OWASP Agentic AI Top 10 exposes gaps in agent governance

At a glance

What this is: Anomali’s roundup highlights OWASP’s first Top 10 for Agentic Applications, which maps real-world failure patterns in autonomous AI systems to repeatable security risks.

Why it matters: For IAM, PAM, and AI governance teams, the key issue is that agentic systems introduce delegated authority and cross-system trust that standard access models do not reliably constrain.

By the numbers:

• 98% of companies plan to deploy even more AI agents within the next 12 months, despite documented rogue behaviour in 80% of current deployments.
• 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so.
• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
• Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.

👉 Read Anomali's roundup on OWASP Agentic AI, MongoBleed, WebRAT malware, and more

Context

Agentic AI changes the control problem because the system can plan, delegate, and execute actions across tools and services rather than simply generate outputs. That creates a governance gap for primary keyword control models built around static roles, predefined sessions, and human approval points. In practice, the risk is not only what the model says, but what the agent is allowed to do once it has delegated authority.

This article uses OWASP’s 2026 agentic application framework as the trigger for a broader security question: how do organisations govern AI systems that can inherit credentials, call tools, and persist state across tasks? For teams responsible for IAM, PAM, and NHI programmes, that intersection matters because an agent often behaves like a non-human identity with dynamic privileges and opaque operational boundaries.

Key questions

Q: How should security teams govern AI agents that can access enterprise systems?

A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring. The control set should include inventory, task-bound credentials, audit trails, and revocation paths. If an agent can call tools or touch production systems, it belongs in the same governance model as service accounts and other machine identities.

Q: Why do AI agents complicate traditional IAM and PAM controls?

A: AI agents complicate IAM and PAM because they can make decisions, chain tools, and act faster than human review cycles can respond. They also blur the line between authentication and authorization, since the same identity may trigger multiple actions after a single approval. That means organizations need policy, telemetry, and revocation designed for autonomous behavior, not just human login events.

Q: What do security teams get wrong about memory in agent systems?

A: Security teams often treat memory as if a vector store were enough. In practice, memory includes working state, durable state, and policy-relevant context, each with different access, retention, and audit needs. If those are collapsed into one mechanism, the system becomes hard to govern, hard to troubleshoot, and hard to prove after the fact.

Q: What should enterprises do before scaling agentic AI in production?

A: Enterprises should unify IAM, PAM, and NHI governance around actor type and delegation path. That includes inventorying unmanaged identities, enforcing runtime guardrails, and proving who owns each agent's authority. Without those controls, agentic AI expands existing identity blind spots instead of reducing them.

Technical breakdown

How agentic AI expands the attack surface

Agentic systems differ from standard LLM use because they can take actions, not just produce text. They may invoke tools, hand off tasks to other agents, and reuse context over time, which makes trust cumulative. If a prompt injection alters the agent’s goal or a tool is overprivileged, the resulting failure can cascade across connected systems. The security issue is therefore not only prompt quality but the combination of autonomy, delegation, and persistent state. That is why conventional controls that assume a human in the loop can be too slow or too coarse for agentic workflows.

Practical implication: inventory every agent, the tools it can call, and the credentials it can reach before production use.

Why overprivileged tools and delegated authority are dangerous

Overprivileged tools turn a successful agent compromise into a high-impact access event. When an agent can read mailboxes, modify tickets, query databases, or trigger deployments, the tool layer becomes the real control plane. Delegated authority also makes misuse harder to detect because actions may look authorised at the protocol level even when they are not aligned to the task. This is closely related to NHI governance, because the agent often operates with service credentials, API tokens, or other secrets that outlive a single request. Least privilege must therefore be evaluated at the tool and secret level, not just the user level.

Practical implication: scope each tool and secret to the smallest task boundary, then remove anything the agent does not strictly need.

How memory poisoning and supply chain trust failures propagate

Agent memory, context, and linked dependencies can all become persistence layers for malicious influence. If a poisoned instruction, compromised plugin, or untrusted upstream dependency enters the workflow, the agent may repeatedly reuse it across sessions or workflows. That makes the risk broader than a single bad prompt. The attacker is trying to shape future decisions, not just win one interaction. In multi-agent environments, that influence can spread through inter-agent trust relationships and shared state. The governance challenge is to treat context, memory, and dependencies as security assets that need provenance, validation, and lifecycle control.

Practical implication: apply provenance checks, dependency reviews, and reset policies to agent memory and shared context, not just to code.

Threat narrative

Attacker objective: The attacker seeks to hijack agent behaviour so that authorised automation performs unauthorised access, data exposure, or downstream operational abuse.

1. Entry begins with indirect prompt injection, poisoned dependencies, or misuse of overtrusted agent inputs that alter task intent.
2. Escalation occurs when the agent uses delegated authority to invoke overprivileged tools, access sensitive systems, or chain actions across services.
3. Impact follows when the agent completes unauthorised operations, leaks credentials or data, or triggers cascading failures across multi-agent workflows.

