OWASP Top 10 for agentic applications 2026 and NHI risk

At a glance

What this is: This is Teleport’s summary of OWASP’s 2026 agentic applications Top 10, showing that AI agents create identity, tool-use, memory, and supply-chain risks when they act with real permissions in production.

Why it matters: It matters because IAM, PAM, and NHI programmes need to govern agent identity, tool scope, and approval boundaries, not just model outputs or prompt safety.

👉 Read Teleport’s summary of the OWASP Top 10 for Agentic Applications 2026

Context

Agentic applications are AI systems that do more than generate text. They remember context, choose tools, call APIs, move data, and execute actions with production permissions, which means identity and access control become part of the attack surface.

Teleport’s summary of the OWASP GenAI Security Project frames the core problem as a mismatch between older security models and agent behaviour. Controls built for human-paced, request-driven access struggle when an agent can plan, delegate, and act inside the same runtime cycle.

The article is not just a risk catalogue. It is a reminder that security teams now have to govern agent identity, privilege scope, and inter-agent trust as operational controls rather than future design concerns.

Key questions

Q: What breaks when AI agents inherit access from users and service accounts?

A: The main failure is that inherited access can be broader than the agent’s actual task, so privilege becomes easier to reuse than to govern. Once an agent can chain tool calls across systems, the original approval no longer describes the full blast radius. Security teams need to treat inherited access as a live identity surface, not a one-time provisioning artifact.

Q: Should organisations prioritise runtime controls or agent productivity first?

A: Security teams should prioritise runtime controls before broad deployment because uncontrolled agent expansion creates compliance and breach risk faster than most programmes can remediate it. The practical sequence is identity, policy, telemetry, then scale. Without that order, productivity gains can quickly become unrecoverable governance debt.

Q: What are the signs that an agentic workflow is failing governance checks?

A: Look for repeated goal drift, unusual tool chains, unexpected data movement, reused credentials, and agent-to-agent messages that lack strong authentication or schema validation. Those signals show the workflow is operating outside the boundary your governance model assumes.

Q: How should security teams govern AI agents and NHIs differently?

A: Security teams should govern NHIs as predictable machine identities and AI agents as runtime actors that can alter behaviour after authentication. That means static entitlements, inventory, and rotation remain central for NHIs, while agents need behaviour monitoring, delegation tracing, and ownership controls that account for tool choice and execution timing.

Technical breakdown

Why agent goal hijack is an identity problem

Agent goal hijack happens when malicious input changes what the agent thinks it is supposed to do. Because many agents encode plans in natural language, they can treat external text, retrieved data, or embedded prompts as if it were trusted instruction. The result is not only bad output but bad action selection, because the agent may follow attacker-shaped objectives while still appearing internally consistent. That makes the problem an identity and authorisation issue as much as a model-safety issue, because the agent is acting under legitimate credentials. Practical implication: treat all goal-shaping input as untrusted and constrain the actions an agent can take.

Practical implication: bind agent goals to explicit policy and limit the actions they can perform even when the input looks legitimate.

How tool misuse and privilege abuse unfold in production

Tool misuse occurs when an agent uses a legitimate tool in an unsafe way, such as chaining a harmless action into a destructive one or passing unvalidated output into a shell or database call. Identity and privilege abuse adds the delegation layer: an agent may inherit credentials, cached context, or implicit authority from a human or another service. In both cases, the issue is not unauthorized access from the outside. It is excessive or poorly bounded access from the inside. Practical implication: scope every tool and every delegated identity separately, then validate each invocation before execution.

Practical implication: design per-tool and per-agent authorization boundaries, not one broad permission set for the whole workflow.

Why agentic supply chain risk extends beyond code

Agentic systems can dynamically load models, plugins, descriptors, and tools from third parties, which turns runtime composition into a security dependency. A malicious or compromised component can alter behaviour, inject hidden instructions, or redirect data at the point where the agent actually acts. This is a supply-chain issue because trust is being extended to artifacts and services that may not be owned, reviewed, or updated like first-party code. The article’s emphasis on inventories, signing, and sandboxing reflects that the attack surface now includes what the agent can load on demand. Practical implication: inventory runtime dependencies and revoke trust when any component cannot be verified.

Practical implication: treat dynamically loaded agent components as governed dependencies, not temporary conveniences.

Threat narrative

Attacker objective: The attacker wants the agent to carry out harmful actions under legitimate permissions while appearing to operate normally.

1. Entry begins when an attacker places malicious instructions, compromised tools, or poisoned runtime components into the agent’s input, dependency, or communication path.
2. Escalation occurs when the agent accepts those inputs as legitimate, inherits privileged context, or uses approved tools in unintended ways that expand attacker control.
3. Impact follows when the agent executes destructive actions, leaks data, propagates poisoned context, or triggers cascading failures across connected systems.

