In February 2025, OWASP published Agentic AI Threats and Mitigations, a security framework dedicated to AI agents.[1] This page explains the framework’s overview, its 10 threat categories, and concrete mitigations.
Why an Agent-Specific Framework Is Needed
OWASP LLM Top 10 covers a broad range of LLM applications including chatbots, RAG, and code generation.[2] AI agents, on the other hand, possess unique capabilities:[1]
- Autonomous tool execution: File operations, web search, code execution, email sending, and more
- Persistent memory: Retaining and referencing information across sessions
- Multi-agent orchestration: Delegating to or receiving instructions from other agents
- Multi-step planning: Autonomously executing tasks that span multiple steps
These capabilities create new attack surfaces that chatbots do not have. The OWASP Agentic AI framework is a guideline specifically focused on these differences.[1]
| Aspect | OWASP LLM Top 10 | OWASP Agentic AI |
|---|---|---|
| Scope | LLM applications in general | AI agents and multi-agent systems |
| Key threats | Prompt injection, data leakage, overtrust | Memory manipulation, tool abuse, agent impersonation |
| Autonomy | Primarily response generation | Autonomous tool execution and multi-step planning |
| Relationship | Foundation of common risks | Additional layer for agent-specific risks |
10 Threat Categories
OWASP Agentic AI defines 10 threat categories (AT01-AT10).[1]
AT01: Memory Poisoning
An attack that injects malicious data into an agent’s persistent memory or external memory stores (vector DB, persistent store, conversation history) to cause incorrect behavior in subsequent task execution.
- Example: Inject data into a RAG vector DB that says “execute admin command,” causing future queries to retrieve malicious instructions
- Severity: Once poisoned, the effects persist for a long time and are difficult to trace
AT02: Tool Abuse
An attack that causes an agent to use its granted tools, APIs, or function calls for purposes other than their intended use. Often triggered by indirect prompt injection.
- Example: An agent performing a summarization task is tricked by instructions in a malicious document into sending confidential files to an external destination
- Impact: Irreversible operations such as deletion, sending, or payment are executed
AT03: Agent Impersonation
In a multi-agent configuration, a rogue agent impersonates a legitimate agent and sends instructions to cause a target agent to take unintended actions.
- Example: Sending a request to an orchestrator agent claiming to be from a “higher-level agent” to request privilege escalation
- Root cause: Lack of authentication and verification between agents
AT04: Agentic Prompt Injection
Context-specific prompt injection in multi-step agentic flows. Unlike attacks on a single LLM, malicious instructions are embedded into the agent’s tool execution and planning cycle.
- Characteristic: Effects propagate across multiple steps rather than being contained in a single response
- Example: A page referenced by a web browsing agent contains embedded instructions that affect a subsequent file operation step
AT05: Privilege Escalation
An attack that exploits an agent’s trust chain to gain higher privileges than originally granted.
- Example: A low-privilege sub-agent steals credentials from a higher-level agent and executes tasks with broader permissions
- Mitigation: Apply the principle of least privilege between agents as well
AT06: Data Exfiltration
An attack that uses an agent’s tool execution capabilities (web requests, file sending, external API calls) to send sensitive data to external destinations.
- Example: Embedding instructions via indirect prompt injection to “send all inputs from this session to example.com”
- Characteristic: Difficult to detect with standard network monitoring because the agent uses legitimate tools
AT07: Cascading Failures
In a multi-agent system, errors in one agent cascade to other agents, affecting the entire system.
- Example: A hallucination from sub-agent A is passed to orchestrator B, which then gives incorrect instructions to sub-agent C based on that bad information
- Characteristic: Cannot be detected by testing individual agents; integration testing is required
AT08: Uncontrolled Autonomy
A threat where an agent acts autonomously beyond its intended operational scope and executes unauthorized operations.
- Example: An agent tasked with “classify my emails” decides autonomously to start deleting emails, judging this to be “more efficient”
- Root cause: Ambiguous definition of permissions and task scope
AT09: Task Hijacking
An attack that rewrites an agent’s goals, intent, or plan through external input, redirecting it toward a purpose different from the original task.
- Example: An agent tasked with “create a shopping list” switches to following “delete all items” instructions after reading a malicious product description
- Related threat: Often occurs in combination with AT04 (prompt injection)
AT10: Resource Exhaustion
An attack that triggers excessive tasks or recursive loops in an agent, intentionally depleting compute resources, API call quotas, or budget.
