Topic starter
18/08/2026 2:41 pm
TL;DR: Agentic risk in the OWASP Top 10 for Agentic Applications 2026 is driven by delegated authority, broad tool access, and multi-step actions, according to Cycode. Per-agent identity, short-lived credentials, and runtime shutdown controls become central when one agent can turn a small action into a larger incident.
Editorial analysis by NHI Mgmt Group, based on content published by Cycode: “OWASP Top 10 for Agentic Applications”.
By the numbers:
- The OWASP Top 10 for Agentic Applications 2026, published December 9, 2025, catalogs ten risk categories.
- Cycode says the list is built from real 2025 incidents, not projections.
- Cycode reports that one compromised MCP server hit 78.3 percent attack success in a five-server agent setup.
Key questions
Q: Why do AI agents create more risk than traditional automation?
A: AI agents create more risk because they can interpret context, choose actions, and invoke tools autonomously.
Q: How can teams tell whether agentic access controls are actually working?
A: Look for evidence that every privileged action is logged with actor type, target resource, and policy decision, and that denied requests are being blocked before execution.
Q: What breaks when AI agents have broader access than their tasks require?
A: Over-privileged agents break segregation of duties, weaken auditability, and expand blast radius across transactions, data lookups, and workflow triggers.
Practitioner guidance
- Define per-agent identities and scoped credentials Give each agent its own identity, then constrain its credentials to the smallest set of tools, APIs, and data paths required for the task.
- Isolate retrieved content from executable instructions Treat email, documents, tickets, and repository content as untrusted input so they cannot rewrite agent goals or trigger sensitive actions.
- Build an AI Bill of Materials for agentic systems Inventory agents, models, tools, MCP servers, and connectors so permission review and provenance checks cover the full runtime chain.
Bottom line: Agentic AI shifts the security problem from output quality to delegated action, which makes identity scope and tool reach central control points.
Glossary terms: Agentic Application, Blast Radius, AIBOM, Agent Goal Hijack (ASI01)
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 hour ago by NHI Mgmt Group
18/08/2026 3:25 pm
Agentic risk is a governance problem before it is a model problem. The article’s central insight is that autonomy changes how damage accumulates, because the agent acts with real permissions across multiple systems. That means identity, tool scope, and approval boundaries matter more than whether the underlying model is accurate. Practitioners should judge agents by the authority they can exercise, not by the quality of their answers.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should organisations govern external tools used by AI agents?
A: Organisations should review external tools as security inputs, not convenience features. Each tool needs ownership, approval, metadata inspection, and ongoing monitoring for hidden instructions or unexpected behaviour. If an AI agent can act on a tool, then the tool’s provenance and control status should be governed like any other sensitive integration.
👉 Read our full editorial: Agentic risk is about delegated authority, not model output
This post was modified 1 hour ago by NHI Mgmt Group