OWASP Agentic AI Top 10 exposes gaps in agent governance

At a glance

What this is: OWASP's first Top 10 for Agentic Applications 2026 turns agentic AI risk into a failure taxonomy built around autonomy, tool use, trust, and persistent state.

Why it matters: It matters because AI agents can exercise delegated authority across systems, which means IAM, PAM, and governance teams must treat agent permissions, trust chains, and lifecycle control as live security boundaries.

Context

Agentic AI changes the security problem because the system can plan, delegate, and execute actions, not just generate outputs. That means the relevant control surface includes identity, authority, tools, memory, and the trust relationships between agents and downstream systems. For IAM and PAM teams, the question is no longer only what a model can say, but what an agent can do with the privileges it inherits.

The OWASP Agentic AI Top 10 matters because it translates a fast-moving category into repeatable failure patterns that security teams can govern. The article's emphasis on incidents already seen in the wild shows this is not a hypothetical design exercise. For practitioners, the typical starting position is still too narrow: many programmes secure prompts or model access but leave delegated execution, persistent context, and inter-agent trust insufficiently controlled.

Key questions

Q: How should teams govern agentic AI when the model can act across multiple tools and services?

A: Teams should govern the full execution path, not just the model endpoint. The practical control is a replayable event history that records tool calls, context updates, and decisions in order, so security and compliance can reconstruct what happened. Without that trace, incident response and audit become guesswork.

Q: Why do overprivileged tools make agentic AI harder to secure?

A: Because a tool with more access than the task requires turns a prompt into an execution path. If an attacker can influence the agent's input, the agent may use that excess authority to read, send, or modify data outside the intended workflow. The risk is not only misuse, but misuse amplified by delegated trust.

Q: What are the signs that agent memory or context controls are failing?

A: Look for inconsistent behaviour across tasks, decisions shaped by stale or unexpected context, and outputs that reflect prior malicious prompts long after the original source is gone. Those are indicators that retained state is influencing execution. When this happens, the control failure sits in lifecycle management of memory, not in the model's reasoning alone.

Q: What should organisations do when an AI agent depends on external tools and plugins?

A: Apply supplier and dependency governance before deployment and keep monitoring after it goes live. The question is not whether the component is convenient, but whether it can change agent behaviour, expand authority, or introduce hidden trust relationships. If the dependency can alter execution, it belongs in the security review scope.

Technical breakdown

Why autonomous agents create a broader security boundary

An agentic system is more than a model wrapped in a workflow. It can decide when to call tools, route tasks to other agents, retain context, and continue execution without a human approving every step. That creates a broader security boundary because authority is distributed across prompts, tool permissions, memory stores, and orchestration layers. If any one of those layers is over-trusted, the agent can convert a local weakness into system-wide action. Traditional application controls often assume discrete user sessions and predictable execution paths, which is why agentic systems slip past them when autonomy and delegation are not explicitly governed.

Practical implication: Treat agent permissions, memory, and orchestration as separate control points, not as one combined application risk.

How indirect prompt injection and tool misuse become execution paths

Indirect prompt injection works when hostile content is embedded in data or context that an agent later consumes, causing it to follow attacker instructions instead of intended policy. Tool misuse happens when an agent has access to actions that are broader than the task really needs, so a malicious instruction can trigger data access, sending, or modification outside the user's expectation. In agentic systems, these are not just content risks. They are authority risks, because the agent can convert untrusted input into privileged action through tool calls. Once tools are overprivileged, trust is already being used as an execution channel.

Practical implication: Bound each tool to task-scoped permissions and validate the inputs that can influence tool selection.

Why memory, context, and supply chain integrity now matter to identity governance

Agent memory and context are durable state, which means poisoning them can shape later decisions long after the initial malicious input disappears. Supply chain risk is similar: if the agent depends on external tools, skills, plugins, or orchestration components, compromise can arrive through trusted dependencies rather than direct exploitation. This is why agentic governance crosses into identity security. The control question becomes who or what is allowed to act, remember, and delegate over time. OWASP's framework is useful because it links these failures to recurring governance patterns instead of treating each incident as a one-off anomaly.

Practical implication: Inventory the identities, dependencies, and retained state that can influence agent behaviour across sessions.

