OWASP agentic AI top 10 shows why identity controls are failing

At a glance

What this is: OWASP's first Top 10 for Agentic Applications frames agentic AI as a governance problem spanning goals, tools, memory, communication, and delegated privilege.

Why it matters: It matters because IAM, PAM, and AI governance teams now have to control software that can inherit identity, use tools, and act with minimal human oversight.

By the numbers:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%).
• 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so.

👉 Read Straikerai's analysis of the OWASP Top 10 for Agentic AI risks

Context

Agentic AI changes the security problem because the system is no longer limited to generating text. Once an agent can choose actions, call tools, and continue a workflow with delegated access, conventional prompt-layer controls stop being enough. That creates a direct identity governance problem for AI agent identity, privilege scope, and auditability.

The article uses the OWASP Top 10 for Agentic Applications to explain that risk in practical terms: goal hijack, tool misuse, identity and privilege abuse, supply chain compromise, memory poisoning, and cascading failures all describe different ways trust gets abused inside an agentic workflow. For identity and security teams, the core issue is not whether the model is accurate, but whether the agent can be trusted with access at all.

Key questions

Q: What breaks when AI agents inherit access from users and service accounts?

A: The main failure is that inherited access can be broader than the agent’s actual task, so privilege becomes easier to reuse than to govern. Once an agent can chain tool calls across systems, the original approval no longer describes the full blast radius. Security teams need to treat inherited access as a live identity surface, not a one-time provisioning artifact.

Q: When should organisations prioritise agent identity controls over model tuning?

A: Always when the agent can take actions, access data, or call tools that create real business impact. Model tuning reduces some error types, but it does not solve false authority, overbroad permissions, or unlogged execution. If the agent can change state, identity and privilege controls come first.

Q: What do security teams get wrong about multi-agent systems?

A: They treat the system as a set of independent components instead of a trust network. In reality, shared memory, message forwarding, and delegated outputs let one compromised step influence many others. Security needs message validation, least privilege, and containment across the whole chain, not just one model boundary.

Q: What frameworks should organisations use to assess agentic AI risk?

A: Use OWASP Agentic AI Top 10 for threat modelling, OWASP NHI guidance for credential and privilege governance, and Zero Trust principles for continuous verification of tools and identities. Together, they help teams evaluate agent behaviour, access boundaries, and trust at runtime instead of only at onboarding.

Technical breakdown

Agent goal hijack and instruction injection

Agent goal hijack happens when untrusted content overrides the agent's intended task. In practice, this is a form of instruction injection, where hidden prompts or external inputs alter the plan the agent follows. The risk is higher in retrieval-augmented or browsing workflows because the agent ingests outside content and may treat it as operational guidance. Once the goal changes, downstream tool use, data access, and human approval steps all inherit the wrong intent.

Practical implication: separate untrusted content from control instructions and constrain which inputs can alter agent objectives.

Identity and privilege abuse in agentic workflows

Identity and privilege abuse occurs when an agent accepts spoofed authority or inherits human privileges without sufficient proof of legitimacy. Unlike a simple automation script, an agent may reason about requests, decide whether they appear trusted, and then use APIs, files, or databases under that delegated identity. That creates a new trust boundary around who the agent believes it is serving and what permissions it can exercise. In IAM terms, this is about collapsing standing privilege into task-scoped, verifiable access.

Practical implication: bind agent actions to scoped identities and require explicit policy checks before privilege use.

Cascading failure across multi-agent systems

Cascading failure occurs when one compromised or mistaken agent corrupts the behaviour of others. Multi-agent systems often rely on message trust, shared context, and implicit handoffs, so a false belief can propagate quickly through a workflow. That makes agentic architectures sensitive to memory poisoning, inter-agent tampering, and over-trust in previous outputs. Security teams should think in terms of blast radius, because a single compromised step can distort an entire chain of decisions and actions.

Practical implication: limit shared state, verify inter-agent messages, and design containment so one agent's failure cannot cascade.

Threat narrative

Attacker objective: The attacker wants to turn an agent's legitimate access, reasoning, and tool use into silent data theft, unauthorised action, or workflow corruption.

1. Entry begins when attackers place malicious instructions, poisoned dependencies, or spoofed messages into the agent's operating context.
2. Escalation occurs when the agent accepts false authority, misapplies tools, or inherits permissions that exceed the task boundary.
3. Impact follows when the agent exfiltrates data, executes harmful actions, or propagates false decisions across connected workflows.

NHI Mgmt Group analysis

Agentic AI identity is now a governance boundary, not a model feature. Once a system can select tools and timing, it behaves like a software identity with operational authority. That means IAM and PAM teams have to treat the agent as an access-bearing entity with lifecycle, policy, and audit requirements. The discipline is no longer just model safety, it is identity governance for action-capable software.

Identity and privilege abuse is the most actionable failure mode in this category. OWASP's list is broad, but the control question that matters most is whether an agent can be induced to act under false authority. That maps directly to delegated access, impersonation risk, and weak trust verification in AI workflows. Practitioners should view every agentic approval path as a privilege boundary that can be spoofed if identity proof is weak.

