OWASP Agentic Top 10 as a build checklist for AI apps

A build checklist for apps whose AI can act, starting with ASI01 Agent Goal Hijack and covering all ten risks, checked against primary sources on October 24, 2026.

Timothy Lindblom

Founder, Newly

October 24, 2026|9 min read

Published October 24, 2026Last updated October 24, 2026

The OWASP Top 10 for Agentic Applications lists ten risks for apps whose AI can take actions as well as write text. Use it as a build checklist by starting with ASI01 Agent Goal Hijack: write down what your agent reads, what it can do and whose access it uses. Then work through ASI02 to ASI10 with the table below and keep one piece of evidence for each.

What is the OWASP Agentic Top 10, and who is it for?

The OWASP GenAI Security Project published the list on December 9, 2025. It names ten categories, ASI01 to ASI10, for software where a model plans steps, calls tools and acts for a user. It is for the person who decides what the AI inside an app is allowed to do, which for an AI-built app is usually you.

Item	What it is	Date
Agentic Top 10	Ten risk categories for agentic applications, ASI01 to ASI10	December 9, 2025
LLM Top 10 2026	The companion list for the model layer. Excessive Agency is third, and the list maps to the agentic one	September 1, 2026
Agent Control Standard	A standard for runtime hooks and declarative controls that agent platforms enforce	September 1, 2026
CISA agentic AI guide	Joint guide that advises against broad or unrestricted access and starting with low-risk, non-sensitive use cases	May 1, 2026
Prompt injection status	OWASP's LLM01:2026 page says no reliable prevention exists, so defense is architectural	Checked October 24, 2026

That last row shapes the whole checklist. If the model can be talked into things, the controls have to live outside the model: in the tools it can call, the credentials those tools use and the approvals in front of them. The sources are OWASP's September 1, 2026 announcement, LLM01:2026 and CISA's guide. For the model layer on its own, read what changed in the 2026 LLM list.

Is my app agentic, and which combination is the risky one?

If the AI in your app can send a message, write a record, call an API or browse a page, treat it as agentic. A useful test is Meta's Agents Rule of Two, which OWASP's LLM01 page also cites. Within one session, an agent should have no more than two of three properties: it reads untrusted input (A), it reaches sensitive data or systems (B), or it changes state or communicates outside (C).

Properties held	Example in an app	What to do
A and B	An assistant reads uploaded documents and the user's records, then only replies in the chat	Keep it without write tools. Check that replies cannot load images or links built from record data
A and C	A public chat that can open a support ticket and sees no customer data	Validate every ticket field in code and cap tickets per user
B and C	An internal assistant that reads only your own trusted data and updates records	Log every write and require approval for bulk changes
A, B and C	An assistant that reads inbound email, sees customer records and can reply	Drop one property, or put a human approval on the C step

The last row is the one to remove first. See how hidden text in email targets AI inbox assistants and how rendered images carry data out of a chat.

What is ASI01 Agent Goal Hijack, and how do I check for it?

OWASP describes ASI01 with the line that hidden prompts turned copilots into silent exfiltration engines. In practice, the agent is redirected into actions its owner did not intend. MITRE added matching entries to ATT&CK on October 13, 2026: T1698 Indirect Prompt Injection, T1699 Direct Prompt Injection and T1700 AI-Enabled Exfiltration. Our ATT&CK v20 explainer covers the IDs. Direct means the user typed it. Indirect means the agent read it in a document, page, email or tool result.

Where the three controls in this checklist sit on an agent's request path.

Six checks for ASI01

List every input your agent reads that someone else wrote: user messages, uploads, emails, web pages, retrieved documents and tool results.
Beside each input, write the most damaging thing the agent could do next with its current tools.
Keep untrusted text out of your instructions. OpenAI's guidance for building agents says to pass untrusted input through user messages, not developer messages.
Define a fixed output shape between steps, such as enums and required fields, and validate it in your own code.
Put an approval in front of any action that changes data or sends something out. OpenAI recommends always enabling tool approvals.
Strip invisible Unicode from text before it reaches the model, as LLM01:2026 recommends.