Breaches seen in the wild

• reviewdog Action compromise 2025: A stolen maintainer token poisoned reviewdog/action-setup, leaking CI secrets including the tj-actions bot token used in the next attack.
• Shai Hulud npm malware campaign: Shai Hulud campaign: npm malware exposed secrets on GitHub.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic systems collapse the assumption that identity is only a static wrapper around a user or workload. Once an AI agent can choose actions at runtime, identity becomes an active control surface rather than a provisioning record. That changes the governance problem from who owns the account to what the account is allowed to decide, do, and delegate. Practitioners need to treat agent identity as a runtime policy boundary, not just an object in the directory.

Tool misuse and identity abuse are the same governance problem viewed from different angles. One describes the unsafe action path, the other describes the authority path that made the action possible. In agentic systems, the distinction matters less than the fact that both are mediated through scoped permissions, delegated trust, and approval timing. That means security teams should stop separating application control from identity control when they review AI workflows.

Agentic supply chain risk is not just software provenance, it is trust provenance for runtime behavior. When agents can load third-party tools, models, or descriptors on demand, the issue is whether those components deserve operational trust at the moment of execution. This is where traditional software supply-chain thinking falls short because the compromise can arrive through live orchestration rather than a fixed build artifact. The implication is that governance must extend to every runtime dependency an agent can reach.

What breaks here is the assumption that access reviews can see and certify stable privilege over time. That assumption was designed for human users and long-lived non-human identities. It fails when an agent acquires context, uses privilege, and releases it within one task or one session. The implication is not merely stronger review cadence, but a different control model centered on issuance-time constraints, task boundaries, and continuous runtime enforcement.

Agentic blast radius: the real risk metric is no longer the agent’s intelligence, but how far one bad decision can propagate through delegated tools, shared memory, and chained automations. A small failure can become a multi-system incident when agents collaborate or inherit each other’s outputs without strong containment. That is why the category needs zero-trust thinking, not just content moderation or prompt filtering. Practitioners should measure how quickly a single compromised agent can spread trust, not just data.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Breaches involving third parties rose to 48% of all breaches, a 60% increase on the previous year, according to Verizon's 2026 Data Breach Investigations Report.
• Read next: AI Agent Identity Security Buyer's Guide

What this signals

Identity review will not be enough for agents that can acquire, use, and discard privilege inside a single task. Governance has to move toward issuance-time control, task-scoped authorization, and runtime containment because the review window no longer matches the behaviour window.

Runtime trust now matters as much as code provenance. If an agent can load tools, models, or descriptors on demand, security teams need inventories, signing, and revocation paths that cover live dependencies rather than only packaged software.

Agentic blast radius is becoming a design metric. The practical question is how far a single compromised action can spread through delegated tools, shared memory, and multi-agent communication before containment breaks.

For practitioners

• Define unique identities for each agent Assign each agent a separate identity with short-lived credentials, bounded scope, and no shared cached context across tasks.
• Scope every tool before execution Limit each tool to the minimum data, command set, and rate necessary, then require explicit confirmation for destructive operations.
• Inventory runtime dependencies and trust points Track every model, plugin, descriptor, and external service the agent can load, and block any component that cannot be verified or pinned.
• Separate planning from execution Keep agent reasoning, tool selection, and action execution under distinct policy checks so one compromised step cannot automatically trigger the next.
• Add blast-radius controls to multi-agent systems Use containment boundaries, rate limits, and kill switches so one agent’s failure cannot cascade across related agents or services.

Key takeaways

• Agentic AI changes identity security because the actor can choose, chain, and execute actions in production with real permissions.
• The OWASP 2026 Top 10 highlights risks across goal hijack, tool misuse, privilege abuse, supply chain compromise, memory poisoning, and rogue behaviour.
• Security teams should govern agent identity, runtime trust, and blast radius at issuance and execution time, not only through model or prompt controls.

Key terms

• Agentic Application: An agentic application is software in which an AI system can choose actions, call tools, and complete tasks with limited human intervention. In security terms, it behaves like an active workload that needs scoped identity, logging, and control boundaries, not just prompt filtering.
• Tool Misuse: Tool misuse occurs when an agent uses an allowed integration in a way that exceeds its intended task, scope, or risk tolerance. The problem is often not access alone but the combination of valid credentials, broad permissions, and unbounded action sequencing.
• Transitive privilege: Privilege that is inherited by a downstream actor through an upstream delegating identity. In agentic environments, it becomes a governance problem when a sub-agent receives more authority than its task requires simply because the orchestrator already had it.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.

What's in the full article

Teleport's full blog post covers the operational detail this post intentionally leaves for the source:

• Teleport’s mapping of each OWASP ASI category to concrete agent guardrails and deployment choices
• Examples of how Teleport applies short-lived credentials, approvals, and audit logging to agent workflows
• The article’s specific implementation guidance for securing AI agents, MCP servers, and human-in-the-loop access
• Related reading links on secretless engineering, MCP security, and AI agent authorisation

👉 Teleport’s full post expands on the ASI categories, mitigation steps, and identity guardrails for AI agents.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.