Agent goal hijack creates a new named concept: the instruction-to-action gap. In traditional security, a bad instruction does not automatically become a bad action. In agentic systems, the gap narrows because the same system that interprets intent also executes it. That makes untrusted retrieval, prompt injection, and context poisoning more dangerous than in LLM-only use cases. The practitioner takeaway is to separate reasoning from authority wherever possible.

Cascading failure is what turns isolated agent mistakes into enterprise risk. Multi-agent environments amplify errors because trust chains are recursive, not linear. A single compromised context can affect planning, execution, human review, and downstream systems at once. That is why containment, not just detection, has to be part of the operating model. Teams need to assume one bad agent can destabilise the whole workflow unless boundaries are explicit.

Agentic AI governance will increasingly converge with NHI controls and AI risk frameworks. The same questions now apply across AI RMF, OWASP NHI, and agentic security guidance: who owns the identity, what permissions exist, how are actions logged, and how is misuse revoked? That convergence will shape the category over the next year. Security leaders should align AI governance, identity governance, and runtime monitoring now rather than after the first visible incident.

What this signals

Agentic AI governance is converging with NHI management because the operational problem is the same: software is being granted identity, authority, and access that must be bounded. Teams that already struggle with service accounts and secrets sprawl should expect similar friction with AI agents, except the decision surface is wider and less predictable.

Instruction-to-action gap: this is the failure mode that matters most for practitioners. When agents can convert external prompts or retrieved content into execution, the question becomes whether policy sits ahead of action or after it. Security leaders should prepare to align agent monitoring with identity lifecycle controls, runtime authorisation, and investigation workflows tied to Ultimate Guide to NHIs , Why NHI Security Matters Now.

The likely programme shift is toward stronger separation between reasoning, authority, and execution. That will push identity teams, AI teams, and GRC teams into the same operating model, especially where access to data, APIs, and business workflows is involved. For governance, the signal is clear: agent controls must become measurable, revocable, and reviewable rather than assumed.

For practitioners

• Define agent identities as governed access subjects Assign each agent a unique, scoped identity with explicit ownership, approval boundaries, and logging so actions can be traced back to a business function rather than a shared service account.
• Restrict tool access to task-specific policy gates Put policy checks in front of every high-risk tool call, especially database queries, file writes, external requests, and workflow triggers. Do not rely on the agent to self-limit access.
• Break shared context to limit cascading failure Separate memory, prompts, and message channels between agents so one poisoned input cannot silently shape the full workflow. Review inter-agent handoffs as trust boundaries, not internal plumbing.
• Instrument agent activity for audit and containment Log inputs, tool calls, delegated decisions, and downstream effects in a way that supports investigation and rollback. Build kill-switches and revocation paths before large-scale deployment.

Key takeaways

• Agentic AI changes security from prompt control to identity and privilege control because the system can now act, not just answer.
• The most common failure pattern is not model error alone but abused trust, where spoofed authority or poisoned context drives unauthorised action.
• Practitioners should govern AI agents like access-bearing software entities, with scoped identities, policy gates, audit trails, and containment paths.

Key terms

• Agent Goal Hijack (ASI01): An attack where an adversary redirects an AI agent's objectives by manipulating its instructions, tool outputs, or external content — causing it to act outside its intended scope while appearing normal. The number one risk in the OWASP Top 10 for Agentic Applications 2026.
• Identity And Privilege Abuse: Identity and privilege abuse happens when delegated authority, cached credentials, or inherited access lets an agent act beyond the intent of the original owner. In agentic systems, the problem is often ambiguity in who owns the action and whether the granted authority still matches the task.
• Cascading Failure: A cascading failure happens when one broken component causes dependent components to fail or degrade in sequence. In microservice systems, the problem is usually not one service going down, but the combined effect of latency, retries, shared dependencies, and exhausted resources spreading the outage.
• Instruction-to-Action Gap: The space between what an AI system interprets as intent and what it is allowed to execute. In agentic environments, this gap shrinks because the same system can reason, decide, and act, which makes policy placement and control boundaries critical.

What's in the full article

Straikerai's full blog covers the operational detail this post intentionally leaves for the source:

• The article breaks down each of the ten OWASP agentic risks in plain English, including goal hijack, tool misuse, identity abuse, and rogue behaviour.
• It provides the kitchen analogy and visual structure the author used to explain how the risks chain together across planning, execution, and human review.
• The source links to real-world examples and related research material that can help teams map the risks into their own AI control reviews.
• It includes Straikerai's positioning on runtime guardrails and red-team testing for agentic applications, which is relevant once you move from strategy to implementation.

👉 Straikerai's full post includes the risk-by-risk breakdown, real-world examples, and the author's agentic security framing.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management for practitioners building control models around non-human access. It helps security teams connect identity governance to the operational realities of modern access-bearing systems.