OWASP agentic top 10 shows how NHIs shape agent risk

TL;DR: OWASP’s Agentic Top 10 for 2026 maps the main failure modes in AI agents to identity, tool, memory, and supply-chain risk, showing that most incidents start with overprivileged or exposed non-human identities, not with the model alone, according to OWASP. The governance problem is now operational, because agent security collapses when secret sprawl and implicit trust outpace least-privilege control.

At a glance

What this is: OWASP’s Agentic Top 10 2026 frames AI agent risk as a systemic identity, tool, and trust problem rather than a prompt-only problem.

Why it matters: For IAM and NHI teams, the list reinforces that agent governance depends on inventory, least privilege, and auditable identities across tools and environments.

By the numbers:

• 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so.
• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.

👉 Read OWASP’s full analysis of the 2026 Agentic Applications Top 10

Context

AI agent security becomes an identity problem as soon as the system can act, call tools, and reuse credentials on behalf of users or workloads. In that setting, the real governance gap is not only prompt safety, but whether non-human identities are scoped, inventoried, and auditable across the environments they touch. OWASP’s Agentic Top 10 matters because it makes that gap visible to IAM and NHI practitioners.

The article’s central claim is that most agent failures amplify existing weaknesses: overprivileged secrets, inherited sessions, weak inter-agent trust, and unsafe integrations. That is a familiar pattern in NHI governance, where the security outcome depends less on the model itself and more on the access fabric surrounding it. For teams already tracking service accounts and API keys, this is a typical escalation of the same control problem into agentic systems.

Key questions

Q: How should security teams govern AI agents without creating excessive friction?

A: Start by treating each agent as a non-human identity with a defined owner, purpose, and access boundary. Use task-scoped permissions, time limits, and revocation procedures so the agent can act only within a narrow role. Then add logging, periodic review, and approval paths for high-risk actions so governance reduces risk without blocking routine automation.

Q: Why do AI agents increase NHI governance risk compared with traditional automation?

A: AI agents can interpret context, choose tools, and chain actions dynamically, which means their behaviour is less predictable than scripted automation. If they reuse human sessions or overprivileged secrets, the system can create silent privilege expansion and weak attribution. The risk comes from autonomous action plus inherited trust, not from automation alone.

Q: What is the difference between agent security and NHI security?

A: Agent security focuses on what the AI system says or does at runtime, while NHI security governs the identities, secrets, and permissions that let it act in the first place. In practice, the two are inseparable. If the identity layer is weak, the agent layer becomes a multiplier for existing access problems.

Q: When should organisations rotate secrets used by AI agents?

A: Rotate secrets immediately when they are shared across multiple systems, exposed in logs or code, or used by agents with broad access. In agentic environments, rotation is not just a hygiene task. It is a containment control that limits how far compromised credentials can spread through tools, workflows, and dependent services.

Technical breakdown

How agent goal hijack emerges from tool-enabled identity chains

Agent goal hijack happens when an AI system follows manipulated inputs, documents, or instructions and silently shifts from the user’s objective to an attacker’s objective. The technical issue is not only content injection. It is the combination of tool access, persistent context, and identity-bearing permissions that allows the agent to act on poisoned intent. Once the agent can send email, query CRM records, or invoke internal APIs, a compromised instruction can become an executed workflow. That makes trust boundaries across inputs, memory, and tools the real security perimeter, especially when the agent’s actions inherit human or workload authority.

Practical implication: Treat instruction sources, tool permissions, and identity scope as one control surface, not three separate ones.

Identity and privilege abuse in agentic systems

Identity and privilege abuse occurs when an agent borrows a human session, reuses shared secrets, or inherits permissions without a distinct, task-scoped identity. In practice, that creates attribution gaps and broadens blast radius because the system cannot easily distinguish one agent’s action from another’s or from the user’s. The issue is amplified in multi-agent workflows, where cross-agent trust is often implicit and rarely validated with strong authentication or policy checks. From an NHI perspective, this is the same control failure as any overprivileged service account, but now the entity making the decision can also take actions in real time.

Practical implication: Give every agent its own identity, time-bound permissions, and logs that support clear audit and revocation.

Why memory poisoning and cascading failures are NHI problems

Memory poisoning happens when persistent memory, embeddings, or retrieval stores are seeded with malicious or misleading content that changes future decisions. Cascading failure follows when that poisoned state is reused across multiple agents, workflows, or environments. The technical risk is persistence plus reuse: one compromised context can influence many downstream actions, especially if the same non-human identity is trusted across systems. That is why agent governance cannot focus only on runtime prompts. It also has to cover the data and identity assets that shape future reasoning, including secrets, tokens, and trusted knowledge stores.

Practical implication: Control what enters memory, limit what identities can retrieve, and assume poisoned state can propagate across workflows.

Threat narrative

Attacker objective: The attacker wants the agent to carry out trusted actions that expand access, expose sensitive data, or execute harmful workflows while appearing legitimate.

1. Entry via manipulated inputs, poisoned documents, or compromised tool content that changes the agent’s objective.
2. Escalation through inherited secrets, shared sessions, or weak inter-agent trust that lets the agent invoke higher-value tools.
3. Impact through unauthorized actions such as data access, destructive commands, or credential exposure at scale.

