Are your AI agents secure? Ten attack paths to review

Probably not as secure as the chat window suggests. An agent combines untrusted input, real credentials and the ability to act. The OWASP Top 10 for Agentic Applications, published December 9, 2025, groups the resulting risks into ten categories. Each one maps to a question you can ask of any agent today.

Why do agents need their own list?

A chatbot that answers wrongly produces a bad paragraph. An agent that is steered wrongly sends the email, runs the command or merges the change. The model is only one part. Tools, memory, identity and other agents all become places where an attacker can intervene.

OWASP's ten categories, as named by the project, are goal hijack, tool misuse, identity and privilege abuse, agentic supply chain vulnerabilities, unexpected code execution, memory and context poisoning, insecure inter-agent communication, cascading failures, human-agent trust exploitation and rogue agents. The wording below is our own reading, so check the OWASP document for its exact text.

The ten paths, one question each

1. Goal hijack. Instructions hidden in a document, email or web page change what the agent is trying to do. Ask: what untrusted text does this agent read, and can any of it contain instructions?

2. Tool misuse. A legitimate tool is used in a harmful way, for example a file tool pointed at the wrong directory. Ask: what is the worst call each tool allows, and is that bounded?

3. Identity and privilege abuse. The agent acts with more authority than the person it serves. Ask: whose credentials does it use, and are they scoped to the task?

4. Agentic supply chain. Plugins, tool servers, models and prompts come from third parties. Ask: can you list every external component the agent loads, with versions?

5. Unexpected code execution. The agent generates or runs code you did not review. Ask: where does generated code run, and with what network and file access?

6. Memory and context poisoning. Bad content gets stored and shapes later behavior. Ask: who can write to the agent's memory, and can you inspect and wipe it?

7. Insecure inter-agent communication. One agent trusts another's messages too readily. Ask: do agents authenticate each other, or just pass text?

8. Cascading failures. A small error spreads through chained agents. Ask: what stops one wrong output from becoming ten wrong actions?

9. Human-agent trust exploitation. People over-trust a confident agent and approve bad actions. Ask: do approval prompts show the real action, in plain words?

10. Rogue agents. An agent drifts from its intended behavior or is deployed without oversight. Ask: do you have an inventory of running agents and an owner for each?

A constructed example

A support agent reads inbound tickets and can refund orders up to a limit. A ticket contains hidden text telling the agent to refund a different account. That touches paths 1, 2 and 3 at once. The fix was not a smarter model. It was a rule outside the model: refunds above zero need the ticket's own customer ID to match, and the agent's token cannot refund anyone else.

How to check or apply this

1. Make an inventory of agents, their tools, their data sources and the identity each runs under.
2. For each agent, walk the ten questions and write one line per answer. Mark unknowns.
3. Put limits outside the model: scoped tokens, allow lists for tool calls, network egress rules, human approval for irreversible actions.
4. Log every tool call with the agent identity, inputs and outcome.
5. Test with benign canary instructions planted in documents the agent reads, and confirm they are ignored.
6. Re-run the review when you add a tool, a plugin or a memory store.

Safeguard offers an MCP Guardrail for tool calls and agent identity controls, which map to paths 2 and 3. They do not replace the review above.

Quick check

Sources

• OWASP GenAI Security Project, Top 10 for Agentic Applications for 2026
• NIST NCCoE, Software and AI Agent Identity and Authorization

Last reviewed: 18 October 2026.