Katz is the lead of OWASP Top 10 for Agentic Applications. She is leading AI Security Detection at Tenable and has been at the intersection of AI and security for the last 12 years, both hands on and in leadership positions.