OWASP Top 10 for agentic applications reframes AI agent risk

At a glance

What this is: Cycode’s analysis of OWASP Top 10 for Agentic Applications 2026 argues that agentic risk is driven by delegated authority, broad tool access, and multi-step blast radius rather than by model output alone.

Why it matters: For IAM, PAM, and AI security teams, the implication is that governance has to move from reviewing answers to governing agent identity, scope, and runtime action paths.

By the numbers:

• The OWASP Top 10 for Agentic Applications 2026, published December 9, 2025, catalogs ten risk categories.
• Cycode says the list is built from real 2025 incidents, not projections.
• Cycode reports that one compromised MCP server hit 78.3 percent attack success in a five-server agent setup.
• Cycode notes that the same setup cascaded into other servers’ operations 72.4 percent of the time.

Context

Agentic AI changes the control problem because the system does more than generate text. Once an agent can hold memory, call tools, and act with delegated authority, the security question becomes how much damage a sequence of valid-looking steps can cause across connected systems.

That matters to identity governance because the primary risk is no longer just bad output, but agent identity, scoped privilege, and trust delegation across tools, APIs, and other agents. Cycode’s article uses the OWASP Top 10 for Agentic Applications to frame that shift as an operational governance problem, not a model-only issue.

Key questions

Q: What breaks when AI agents have broader access than their tasks require?

A: Over-privileged agents break segregation of duties, weaken auditability, and expand blast radius across transactions, data lookups, and workflow triggers. In banking, a single agent identity can act with more operational reach than any human reviewer can safely justify.

Q: Why do AI agents create more risk than traditional automation?

A: AI agents create more risk because they can interpret context, choose actions, and invoke tools autonomously. Traditional automation follows fixed rules, but an agent can be manipulated into using its own authority in unintended ways. That makes permission scope, tool boundaries, and monitoring more important than model accuracy alone.

Q: How can teams tell whether agentic access controls are actually working?

A: Look for evidence that every privileged action is logged with actor type, target resource, and policy decision, and that denied requests are being blocked before execution. If you can only see the login and not the downstream action, the control is too weak for agentic use.

Q: How should organisations govern external tools used by AI agents?

A: Organisations should review external tools as security inputs, not convenience features. Each tool needs ownership, approval, metadata inspection, and ongoing monitoring for hidden instructions or unexpected behaviour. If an AI agent can act on a tool, then the tool’s provenance and control status should be governed like any other sensitive integration.

Technical breakdown

Agentic blast radius comes from delegated permissions

Agentic systems differ from chatbots because they can chain actions across tools, data, and services using real credentials. That means the attack surface is not a single prompt or response, but every permission the agent can exercise during a workflow. The critical failure mode is over-scoping: when an agent has broader access than the task requires, each step in the plan can compound harm even if every individual action appears legitimate. Traditional appsec checks are poor at this because they inspect code paths, not the runtime mix of goal, context, tool reach, and authorization.

Practical implication: Treat agent privilege scope as a first-class security boundary and constrain every tool, API, and credential to the task at hand.

Why prompts, memory, and tool calls escape normal appsec

Static application security testing and software composition analysis are not built to inspect an agent’s system prompt, retrieved context, memory store, or inter-agent traffic. Those are the places where agentic attacks live. A poisoned document can alter the agent’s objective, a malicious memory write can persist beyond one session, and an unsafe tool call can turn natural language into action. The security model must therefore cover runtime context, not just source code or dependency manifests, because a clean code scan says nothing about what the agent will do after it reads untrusted input.

Practical implication: Add controls for context ingestion, memory writes, and tool invocation instead of relying on code scanning alone.

Multi-agent trust needs authenticated delegation

Once agents talk to other agents, trust can be replayed, spoofed, or inherited through weak coordination channels. If messages are not authenticated and integrity protected, a fake peer can impersonate a trusted system, or a stolen delegation message can be reused to gain access to downstream actions. This is where agentic security intersects directly with IAM and NHI governance: the identity of the agent, the validity of the message, and the scope of delegated authority all have to line up. Without that, one compromised node can spread through the coordination graph.

Practical implication: Use mutual authentication and signed messages for agent-to-agent communication, and tie delegation to explicit, short-lived authorization.

Threat narrative

Attacker objective: The attacker’s objective is to turn the agent’s delegated authority into unauthorized data access, destructive execution, or downstream system compromise.

