OWASP’s agentic AI Top 10 reframes enterprise AI security

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Zenity's blog post: OWASP's Top 10 for Agentic Applications reframes AI security around the risks created by agents that plan, invoke tools, use memory, and act inside enterprise systems.

Why it matters: It matters because IAM, PAM, and NHI programmes built for static identities and model-centric controls do not fully govern delegated, runtime agent behaviour, privileges, and execution paths.

Context

Agentic AI security is the governance problem that appears when software can decide, delegate, invoke tools, and complete work inside business systems rather than only generate text. In this article, Zenity argues that OWASP’s Top 10 for Agentic Applications gives the industry a common way to classify those operational risks.

The core issue for identity teams is not model quality alone. It is how to govern identity, privilege, and action when the actor can chain tools, use inherited access, and influence real enterprise workflows without fitting old human IAM assumptions.

Key questions

Q: What breaks when AI agents are given broad enterprise access without tight governance?

A: Broad access turns AI agents into high-speed execution paths that can move data, spend money, modify records, or delete assets before operators can intervene. The failure is not only misuse by an attacker. The system itself can exceed intended scope during normal task completion, so the real control problem is bounding authority before runtime action begins.

Q: Why does agentic AI increase enterprise risk compared with text-only models?

A: Agentic AI increases risk because it can move from generating advice to taking actions. Once an agent can call APIs, access databases, or execute commands, mistakes and compromise can affect real systems, not just outputs. That expands the blast radius of bad prompts, weak permissions, and untrusted integrations across business operations.

Q: What are the signs that agent controls are not working?

A: The clearest warning signs are unexplained tool calls, unexpected privilege use, unreviewed delegated actions, and memory or context changes that alter later decisions. If an agent can move from one system to another without visible policy checks, governance is happening too late. Practitioners should look for behaviour that outpaces their logging and approval boundaries.

Q: How should security teams govern agents that act like privileged identities?

A: They should assign each agent a distinct identity, define explicit delegation boundaries, and monitor the actions that identity can perform across the lifecycle. If an agent can access data, invoke tools, or trigger workflow steps, it needs controls comparable to a privileged service account, plus behavioural oversight for runtime decisions.

Technical breakdown

Agent goal hijack and the breakdown of instruction boundaries

Agent goal hijack occurs when an attacker manipulates an agent’s runtime instructions so the system pursues a different objective than the one originally authorised. In agentic systems, the boundary between user input, retrieved context, and operational intent is weak unless it is explicitly enforced. That creates a control problem that is closer to runtime authorisation than to prompt filtering. Once goals can be rewritten mid-session, the security question becomes whether the agent can preserve its intended purpose when exposed to hostile context, not whether the model can produce a safe answer.

Practical implication: Treat goal integrity as a runtime control problem and validate whether agents can resist instruction redirection before they are allowed to act.

Identity and privilege abuse in agentic workflows

Agent identity and privilege abuse happens when an agent inherits tokens, cached credentials, or broad access scopes and then uses that access beyond the intent of the workflow. The article frames agents as privileged service-account-like actors, which is the right mental model because they can operate across systems with delegated permissions. The critical distinction is that access is no longer just held, it is acted on. That means privilege scope, delegation boundaries, and authentication context all matter at execution time, not only at provisioning time. In practice, this is where NHI governance meets agentic behaviour.

Practical implication: Audit inherited access, delegation chains, and token scope as a single control surface for agentic execution.

Cascading failures from autonomous tool chains

Agentic systems are vulnerable to cascading failures because they can plan, delegate, and execute across multiple tools before humans observe the first deviation. A small error, poisoned memory item, or compromised dependency can expand into a broad operational incident when the agent keeps chaining actions on its own. This is structurally different from a single failed API call. The risk is compounded when agents interact with other agents or shared memories, because each step can amplify the last one. Security control therefore has to follow the action sequence, not just inspect the initial input.

Practical implication: Build step-level oversight for agent actions so a single bad decision cannot automatically cascade into downstream business impact.

Threat narrative

Attacker objective: The attacker wants to steer agent behaviour so the system performs unauthorised actions while still appearing to operate within normal business workflows.

1. Entry begins when a prompt injection, poisoned context, or compromised dependency influences the agent’s initial decision path.
2. Escalation occurs when the agent misuses inherited identity, cached tokens, or delegated tools to extend its reach beyond the intended scope.
3. Impact follows when the agent executes harmful actions across workflows, data stores, or downstream systems before human review can intervene.