To test your own app, put a harmless instruction in a test document, such as asking for a chosen word at the end of every reply, and see whether the agent follows it. Do this on a test account. The 15-minute chatbot self-test walks through the rest.

What does each of the ten risks mean for my app?

The second column shortens OWASP's one-line description of each category from its announcement. The third column is our mapping to things you can open in your project, drawn from LLM01:2026, LLM03:2026 and the Expo and Supabase docs. It is not text from the OWASP document.

Risk	OWASP summary	Look for this in your app
ASI01 Agent Goal Hijack	Hidden prompts turned copilots into silent exfiltration engines	Untrusted inputs with no approval before actions
ASI02 Tool Misuse	Agents turn legitimate tools into harmful outcomes	Open-ended tools such as run any query. LLM03 advises granular tools with strict input validation
ASI03 Identity & Privilege Abuse	Leaked credentials let agents act beyond their scope	A shared key for all users. Expo says EXPO_PUBLIC_ values are visible in plain text in the compiled app. Supabase says a secret key should never reach the browser or customers
ASI04 Agentic Supply Chain Vulnerabilities	Runtime components could be poisoned	Unpinned MCP servers, agent skills and packages. See the dependency pinning checklist
ASI05 Unexpected Code Execution	Natural-language paths unlock new code execution	Any tool that runs generated code, shell commands or SQL built from model text
ASI06 Memory & Context Poisoning	Behavior is manipulated after the first interaction	Saved memory or notes the agent writes and later reads. LLM01 treats memory writes as privileged
ASI07 Insecure Inter-Agent Communication	Spoofed messages misdirect coordinated agents	Two agents or services passing messages with no authentication between them
ASI08 Cascading Failures	Wrong signals amplify through automated pipelines	Loops and retries with no cap. LLM03 suggests circuit breakers that halt or rate-limit
ASI09 Human-Agent Trust Exploitation	Confident explanations mislead people into approving harm	Approval screens that show a summary and hide the real parameters
ASI10 Rogue Agents	Agents show misalignment, concealment or self-directed behavior	No log of tool calls and no way to switch the agent off quickly

Two rows link to deeper pages. For ASI04, read the AI dependency pinning checklist and MCP tool poisoning and rug pulls. For ASI03, the CERT-In advisory on AI agents and leaked secrets is a dated example of over-broad access, and red.run.cloud's audit of AI tools connected to Google Workspace shows what to look at in an account you already have.

Why the tools and credentials come first

Do ASI02 and ASI03 before ASI01. A hijacked agent that holds one narrow tool and the signed-in user's own access can reach little. The same hijack with a secret key and a generic query tool can reach everything. LLM03:2026 says to enforce authorization in logic, not in the model's judgment.

What changes if my agent uses MCP servers?

Each connected server adds tools you did not write. The MCP tools page says servers must validate all tool inputs, implement access controls, rate limit invocations and sanitize outputs. It says there should always be a human in the loop who can deny tool calls, and that clients must treat tool annotations as untrusted unless the server is trusted.

If a server is reachable over HTTP, the authorization page says it must validate that an access token was issued for it as the intended audience, and must not accept or pass on any other tokens. Authorization itself is optional in the spec, so an endpoint with none is allowed to exist. Check yours with the MCP authorization checklist and the guide to binding servers to localhost.

Where do you stand?

Every item starts as unknown. Move one to confirmed only when you hold the evidence listed under it. If you found the problem, mark it detected and fix it before you add more tools.

Your agentic build checklist

Detected: You found the problem.
Unknown: Not checked yet, or the check could not tell.
Confirmed by owner evidence: You checked and kept the proof.

