OWASP agentic top 10 shows how NHIs shape agent risk

At a glance

What this is: OWASP’s Agentic Top 10 2026 frames AI agent risk as a systems problem driven by identity, permissions, tools, memory, and supply-chain exposure, not just prompt behaviour.

Why it matters: IAM, PAM, and NHI teams need to treat agent identities as first-class governance objects because privilege reuse and secret exposure can turn ordinary agent actions into high-impact incidents.

Context

OWASP’s Agentic Top 10 2026 is a risk taxonomy for AI agents and multi-agent systems. The practical issue for identity teams is that these systems do not fail in isolation: they fail through the credentials, tokens, permissions, and trust relationships that power them.

For NHI governance, the important shift is that agent behaviour now sits on top of existing machine identity problems. Overprivileged service accounts, long-lived secrets, and weak ownership are not background hygiene issues anymore. They are the control plane that determines whether an agent can be contained, attributed, and revoked when something goes wrong.

Key questions

Q: What breaks when AI agent access relies on long-lived secrets?

A: Long-lived secrets let AI agents carry persistent access far beyond the task they were created for. That increases theft risk, complicates offboarding, and makes it harder to prove scope at audit time. Secretless, short-lived access is safer because the credential exists only for the current task and runtime context.

Q: Why do overprivileged agent identities create such a large security risk?

A: Because agents can turn ordinary tool access into destructive action at machine speed. If an agent can reach email, internal APIs, file systems, or cloud resources with broad permissions, a small prompt or supply-chain issue can become deletion, exfiltration, or workflow abuse. The risk is amplification through legitimate access, not model magic.

Q: What is the biggest failure mode in agentic AI governance?

A: The biggest failure mode is unmanaged shadow AI that operates with real access but no lifecycle record. When an agent is not registered, the organisation loses ownership, purpose, and auditability at the same time. That creates an identity gap, not just a visibility gap, and it makes every later control weaker.

Q: How should teams govern agent memory, tools, and identity together?

A: Treat them as one operating surface. Tool permissions determine what the agent can do, memory determines what it continues to believe, and identity determines what it can reach. If any one of those is weakly governed, the others inherit the risk and the agent can move from local misuse to enterprise-wide impact.

Technical breakdown

How agent identity abuse turns into privilege escalation

ASI03 in the OWASP Agentic Top 10 is fundamentally an identity problem. Agents often inherit a user session, reuse a secret, or rely on implicit trust across components, which makes attribution and scope control ambiguous. When a single credential can be reused by multiple tools or agents, the system no longer has a clean boundary between one actor and the next. That is why agent identity should not be treated as a cosmetic label. It is the mechanism that determines whether an action is attributable, revocable, and bounded by least privilege.

Practical implication: create distinct identities for agents and remove inherited human sessions from production workflows.

Why tool misuse is really a permissions design problem

ASI02 shows that many agent incidents do not require model compromise. The agent can stay within granted permissions and still delete data, exfiltrate records, or trigger destructive workflows through email, browsers, internal APIs, or SaaS tools. The failure is not merely misuse of a tool. It is the fact that the tool was exposed through permissions broad enough to make destructive behaviour possible. In identity terms, the tool surface is only as safe as the authorisation boundary behind it.

Practical implication: map every agent tool to a narrow permission scope and verify that destructive actions require explicit control points.

How memory poisoning widens the NHI attack surface

ASI06 matters because persistent memory, embeddings, and RAG stores can retain secrets, keys, tokens, and misleading instructions long after the original event. That turns agent memory into an identity-adjacent trust store. If those stores are writable by weakly governed inputs, the agent may carry compromised state into later sessions and make bad decisions with legitimate access. The security issue is not just bad text in memory. It is persistent trust in data that may have been introduced by an untrusted source.

Practical implication: classify agent memory and retrieval stores as governed assets and restrict what can be written into them.

Threat narrative

Attacker objective: The attacker wants to turn legitimate agent permissions into actions that look authorized while producing data loss, exfiltration, or operational disruption.

1. Entry begins when an attacker manipulates an agent through inputs, tools, or compromised components that the agent already trusts.
2. Credential access or abuse follows when the agent uses inherited sessions, reused secrets, or exposed tokens to reach systems beyond the intended scope.
3. Escalation occurs when the agent misuses legitimate permissions, chains tools, or amplifies a poisoned memory state into broader actions.
4. Impact is the deletion, exfiltration, or corruption of data and workflows through actions that appear legitimate unless identity and tool provenance are tightly tracked.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Spain's first AI agent data breach 2026: Spain's AEPD logged its first breach notification attributed to an attacker's AI agent, which altered personal data and accessed invoices.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic risk is an NHI governance problem before it is a model risk problem. OWASP’s list is useful because it shows that most agent failures are carried by secrets, permissions, and trust boundaries rather than by reasoning quality alone. If the identity layer is overprivileged or unowned, the agent simply inherits the weakness. The implication is that agent security programmes must start with machine identity governance, not with prompt tuning.