1. Entry occurs when an attacker places crafted content, malicious instructions, or a compromised component into the agent’s read path, such as email, repository content, or a connector package.
2. Credential access and tool abuse follow when the agent reuses delegated authority to reach data, APIs, or operational systems that it was never meant to touch at that scope.
3. Escalation happens when the agent chains multiple legitimate-looking steps, so each action compounds the blast radius across memory, tools, and downstream automations.
4. Impact lands as data exfiltration, destructive actions, or supply-chain propagation, including database deletion, token theft, or unauthorized changes to production systems.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Amazon Q Developer extension compromise 2025: An over-scoped CI token let an attacker ship a prompt telling Amazon Q's AI coding agent to wipe files and AWS resources (CVE-2025-8217).

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic risk is a governance problem before it is a model problem. The article’s central insight is that autonomy changes how damage accumulates, because the agent acts with real permissions across multiple systems. That means identity, tool scope, and approval boundaries matter more than whether the underlying model is accurate. Practitioners should judge agents by the authority they can exercise, not by the quality of their answers.

Blast radius, not prompt quality, is the decisive control variable. The OWASP framing is useful because it shifts attention from output correctness to what an agent can reach once instructions, memory, and tools are combined. This is where the identity bridge matters most: per-agent identity, scoped credentials, and delegation controls define whether a compromised agent is contained or capable of lateral damage. Security teams should design for the worst reachable action, not the average request.

AI security teams need an inventory of agents and connectors, not just models. The article reinforces that the meaningful governance unit is the agentic system, including tools, MCP servers, and runtime permissions. That is why AIBOM-style inventory, provenance, and permission review are becoming operational necessities rather than documentation exercises. Practitioners should assume that unmanaged agent sprawl creates governance debt quickly.

Real incidents have already validated the threat model. Cycode’s examples show this is not speculative research, because zero-click exfiltration, compromised coding assistants, and destructive agent behavior have already occurred in production contexts. The lesson for the field is that agentic controls now belong in the same conversation as IAM, PAM, and SDLC governance. Organisations should treat agentic attack paths as active exposure, not future risk.

Agentic AI identity needs a control model of its own. The article makes clear that giving an agent access without tightly governed identity, trust, and runtime constraints creates a new class of non-human privilege exposure. That should push identity programmes to define who or what is acting, which authority is delegated, and how quickly that authority can be revoked. Practitioners should build governance around agent identity lifecycle, not around the model in isolation.

From our research library:

• 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
• 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
• Read next: AI Agent Authorisation Guide

What this signals

Agentic AI identity is becoming a governance boundary, not a niche control. The practical challenge for teams is that an agent can appear compliant at the model layer while still holding excessive operational reach. That means identity programmes need to inventory agents, their delegates, and their connectors as part of the control plane, not as an afterthought.

Blast-radius reduction is the right design goal for agentic environments. Cycode’s cited incident data shows why privilege scope matters: systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems, so governance should focus on what an agent can touch, not just what it says.

Per-agent authorisation should become a release gate. If an agent can act across production, support, and developer workflows, the organisation needs a release-time check on the permissions it inherits and the tools it may call. Otherwise, the operational model will keep outrunning the control model.

For practitioners

• Define per-agent identities and scoped credentials Give each agent its own identity, then constrain its credentials to the smallest set of tools, APIs, and data paths required for the task.
• Isolate retrieved content from executable instructions Treat email, documents, tickets, and repository content as untrusted input so they cannot rewrite agent goals or trigger sensitive actions.
• Build an AI Bill of Materials for agentic systems Inventory agents, models, tools, MCP servers, and connectors so permission review and provenance checks cover the full runtime chain.
• Instrument kill switches and behavioural monitoring Monitor agent actions, not just prompts, and make shutdown procedures available when behaviour drifts beyond approved delegation.

Key takeaways

• Agentic AI shifts the security problem from output quality to delegated action, which makes identity scope and tool reach central control points.
• The article ties its framework to real incidents, including zero-click exfiltration, supply-chain compromise, and destructive agent behaviour in production.
• Teams that want to contain agent risk need per-agent identity, short-lived credentials, authenticated delegation, and runtime monitoring with shutdown capability.

Key terms

• Agentic Application: An agentic application is software in which an AI system can choose actions, call tools, and complete tasks with limited human intervention. In security terms, it behaves like an active workload that needs scoped identity, logging, and control boundaries, not just prompt filtering.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
• AIBOM: An AI Bill of Materials is a structured inventory of the components, data sources, prompts, connectors, and dependencies that shape an AI system. It helps security teams understand what the model can access, where risk enters the stack, and which changes require governance review.
• Agent Goal Hijack (ASI01): An attack where an adversary redirects an AI agent's objectives by manipulating its instructions, tool outputs, or external content, causing it to act outside its intended scope while appearing normal. The number one risk in the OWASP Top 10 for Agentic Applications 2026.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, secrets management, and workload identity. It is designed for practitioners who need to govern delegated access across human and non-human systems.