1. I have a written list of every input my agent reads that someone else wrote, and each one is labelled as untrusted.
Evidence: the list, plus the place in the code where untrusted text enters the model call.
2. Each tool does one narrow job, validates its input in code, and has no generic query or shell option.
Evidence: the tool list with each tool's name, parameters and validation rule.
3. Tools act with the signed-in user's access, and no service key or other secret key is inside the app bundle.
Evidence: which credential each tool uses, and a second test account's refused request.
4. Any action that changes data or sends something out waits for the user, and the approval screen shows the real parameters.
Evidence: a screenshot of the approval screen for the riskiest tool.
5. Steps per request, retries and spend per user are capped, and a loop halts instead of continuing.
Evidence: the limit settings and a test run that hit the cap.
6. Every tool call is logged without secrets, and I can switch the agent off without a redeploy.
Evidence: a sample log line and the switch or setting that disables it.

0 detected6 unknown0 confirmed by owner evidence

Your answers stay in this browser tab. Nothing is saved or sent.

An outside check covers only part of this. The limits of an external scan apply here too: a bundle key or an open endpoint is visible from outside, and a hijackable tool call is not. For the file where your keys live, see EXPO_PUBLIC_ in the Expo docs.

Frequently asked questions

Is the OWASP Agentic Top 10 a standard I have to comply with?

No. It is a ranked list of risks from the OWASP GenAI Security Project, published on December 9, 2025. Nothing on this page certifies an app. Use it to decide what to check, and keep the evidence for each check.

Does it apply if my chatbot cannot call any tools?

Mostly the LLM Top 10 applies instead, because the model can only produce text. The agentic list starts to matter when the AI can send a message, write a record, call an API or browse. Check whether the chat window renders links or images from model output, since that can send data out without any tool.

Can a scan find agent goal hijack in my app?

No. The free scan on red.run.cloud reads what your site serves and matches versions to known vulnerabilities. It can see an exposed endpoint or a key in a shipped bundle. It cannot see how a model behaves when it reads hostile text, so treat that as unknown until you have tested it yourself.

Which of the ten should I fix first?

Start with ASI03 Identity and Privilege Abuse and ASI02 Tool Misuse, because they set the damage limit for everything else. OWASP's 2026 LLM guidance says to give tools the minimum functions and permissions and to require human approval for high-impact actions. ASI01 then becomes a smaller problem, because a hijacked agent can reach less.

What does Newly cover here?

Newly builds a real iPhone and Android app with React Native and Expo, and you can download the code or connect your own repository. What the AI features inside your app may read and do is a design decision in your project, so these checks are yours to run. AI inside your app uses credits, which is one reason to cap loops and retries.

How often should I redo the checklist?

Redo it when you add a tool, connect a new MCP server, widen a permission or let the agent read a new kind of content. The list itself will change too, so check the OWASP page for the current edition when you start.

Sources

All sources were opened on October 24, 2026. The full text of the OWASP Agentic Top 10 document could not be read when this page was written, so category summaries come from OWASP's own announcement.

OWASP Top 10 for Agentic Applications: the benchmark for agentic security, OWASP GenAI Security Project, December 9, 2025
OWASP Top 10 for Agentic Applications for 2026, OWASP GenAI Security Project
Agentic Security Initiative, OWASP GenAI Security Project
2026 Top 10 for LLM Applications and Agent Control Standard, OWASP GenAI Security Project, September 1, 2026
Agent Control Standard, OWASP GenAI Security Project
LLM01:2026 Prompt Injection, OWASP GenAI Security Project, GitHub
LLM03:2026 Excessive Agency, OWASP GenAI Security Project, GitHub
MCP specification 2026-07-28: Authorization, Model Context Protocol
MCP specification 2026-07-28: Tools, Model Context Protocol
Careful Adoption of Agentic AI Services, May 1, 2026, CISA
ATT&CK v20 updates, October 13, 2026, MITRE
Safety in building agents, OpenAI developer docs
The Agents Rule of Two, October 31, 2025, Meta AI
Environment variables in Expo, Expo docs
Row Level Security, Supabase docs