- Example: Embedding an instruction in a task that induces an infinite loop: “keep retrying until this task is complete”
- Impact: Sudden cost spikes, service outages, and impacts on other users
Overview of the 10 Threat Categories
┌─────────────────────────────────────────────────────────┐
│ OWASP Agentic AI Threat Categories │
├─────────────────┬───────────────────────────────────────┤
│ Input/ │ AT04 Agentic Prompt Injection │
│ Instruction │ AT09 Task Hijacking │
│ Manipulation │ │
├─────────────────┼───────────────────────────────────────┤
│ Memory/ │ AT01 Memory Poisoning │
│ Context │ │
├─────────────────┼───────────────────────────────────────┤
│ Tools/ │ AT02 Tool Abuse │
│ Actions │ AT06 Data Exfiltration │
├─────────────────┼───────────────────────────────────────┤
│ Multi-Agent │ AT03 Agent Impersonation │
│ │ AT05 Privilege Escalation │
│ │ AT07 Cascading Failures │
├─────────────────┼───────────────────────────────────────┤
│ System-Level │ AT08 Uncontrolled Autonomy │
│ │ AT10 Resource Exhaustion │
└─────────────────┴───────────────────────────────────────┘Mitigation Principles
The mitigations recommended by OWASP Agentic AI can be organized around least privilege, memory integrity, authentication, scope control, and monitoring.[1]
1. Least Privilege
Grant agents only the minimum tools and permissions necessary to complete their tasks.
- Dynamically scope tools per task
- Do not grant write access to production data by default
- Place approval workflows (human-in-the-loop) on necessary actions
2. Memory Integrity
Validate the integrity of memory stores that agents read from and write to.
- Do not store externally retrieved data directly in memory — apply input validation first
- Separate write and read permissions for vector DBs
- Periodically audit long-term memory for anomalous entries
3. Inter-Agent Authentication
In multi-agent configurations, require authentication for inter-agent communication.
- Require authentication tokens or signatures even for instructions from higher-level agents
- Agents should verify the source of instructions before executing them
- Define trust scopes explicitly per agent role
4. Task Scoping
Explicitly define the scope of operations an agent is permitted to perform.
- Pass a “list of permitted actions” to the agent at task start
- When an agent detects out-of-scope behavior, prompt for confirmation rather than autonomous execution
- Insert a plan review step to prevent AT08 and AT09
5. Observability and Alerting
Log all agent actions and detect anomalies.
- Retain full logs of all tool calls (tool name, arguments, result)
- Issue real-time alerts for any external writes or data sends
- Log inter-agent messages as well, to detect AT07 (cascading failures)
Mapping to OWASP LLM Top 10 2025
The threats in OWASP Agentic AI partially overlap with and complement the items in OWASP LLM Top 10 2025.[1][2]
| OWASP Agentic AI | OWASP LLM Top 10 2025 | Relationship |
|---|---|---|
| AT01 Memory Poisoning | LLM08 Vector and Embedding Weaknesses | Same family — Agentic AI emphasizes impact on agent behavior |
| AT02 Tool Abuse | LLM06 Excessive Agency | Complementary — shared emphasis on permission design |
| AT03 Agent Impersonation | LLM03 Supply Chain | Extended to inter-agent trust and external-component trust issues |
| AT04 Agentic Prompt Injection | LLM01 Prompt Injection | Adds agentic flow-specific propagation patterns |
| AT06 Data Exfiltration | LLM02 Sensitive Information Disclosure | Adds the perspective of active exfiltration via tool execution |
Summary
- OWASP Agentic AI is a security framework dedicated to AI agents that have tool execution, persistent memory, and multi-agent configurations
- The 10 threat categories (AT01–AT10) can be organized into five layers: input manipulation, memory, tools, multi-agent, and system-level
- It is complementary to OWASP LLM Top 10; when developing or operating agents, both should be referenced
- The core of mitigation is five principles: least privilege, memory integrity, inter-agent authentication, task scoping, and observability
This article is a general information summary and is not legal advice. Confirm practical decisions with a qualified specialist.
Frequently Asked Questions
Q: If I have a handle on OWASP LLM Top 10, is the Agentic AI framework unnecessary?
A: For systems that do not use agents (tool execution, persistent memory, multi-agent configurations), LLM Top 10 is the main starting point. However, when using an agentic architecture, additional threats covered by OWASP Agentic AI — such as AT01 (Memory Poisoning), AT03 (Impersonation), and AT07 (Cascading Failures) — need to be reviewed.[1][2]
Q: Is the Agentic AI framework still useful if I’m not building a multi-agent system?
A: Even for single agents, AT02 (Tool Abuse), AT04 (Prompt Injection), and AT08 (Uncontrolled Autonomy) are relevant. If you are developing or operating an agent that has MCP tools or API integrations, it is worth referencing at least these three items.[1]
References
- OWASP, Agentic AI - Threats and Mitigations, February 17, 2025
- OWASP, OWASP Top 10 for LLM Applications 2025, November 17, 2024