Identity and privilege abuse is the named concept that best explains why agent governance breaks down. ASI03 captures a condition where one credential, session, or role can be reused across agent actions without clean attribution. That was designed for bounded, human-paced access patterns. It fails when the actor can chain tools and move across contexts faster than review or recertification cycles can observe. The implication is that governance needs an agent-native identity boundary, not a retrofit of human access assumptions.

Agentic supply chain risk extends NHI governance to the components that feed the agent. Models, plugins, MCP servers, prompt templates, and external tools can all inject hidden instructions or backdoors at runtime. That means third-party trust now applies to the agent stack itself, not only to the surrounding infrastructure. Practitioners should treat the agent supply chain as part of the non-human identity estate, with ownership, provenance, and revocation boundaries.

Blast radius is now the operational measure that matters most. The article’s central thread is that exposed secrets do not just create access, they create propagation paths across agents, workloads, and SaaS environments. One compromised identity can cascade into many others when reuse and cross-environment trust are normalised. The field should therefore measure not just how many NHIs exist, but how far a single identity can reach before containment kicks in.

OWASP has effectively validated the convergence of agentic AI and NHI governance. The most citable insight here is that AI agent risk becomes governable only when identity inventory, least privilege, and secret lifecycle controls are applied together. Security teams that keep these disciplines separated will miss the interaction effects. The practical conclusion is that agent programmes and NHI programmes now need shared ownership and shared controls.

From our research library:

• Gartner predicts that more than 40% of agentic AI projects will be cancelled by the end of 2027, citing rising costs, unclear value and insufficient risk controls.
• Read next: Agentic AI Security Guide

What this signals

Identity and privilege abuse now defines the agent governance problem. If an AI system can inherit sessions, reuse secrets, or act through implicit trust, traditional access review processes lose their timing model. The control point shifts to issuance, scope, and revocation of the agent identity itself, not to after-the-fact certification.

Agent blast radius is the programme metric that matters most. OWASP’s taxonomy makes clear that a single exposed credential can propagate across tools, models, and environments when reuse is normalised. That is why identity teams need to understand where agent access fans out, not just whether access exists.

70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey. That gap becomes a governance liability when agent permissions outgrow the controls that were designed for human-paced work.

For practitioners

• Define per-agent identities Assign each production agent its own identity, separate from human sessions, and scope permissions to the task and environment the agent actually needs.
• Inventory secrets behind every agent Map API keys, OAuth tokens, PATs, and service accounts to the agents and workloads that use them so ownership and blast radius are visible.
• Reduce cross-tool privilege overlap Review whether browser, email, CRM, DNS, and internal API permissions overlap in ways that let one agent action fan out into unrelated systems.
• Treat memory and RAG stores as governed trust Limit what can be written into persistent memory, embeddings, and retrieval stores, and separate untrusted inputs from state that influences future runs.
• Set revocation paths for agent blast radius Predefine which credentials, tools, and dependencies should be revoked first when an agent behaves outside baseline or a secret is exposed.

Key takeaways

• AI agent incidents often start with identity and permission design, not with the model itself.
• OWASP’s agentic risk list shows why overprivileged NHIs, secret exposure, and trust reuse are the main amplifiers.
• The practical response is to govern each agent as a distinct identity with narrow scope, clear ownership, and fast revocation paths.

Key terms

• Agent Identity: An agent identity is the set of attributes, credentials and permissions assigned to an autonomous software entity. It is treated as a non-human identity because it can authenticate, act on systems and accumulate access over time, which creates governance, audit and lifecycle obligations similar to other production identities.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
• Identity And Privilege Abuse: Identity and privilege abuse happens when delegated authority, cached credentials, or inherited access lets an agent act beyond the intent of the original owner. In agentic systems, the problem is often ambiguity in who owns the action and whether the granted authority still matches the task.
• Memory Poisoning (ASI06): An attack where malicious content is injected into an AI agent's memory or context, causing it to alter its behaviour in subsequent tasks, potentially exfiltrating secrets, escalating privileges, or acting against its intended purpose.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.