NHI Mgmt Group analysis

Agentic governance is now an identity problem, not just an AI safety problem. The article shows that the core failures sit in delegated authority, trust chains, and persistent state. Those are the same kinds of governance boundaries IAM and PAM exist to control in human and machine identity programmes. The practical conclusion is that agentic AI must be governed as an identity-bearing system, not as a conversational interface.

Overprivileged tools are the agentic equivalent of standing privilege. Once an agent can invoke actions that exceed the task, the security model depends on trust behaving perfectly under adversarial pressure. That assumption fails quickly when prompts, context, or dependencies are manipulated. Practitioners should treat tool scope and approval boundaries as first-class security controls, because excess authority is what turns a prompt issue into a compromise.

Persistent memory creates governance debt that traditional access review cannot see. Access certification assumes privileges are visible, stable, and reviewable after the fact. Agent state breaks that assumption because harmful influence can survive in context stores, memory layers, and orchestration traces even when no one has persistent human-style access to review. The named concept here is persistent agent trust drift, and it should be treated as a lifecycle control failure, not a model quality issue.

The most dangerous blind spot is the trust agents inherit from adjacent systems. A delegated agent can appear low risk until it inherits credentials, context, or downstream permissions from a workflow, API, or another agent. At that point, compromise of the agent becomes compromise of the surrounding control plane. Security teams need to govern the trust boundary between the agent and the systems it can influence, not just the prompt that starts the task.

This framework validates a shift toward runtime governance of autonomy. The article does not argue for more theory. It shows that repeatable failure modes already exist, which means controls must move from policy statements to runtime containment, scoped delegation, and continuous review of what agents can actually do. For identity leaders, the message is simple: agent governance now belongs in the same operational conversation as IAM, PAM, and secrets control.

From our research library:

• Gartner predicts that by the end of 2026, 40% of enterprise apps will feature task-specific AI agents.
• Read next: Agentic AI Identity Maturity Model

What this signals

Persistent agent trust drift: agentic systems accumulate hidden risk when authority, context, and memory stay active beyond the task that created them. That makes runtime governance more important than periodic review, because the control failure is often in what the agent remembers and inherits rather than what it was originally asked to do.

Security teams should expect agent governance to converge with IAM and PAM rather than sit beside them. Once agents can request tools, retain context, and delegate actions, the control objective becomes continuous containment of authority across the full lifecycle, not just model approval. 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.

For practitioners

• Inventory every agentic workflow and its delegated authority Map where agents exist, which tools they can invoke, what identities they inherit, and which downstream systems they can touch.
• Restrict tool permissions to task-scoped minimum access Reduce each tool to the narrowest usable action set and separate read, write, and execution capabilities wherever possible.
• Validate prompts, context sources, and retrieval inputs Treat retrieved content, user uploads, and external context as potentially hostile because they can steer agent behaviour indirectly.
• Control persistent memory and context retention Define what agent state may persist, who can modify it, and when it must be cleared so poisoned context cannot carry forward.
• Review agent dependencies as part of supply chain governance Include plugins, orchestration layers, and external services in the same approval and monitoring process used for other trusted software dependencies.

Key takeaways

• Agentic AI changes the control problem by combining autonomy, tools, memory, and delegated trust into one runtime risk surface.
• The OWASP Top 10 for Agentic Applications turns real incidents into a repeatable taxonomy that IAM and PAM teams can actually govern.
• The practical response is to scope agent authority, constrain tool use, and manage persistent state as lifecycle controls, not as model tuning issues.

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Delegated Authority Model: A delegated authority model defines who is allowed to approve, review, or execute control-related decisions across the enterprise. It helps ensure requests reach the correct responsible party, especially when control owners, managers, and process owners sit in different teams, regions, or systems.
• Memory Poisoning (ASI06): An attack where malicious content is injected into an AI agent's memory or context, causing it to alter its behaviour in subsequent tasks, potentially exfiltrating secrets, escalating privileges, or acting against its intended purpose.
• Tool Misuse: Tool misuse occurs when an agent uses an allowed integration in a way that exceeds its intended task, scope, or risk tolerance. The problem is often not access alone but the combination of valid credentials, broad permissions, and unbounded action sequencing.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, and machine identity security. It helps security and identity practitioners translate emerging agent risk into controls their programmes can actually operate.