The OWASP Top Ten for Agents

OWASP is the group that's been publishing lists of the top web security risks for over twenty years. In December twenty twenty five, they published a top ten for agentic applications, written with over a hundred experts. If you build agents, you should know this list.

• OWASP: two decades of security lists
• December 2025: a top ten for agents
• Every builder should know it

The main risks, and your defences

Here are some of the key entries, along with the defence that you've already learned for each of them. Run it. Goal hijack is injection. Tool misuse comes from too much power. Unexpected code execution needs a sandbox. Memory poisoning needs memory that can't grant power. Cascading failures need validated handovers. And rogue agents need monitoring. Look at that list. You've already got an answer for each one.

RISKS = {
    "ASI01": "Goal hijack",
    "ASI02": "Tool misuse",
    "ASI05": "Unexpected code execution",
    "ASI06": "Memory and context poisoning",
    "ASI08": "Cascading failures",
    "ASI10": "Rogue agents",
}

DEFENCES = {"ASI01": "Assume injection, gate in code",
            "ASI02": "Narrow tools, least agency",
            "ASI05": "Sandbox all generated code",
            "ASI06": "Memory never grants power",
            "ASI08": "Validate every handover",
            "ASI10": "Monitoring and a kill switch"}

for code, risk in RISKS.items():
    print(f"{code}  {risk:<30} {DEFENCES[code]}")

ASI01  Goal hijack                    Assume injection, gate in code
ASI02  Tool misuse                    Narrow tools, least agency
ASI05  Unexpected code execution      Sandbox all generated code
ASI06  Memory and context poisoning   Memory never grants power
ASI08  Cascading failures             Validate every handover
ASI10  Rogue agents                   Monitoring and a kill switch

The kill switch

Every production agent needs a kill switch. A single setting, which stops all agents, immediately. Test it before you need it. When things go wrong at machine speed, you won't have time to find the right code. And prepare an incident plan. Who gets called? How do you undo the actions?

Your security checklist

Before launching an agent, ask yourself. If the model is fully tricked, what's the worst case? Have you removed one leg of the trifecta? Are hard rules enforced in code? Is generated code sandboxed? Are all actions logged? Is there a person on high risk actions? And can you shut it down in seconds?

Summary