Breaches seen in the wild

• Moltbook AI agent keys breach — Moltbook breach exposed 1.5M AI agent keys.
• MongoBleed breach — MongoBleed exposed secrets across 87K MongoDB servers.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic security is now an NHI governance problem, not a model-safety sidebar. The article is useful because it shows how agent risk becomes concrete only when identities, permissions, and secrets are part of the workflow. That shifts the control agenda toward inventory, privilege scoping, and auditability across every agent touchpoint. Practitioners should treat agentic systems as another NHI estate, not a separate AI exception.

Identity and privilege abuse is the most operationally dangerous category in agentic systems. Once an agent can reuse human credentials or inherit broad permissions, every downstream action inherits the same trust problem. That creates attribution gaps, wider blast radius, and harder revocation during incidents. The practical conclusion is to remove shared trust and make every agent action revocable at the identity layer.

Memory, context, and tool chains create a durable trust debt. The article correctly emphasizes that agentic risk is systemic, because poisoned context can influence later decisions long after the original input is gone. That means security teams need controls over persistence, retrieval, and dependency reuse, not just prompt filtering. The practitioner conclusion is to govern the whole reasoning path, not only the user-facing prompt.

Ephemeral credential trust debt: agentic systems often rely on temporary-looking access that still inherits deep, persistent trust relationships. That is where many teams underestimate exposure. A short-lived token can still unlock broad permissions if the underlying NHI was never designed for task-scoped use. The conclusion for practitioners is to align token lifespan with actual task scope, not with convenience.

OWASP’s framing reinforces that the next control boundary is the identity fabric around agents. The list is useful because it connects agent failure modes to the same NHI patterns practitioners already struggle to govern: secret sprawl, overprivilege, and weak audit trails. That makes the control model understandable and actionable. The conclusion is simple: if you can’t govern the NHI, you can’t reliably govern the agent.

From our research:

• 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so, according to AI Agents: The New Attack Surface report.
• Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
• For a broader control lens, see OWASP NHI Top 10 for how agentic risks map to identity and access failures.

What this signals

With 80% of organisations reporting that AI agents have already acted beyond their intended scope in some form, the programme implication is clear: agent governance cannot wait for a mature reference architecture. Teams need a control plane that combines identity inventory, privilege review, and behaviour monitoring before usage scales further.

Identity blast radius: the practical risk is no longer just that an agent gets compromised, but that one compromised identity can be reused across multiple workflows and environments. That makes revocation speed, credential lineage, and scope narrowing central design decisions. Practitioners should plan for containment first, then automation.

The safest programmes will stop treating agent controls as an AI-only domain and align them with broader NHI lifecycle management. That means integrating access review, secret rotation, and owner attribution into the same operating model that already governs service accounts and API keys.

For practitioners

• Inventory every agent-facing NHI Map API keys, service accounts, OAuth tokens, and PATs used by agents across cloud, SaaS, CI/CD, and internal tools. Tie each identity to an owner, an environment, and a revocation path so you can answer which agent can do what before an incident forces the question.
• Assign distinct identities to agents Stop letting agents ride on human sessions or shared credentials. Give each agent task-scoped permissions, time-bound access, and logs that make it possible to separate one agent’s behaviour from another’s during review or containment.
• Reduce blast radius for exposed secrets Prioritise rotation and permission narrowing for secrets that multiple agents, microservices, or workloads depend on. If one credential unlocks several workflows, a single exposure can turn into a multi-system incident.
• Monitor for agent behaviour drift Baseline normal tool use, data access, and environment patterns, then alert when an agent starts calling new APIs, using tokens from unusual locations, or chaining tools in ways that change its risk profile.
• Validate inter-agent trust explicitly Require authentication, schema checks, and policy enforcement between agents instead of assuming trusted communication. Unchecked agent-to-agent exchange is where spoofing, replay, and cascading failure become easier to exploit.

Key takeaways

• AI agents become a governance issue when they inherit secrets, sessions, and permissions that outlive any single task.
• The evidence points to a control gap, not a theory gap, because agent behaviour is already exceeding intended scope in many environments.
• Security teams should respond by tightening identity scope, revocation, and auditability before agent deployment accelerates further.

Key terms

• Agentic Application: An agentic application is software in which an AI system can choose actions, call tools, and complete tasks with limited human intervention. In security terms, it behaves like an active workload that needs scoped identity, logging, and control boundaries, not just prompt filtering.
• Non-Human Identity: A non-human identity is any machine or software identity used by workloads, services, scripts, bots, or AI agents. It can include API keys, service accounts, tokens, and certificates. These identities must be governed because they often hold real access, real privileges, and real blast radius.
• Identity Blast Radius: Identity blast radius is the amount of damage possible if a single credential, session, or account is misused or exposed. In agentic environments, the blast radius expands when one identity is reused across tools, environments, or multiple agents, making revocation and scoping central controls.

What's in the full article

OWASP’s full article covers the operational detail this post intentionally leaves for the source:

• The full risk-by-risk breakdown of the 10 agentic failure modes and how OWASP groups them.
• Examples of how each risk maps to inputs, integrations, outputs, and multi-agent workflows.
• The source framing that connects the agentic list to existing NHI and LLM risk models.
• The vendor’s own implementation context for teams building AI agent security programmes.

👉 The full OWASP article includes the complete risk list and source framing for agentic systems

Deepen your knowledge

Agent identity scoping and secret governance are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building controls for AI agents and inherited credentials, it is worth exploring.