- OWASP's ten agentic risks run from Agent Goal Hijack to Rogue Agents.
- Mapping them to OWASP threat IDs and MITRE ATLAS techniques gives teams a shared vocabulary.
- One chain can cross all three lists, and each link is a place to break it.
- Review each agent's tools, data and permissions against the ten risks, starting with what it can change.
What Are The Main Threats To AI Agents?
The main threats are the ten risks in the OWASP Top 10 for Agentic Applications 2026, published on 9 December 2025: goal hijack, tool misuse, identity and privilege abuse, supply chain weaknesses, unexpected code execution, memory and context poisoning, insecure agent-to-agent communication, cascading failures, human trust exploitation and rogue agents. OWASP says more than 100 industry experts took part. If you are new to the topic, start with what is agentic security.
This article maps those ten risks to two other sources: OWASP's threat guide Agentic AI, Threats and Mitigations (threats T1 to T17) and MITRE ATLAS, the catalog of attack techniques against AI systems. The two use different words for similar things, which makes reports hard to compare. A shared map helps.
- 10Risks in the OWASP Top 10 for Agentic Applications 2026Source: OWASP Gen AI Security Project, Top 10 for Agentic Applications 2026
- 100+Industry experts OWASP says took partSource: OWASP Gen AI Security Project, Top 10 for Agentic Applications 2026
How Do The Three Lists Line Up?
The table below is our reading, matched by meaning. It is not an official crosswalk. One link comes from OWASP's own text: ASI01 maps to threats T06 Goal Manipulation and T07 Misaligned and Deceptive Behaviors of the older guide. The other rows are our reading. A dash means we found no close ATLAS entry in the release we read (2026.09).
| OWASP agentic risk | Closest OWASP threat (T-number) | Closest MITRE ATLAS entry |
|---|---|---|
| ASI01 Agent Goal Hijack | T6 Intent Breaking and Goal Manipulation | AML.T0051 LLM Prompt Injection |
| ASI02 Tool Misuse and Exploitation | T2 Tool Misuse | AML.T0053 AI Agent Tool Invocation |
| ASI03 Identity and Privilege Abuse | T3 Privilege Compromise, T9 Identity Spoofing and Impersonation | AML.T0098 AI Agent Tool Credential Harvesting |
| ASI04 Agentic Supply Chain Vulnerabilities | T17 Supply Chain Compromise | AML.T0110 AI Agent Tool Poisoning |
| ASI05 Unexpected Code Execution (RCE) | T11 Unexpected RCE and Code Attacks | - |
| ASI06 Memory and Context Poisoning | T1 Memory Poisoning | AML.T0080 AI Agent Context Poisoning |
| ASI07 Insecure Inter-Agent Communication | T12 Agent Communication Poisoning, T16 Insecure Inter-Agent Protocol Abuse | - |
| ASI08 Cascading Failures | T5 Cascading Hallucination Attacks | - |
| ASI09 Human-Agent Trust Exploitation | T10 Overwhelming Human in the Loop, T15 Human Manipulation | - |
| ASI10 Rogue Agents | T13 Rogue Agents in Multi-Agent Systems | - |
The ATLAS ids are from release 2026.09 of the MITRE data, which lists 16 tactics. OWASP's older LLM list also has an agent-related entry, LLM06:2025 Excessive Agency (2025 edition). A newer LLM Top 10 for 2026 was published on 3 August 2026, so always say which edition you cite.
What Do The Top Risks Look Like In Practice?
Four of the ten show the pattern well.
- Goal hijack (ASI01). OWASP says agents "cannot reliably distinguish instructions from related content". Text the agent reads can redirect its goal. ATLAS lists the indirect form as AML.T0051.001, where instructions arrive through a data channel such as documents, emails, databases or websites. See prompt injection in AI agents.
- Tool misuse (ASI02). The agent uses a legitimate tool in a harmful way. OWASP's first control is least agency and least privilege for tools, with per-tool profiles such as scopes, maximum rate and egress allowlists. ATLAS also names data theft by tool use as AML.T0086, for example sending email.
- Supply chain (ASI04). OWASP lists MCP and Agent2Agent among the agent interfaces that form part of the supply chain, and ATLAS AML.T0110 covers poisoned tools, including MCP servers and agent skills. A bad tool is one more supply chain attack path. See securing MCP servers and tool access. Insecure messages between agents (ASI07) are covered in securing multi-agent systems.
- Memory and context poisoning (ASI06). OWASP counts summaries, embeddings and RAG stores as context. If bad data gets in, it can shape later steps. See memory and context poisoning in AI agents. ATLAS lists AML.T0080 and, for memory, AML.T0080.000.
The UK NCSC adds a warning on the first risk. In its December 2025 blog it says prompt injection "may never be fully mitigated" the way SQL injection can be. Plan for impact reduction, not only prevention.
What Does One Chain Look Like?
Example (illustrative, not a real incident). An agent at acme.com summarizes incoming supplier email and can also send messages. The chain below uses the ids from the table.
- Hidden text in a supplier emailIndirect prompt injection, AML.T0051.001
- The agent treats it as an instructionAgent Goal Hijack, ASI01
- The agent calls its send toolAI Agent Tool Invocation, AML.T0053
- Internal data leaves by emailExfiltration via tool use, AML.T0086
Each link is a place to break the chain. Treat the email as untrusted input, remove the send tool from this agent, or require approval before any external message. The first two cost almost nothing. The third protects you when the first two fail.
What To Do Next.
Use the map as a checklist for your own review.
- List every agent you run or plan to run, with its tools, data and permissions.
- For each, walk through the ten risks and note which apply. Use the OWASP wording so reports match.
- Rank by what the agent can change, not by how clever it is.
- Apply least privilege and approvals first. The pattern is covered in human in the loop and least agency.
- Add logging so you can see these chains. See monitoring and logging for AI agents.
For threat modeling method, the glossary entry on threat modeling is a good start. Teams that already use the MITRE ATT&CK framework will find ATLAS familiar.