Topic starter
18/08/2026 2:41 pm
TL;DR: Ten agent-specific risks in the OWASP Top 10 for Agentic Applications 2026 map to real 2025 incidents, including zero-click data exfiltration, supply-chain compromise, and an autonomous agent deleting production data, according to Cycode. The central finding is that agentic risk is a blast-radius problem, because credentials, tools, memory, and delegated authority compound damage across multi-step actions.
Editorial analysis by NHI Mgmt Group, based on content published by Cycode: “OWASP Top 10 for Agentic Applications”.
By the numbers:
- The OWASP Top 10 for Agentic Applications 2026, published December 9, 2025, catalogs ten risk categories.
- Cycode says the list is built from real 2025 incidents, not projections.
- Cycode reports that one compromised MCP server hit 78.3 percent attack success in a five-server agent setup.
Key questions
Q: What breaks when AI agents have broader access than their tasks require?
A: Over-privileged agents break segregation of duties, weaken auditability, and expand blast radius across transactions, data lookups, and workflow triggers.
Q: Why do AI agents create more risk than traditional automation?
A: AI agents create more risk because they can interpret context, choose actions, and invoke tools autonomously.
Q: How can teams tell whether agentic access controls are actually working?
A: Look for evidence that every privileged action is logged with actor type, target resource, and policy decision, and that denied requests are being blocked before execution.
Practitioner guidance
- Define per-agent identities and scoped credentials Give each agent its own identity, then constrain its credentials to the smallest set of tools, APIs, and data paths required for the task.
- Isolate retrieved content from executable instructions Treat email, documents, tickets, and repository content as untrusted input so they cannot rewrite agent goals or trigger sensitive actions.
- Build an AI Bill of Materials for agentic systems Inventory agents, models, tools, MCP servers, and connectors so permission review and provenance checks cover the full runtime chain.
Bottom line: Agentic AI shifts the security problem from output quality to delegated action, which makes identity scope and tool reach central control points.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:25 pm
Agentic risk is a governance problem before it is a model problem. The article’s central insight is that autonomy changes how damage accumulates, because the agent acts with real permissions across multiple systems. That means identity, tool scope, and approval boundaries matter more than whether the underlying model is accurate. Practitioners should judge agents by the authority they can exercise, not by the quality of their answers.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should organisations govern external tools used by AI agents?
A: Organisations should review external tools as security inputs, not convenience features. Each tool needs ownership, approval, metadata inspection, and ongoing monitoring for hidden instructions or unexpected behaviour. If an AI agent can act on a tool, then the tool’s provenance and control status should be governed like any other sensitive integration.
👉 Read our full editorial: OWASP Top 10 for agentic applications reframes AI agent risk