AI agents turn a model's mistakes and an attacker's instructions into real actions on production systems, at machine speed, using your organisation's credentials. The OWASP Top 10 for Agentic Applications describes the technical failure modes for builders and testers. This list is the business view for CISOs and their executive peers: the ten agent risks most likely to cause loss, liability or a regulator's letter, what each costs the business, and the question to ask your teams. For the technical detail behind each item, see the OWASP Top 10 for Agentic Applications Guide.
The Top 10 at a glance
The order is our editorial judgement, weighting how hard the damage is to reverse and how directly the risk has shown up in published agent incidents. The owner column shows who usually holds the fix, which is rarely the security team alone.
| # | Risk | Business impact | Usual fix owner |
|---|---|---|---|
| 1 | Irreversible actions in production | Data loss, outage, recovery cost | Platform and engineering |
| 2 | Agents running on over-scoped or human credentials | Unbounded blast radius, no attribution | IAM |
| 3 | Untrusted content steering the agent | Data theft, fraud, phishing from trusted accounts | Security architecture |
| 4 | Agents nobody owns or knows about | Unreviewed access, no incident contact | IAM and business owners |
| 5 | Compromised tools, plugins and agent supply chain | Credential theft at scale | Procurement and AppSec |
| 6 | Personal data and regulatory exposure | Breach notification, fines, contract breach | DPO and legal |
| 7 | No audit trail of who did what | Failed investigations, audit findings, disputes | Security operations |
| 8 | Attackers using agents against you | Faster exploitation of exposed secrets and flaws | Security operations and vulnerability management |
| 9 | Runaway cost and resource abuse | Unbudgeted spend, service degradation | Finance and platform |
| 10 | No way to stop an agent quickly | Incidents that run for hours, cascading failures | CISO and incident response |
1. Irreversible actions in production
The risk: an agent deletes, overwrites or sends something that cannot be undone, because it was allowed to and nothing stopped it.
Business impact: in the PocketOS incident, a coding agent removed a production database and its volume-level backups in a single API call that took about nine seconds. No attacker was involved.
Ask your team: which agents can delete, pay, send externally or change access, and is approval for those actions enforced by the platform rather than requested in a prompt? See the Human-in-the-Loop for AI Agents Guide.
2. Agents running on over-scoped or human credentials
The risk: agents borrow a developer's token, a shared service account or an admin API key because it was quickest during the pilot.
Business impact: whatever the agent gets wrong, it gets wrong with every permission that credential holds, and logs show a person, not the agent. OWASP ranks this as ASI03 Identity and Privilege Abuse.
Ask your team: what share of production agents have their own identity with short-lived, task-scoped credentials? See the Top 10 Agentic AI Identity Issues and the AI Agent Authorisation Guide.
3. Untrusted content steering the agent
The risk: an agent reads an email, web page, support ticket or form submission containing hidden instructions, and follows them (prompt injection, OWASP LLM01 and ASI01 Agent Goal Hijack).
Business impact: customer data exfiltrated through a trusted channel, or fraudulent messages sent from your own accounts. Staff also tend to trust agent output, which OWASP lists separately as ASI09 Human-Agent Trust Exploitation.
Ask your team: which agents both read outside content and hold write or send permissions, and what separates the two? See the Agentic AI Security Guide.
4. Agents nobody owns or knows about
The risk: agents built on low-code platforms, in coding tools or inside SaaS products, with no registry entry and no accountable owner.
Business impact: access is never reviewed, alerts have no one to go to, and agents outlive the projects and people that created them.
Ask your team: how many agents do we have, and can we name an owner for each? See the Shadow AI Discovery Guide and the Top 10 Shadow AI Risks.
5. Compromised tools, plugins and agent supply chain
The risk: agents load third-party tools, MCP servers, skills and models that can be malicious or later compromised (ASI04 Agentic Supply Chain Vulnerabilities).
Business impact: one poisoned component can read every credential and message an agent handles, across every team that installed it.
Ask your team: is there an allowlist of approved tools and servers, and who assesses new ones? See the AI Agent Tool and Plugin Security Guide and the Third-Party AI Risk Guide.
6. Personal data and regulatory exposure
The risk: agents reach, change or export personal data in ways no DPIA anticipated, and regulators are now looking at agent incidents specifically.
Business impact: in Spain's first notified AI agent data breach, the AEPD described an agent that logged in, probed the application, modified personal data and accessed invoices, and it asked organisations to include AI-driven attacks in their risk analysis.