Breaches seen in the wild

• Moltbook AI agent keys breach — Moltbook breach exposed 1.5M AI agent keys.
• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic AI governance debt is becoming a material security problem. The Top 10 does more than catalogue attack patterns. It shows that enterprises are accumulating control debt whenever they let AI systems inherit authority from users, tools, and workflows without redefining the trust boundary. The result is a programme that looks governed on paper but remains fragile in operation. Practitioners should treat agentic rollout as an identity and access design problem, not a model deployment task.

Tool misuse is the clearest sign that AI agents now behave like non-human identities. Once an agent can call APIs, move data, or trigger business actions, it starts to look like a privileged machine actor with task-specific authority. That makes NHI governance relevant even when the system is marketed as AI rather than identity infrastructure. The practical conclusion is that access reviews must extend to agent credentials, downstream privileges, and tool allowlists.

Persistent context creates a new kind of trust boundary failure. Memory, shared state, and agent-to-agent delegation mean a compromise can survive beyond a single prompt or session. That shifts the problem from isolated abuse to repeated influence across workflows. Security teams should therefore monitor the provenance of instructions and dependencies with the same seriousness they apply to secrets and code artifacts.

OWASP’s framework is most valuable when it is used to force ownership decisions. A taxonomy only helps if it assigns accountability for tool scope, secret exposure, approval logic, and recovery paths. Otherwise agent governance becomes a collection of generic AI policies that no one can operationalise. The programme-level implication is clear: every agent needs a named owner, a bounded privilege set, and a revocation path.

Agentic AI security and NHI governance are converging faster than most programmes admit. The more agents execute tasks across systems, the more they depend on credentials, certificates, tokens, and service-level access patterns that identity teams already understand. The new challenge is that these identities can reason, select tools, and persist state. Organisations should plan for shared governance between AI security, IAM, and PAM rather than isolated ownership.

From our research:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
• Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
• Forward look: Read OWASP NHI Top 10 for the control patterns defenders are using to constrain agentic risk.

What this signals

Agentic systems will force identity programmes to expand their perimeter. The issue is no longer limited to human access reviews or classic service accounts. If an agent can call tools, inherit secrets, and persist state, identity teams need a control model that covers runtime action, not only login events. The practical next step is to align AI governance with IAM and PAM workflows before deployment scale makes retrofitting impossible.

Access visibility will become a compliance requirement, not just an operational preference. When 48% of organisations cannot track and audit the data their AI agents access, investigations and attestations lose credibility. That gap creates pressure for stronger logging, provenance, and policy enforcement around agent activity. Teams should expect auditors and risk owners to ask for proof that agents are bounded, reviewable, and revocable.

AI governance debt: the cost of delaying owner assignment, scope control, and revocation paths will rise quickly. Every agent that ships without a named owner or explicit privilege boundary increases the amount of manual cleanup later. This is where the link between agentic AI and NHI governance becomes operational, because the same disciplines used for secrets, service accounts, and privileged access now need to extend to autonomous workflows.

For practitioners

• Inventory every agent and its delegated authority Document each agent, the tools it can invoke, the systems it can reach, and the secrets or tokens it can access. Treat that inventory as a living control set, not a one-time architecture diagram.
• Reduce tool scope to task-level privilege Remove broad connector permissions and replace them with narrowly scoped, task-specific access. Where possible, separate read, write, and execute functions so one agent action cannot become full environment control.
• Apply provenance controls to prompts, memory, and dependencies Track where instructions, retrieval sources, plugins, and shared context originate. Reset or quarantine agent memory when provenance cannot be trusted, especially after workflow changes or third-party dependency updates.
• Tie AI agent governance to IAM and PAM workflows Bring agent credentials into the same lifecycle processes used for human and machine identities, including approval, review, rotation, and revocation. Ensure privileged actions can be traced back to a named owner and policy boundary.

Key takeaways

• Agentic AI creates a governance problem because autonomous systems can inherit and exercise authority across tools, data, and workflows.
• OWASP’s Top 10 matters because it translates real attack patterns into repeatable control failures that security teams can actually map and test.
• IAM, PAM, and AI governance teams should converge on agent inventory, least privilege, provenance, and revocation before production scale hardens bad assumptions.

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions — including calling APIs, writing code, and orchestrating other agents — with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Delegated Agent Authority: The permission granted to an AI agent to act on behalf of a human user or another agent, inheriting some or all of their access rights. Delegated authority must be explicitly scoped, time-limited, and auditable.
• Agent Memory: Agent memory is the stored context an AI agent uses across sessions or tasks. In governance terms, it is controlled state, because the memories an agent retains can influence future actions, permissions use, and the safety of subsequent decisions.

What's in the full analysis

Anomali's full post covers the operational detail this post intentionally leaves for the source:

• The article links each OWASP agentic AI risk to the underlying incident pattern and failure mode.
• It shows how the Top 10 maps to practical defender decisions across autonomy, tools, and trust.
• It summarises the surrounding threat context for readers tracking AI security and NHI overlap.
• It provides the original source references that ground the framework in real-world cases.

👉 The full Anomali post covers the OWASP framework context and the related security news items in one place.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and agentic AI identity. It helps security practitioners align access control, lifecycle management, and privilege oversight across modern identity programmes.