Breaches seen in the wild

• SalesBleed Salesforce Agentforce 2026: Three fixed Agentforce flaws let poisoned web leads make AI agents leak CRM data with zero clicks and send phishing under the agent's identity.
• DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic security is no longer a model-risk problem, it is an identity-and-action problem. OWASP’s agentic AI Top 10 matters because it shifts the security conversation from what the model says to what the agent can do. That distinction forces IAM, PAM, and NHI programmes to govern execution paths, not just authentication events. Practitioners should treat agent behaviour as a live access control issue, not a content moderation issue.

Least privilege for agents has to be defined at runtime, not just at provisioning time. Agents inherit tokens, cached identities, and delegated access in ways that static IAM models were not built to reason about. That means privilege boundaries can drift as the agent chains tools and decisions across systems. The implication is that governance now depends on monitoring actual action sequences, not merely reviewing assigned roles.

Goal integrity is the new control plane for agent safety. The article shows that prompt filtering and retrieval hardening do not solve the core problem when an attacker can redirect intent. Runtime guardrails must preserve the authorised objective while the agent is operating, or the security model collapses into post-hoc detection. Practitioners should recognise that intent drift is a governance failure, not just a technical anomaly.

Agent identity should be governed like a privileged service account with behavioural oversight. Zenity’s framing is consistent with a broader market shift toward treating agents as operational identities that need lifecycle controls, delegation boundaries, and continuous monitoring. That approach aligns with OWASP-NHI thinking while extending it into autonomous execution. The practical conclusion is that identity inventory alone is insufficient unless it is tied to what the agent actually does.

OWASP’s framework gives the market a shared language, but the real change is operational. Once security teams can name the failure mode, they can assign ownership across IAM, application security, and AI governance rather than leaving agent risk stranded in a generic AI programme. The field is moving toward control of agent decisions, not just model assurance. Practitioners should expect security architecture to reorganise around behaviour, delegation, and action provenance.

From our research library:

• 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
• Only 23% of IT leaders were very confident in their organisation's ability to manage security and governance for GenAI deployments, according to a 2025 Gartner survey of 360 IT leaders.
• Read next: AI Agent Authorisation Guide

What this signals

Goal integrity becomes a governance requirement when the actor can change state after deployment. In agentic systems, the important question is no longer whether the model produced a safe response, but whether the agent preserved its authorised objective while it acted. That pushes programme owners toward runtime policy, delegation tracking, and action provenance instead of relying on static review cycles.

Agentic AI identity is converging with NHI governance, but the operational bar is higher. Security leaders already expect AI to run major portions of infrastructure autonomously within three years, according to the 2026 Infrastructure Identity Survey. That expectation means identity teams need controls for behavioural drift, tool usage, and delegated execution before agents become normal production actors.

For practitioners

• Map agent permissions to execution boundaries Inventory which agents can invoke tools, read memory, and reach sensitive systems, then compare those permissions with the actual tasks they perform.
• Separate agent identities from human workflows Give each agent a distinct identity, role, and approval boundary so delegated actions can be traced and limited independently of the user who requested them.
• Review goal integrity controls before production use Test whether an agent can be redirected by hostile context, then block release until runtime guardrails preserve the authorised objective during execution.
• Monitor tool sequences and memory writes Track the order of agent actions, the tools called, and any memory updates so unexpected behaviour is visible before it compounds into downstream impact.

Key takeaways

• Agentic AI security shifts the problem from safe outputs to governed actions, which changes the centre of gravity for IAM and NHI teams.
• The key risks in OWASP's framework are identity misuse, goal hijack, tool abuse, memory poisoning, and cascading failure across workflows.
• Practitioners need runtime controls, explicit delegation boundaries, and behavioural monitoring if agents are going to operate inside enterprise systems.

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Agent Goal Hijack (ASI01): An attack where an adversary redirects an AI agent's objectives by manipulating its instructions, tool outputs, or external content, causing it to act outside its intended scope while appearing normal. The number one risk in the OWASP Top 10 for Agentic Applications 2026.
• Identity And Privilege Abuse: Identity and privilege abuse happens when delegated authority, cached credentials, or inherited access lets an agent act beyond the intent of the original owner. In agentic systems, the problem is often ambiguity in who owns the action and whether the granted authority still matches the task.
• Context And Memory Poisoning: Context and memory poisoning are techniques that manipulate what an agent reads in the moment or stores for later use. The first shapes immediate responses and tool calls within a session, while the second persists across sessions. Both can steer behaviour gradually, making compromise look like normal reasoning drift.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.