Ask your team: has every agent touching personal data been through a DPIA and an agent risk assessment? See the Agentic AI Compliance Guide and the EU AI Act Compliance Guide.
7. No audit trail of who did what
The risk: logs record a shared account or the user, not the agent, and tool calls, parameters and approvals are not captured.
Business impact: you cannot prove what happened to an auditor, a customer or a court, and incident scoping becomes guesswork.
Ask your team: for any agent action yesterday, can we show the agent, the user it acted for, the tool call and who approved it? See the AI Agent Observability and Incident Response Guide.
8. Attackers using agents against you
The risk: attackers now run agents that find exposed services, harvest secrets and act on them faster than human operators.
Business impact: the JADEPUFFER agentic ransomware case, reported by Sysdig in July 2026, chained an unpatched AI workflow platform, harvested AI provider and cloud keys, and default service credentials into a destroyed production database. Old hygiene gaps become exploitable in minutes.
Ask your team: how quickly do we rotate exposed secrets and patch internet-facing AI tooling? See the LLMjacking Guide.
9. Runaway cost and resource abuse
The risk: agents loop, spawn sub-agents or are hijacked to consume model and cloud resources (OWASP LLM10 Unbounded Consumption).
Business impact: unbudgeted model bills, exhausted quotas that take down legitimate services, and stolen API keys reused by others.
Ask your team: are there spend caps, rate limits and alerts per agent and per key? See the AI Gateway and LLM Gateway Guide.
10. No way to stop an agent quickly
The risk: when an agent misbehaves, nobody knows every credential it holds or how to halt it, and errors spread to other agents (ASI08 Cascading Failures, ASI10 Rogue Agents).
Business impact: containment takes hours instead of minutes. OWASP's ASI10 guidance calls for kill switches and credential revocation to disable rogue agents.
Ask your team: when did we last test stopping our highest-risk agent, and how long did revoking all its credentials take? See the AI Agent Kill Switch and Containment Guide.
Mapping to OWASP
This list deliberately groups the technical risks by business consequence. The mapping below shows where each item sits in the OWASP agentic and LLM lists and in the twelve risks of NIST AI 600-1, the Generative AI Profile.
| Risk | OWASP Agentic Top 10 (2026) | OWASP LLM Top 10 (2025) | NIST AI 600-1 risk |
|---|---|---|---|
| 1. Irreversible actions | ASI02 | LLM06 | Human-AI Configuration |
| 2. Over-scoped credentials | ASI03 | LLM06 | Information Security |
| 3. Untrusted content | ASI01, ASI06, ASI09 | LLM01 | Information Security, Information Integrity |
| 4. Unowned agents | ASI10 | Not covered | Human-AI Configuration |
| 5. Supply chain | ASI04, ASI05 | LLM03 | Value Chain and Component Integration |
| 6. Personal data | ASI02, ASI03 | LLM02 | Data Privacy |
| 7. No audit trail | ASI03, ASI07 | Not covered | Information Security |
| 8. Attacker agents | Not covered (external threat) | Not covered | Information Security |
| 9. Runaway cost | ASI08 | LLM10 | Not directly covered |
| 10. No kill switch | ASI08, ASI10 | Not covered | Human-AI Configuration |
For a governance anchor, NIST AI RMF 1.0 subcategories MAP 3.5 (human oversight processes), MANAGE 2.4 (mechanisms to supersede, disengage or deactivate AI systems) and MANAGE 4.1 (post-deployment monitoring) cover items 1, 7 and 10. See the NIST AI RMF Guide.
Where to start
In the first 90 days, three moves cut most of the exposure. First, build an inventory of agents with named owners and the credentials each one holds (risks 2, 4 and 10). Second, require platform-enforced approval for delete, payment, external send and access-change actions, and remove admin and human credentials from agents (risks 1 and 2). Third, make an approved risk assessment a precondition for issuing production credentials, using the AI Agent Risk Assessment Template. Report three numbers to the board each quarter: agents with a current assessment, agents on human or non-expiring credentials, and the time taken in the last kill switch test. For framing those conversations, use the Board and CISO Briefing.
Related NHI Mgmt Group resources: OWASP Top 10 for Agentic Applications Guide · Top 10 Agentic AI Identity Issues · Agentic AI Security Policy Template · Board Briefing: AI Security