OWASP Top 10
for Agentic Applications

,-,-,-,-,
| | | | |
|   v   |
 AGENT++
[inject!]

Every agent that reads external data is a potential marionette. We dissect how prompt injection in agentic pipelines differs fundamentally from its web-app predecessor: the attack surface is unbounded, the execution context is elevated, and the victim can't distinguish a system instruction from a poisoned email subject line. We walk through three real-world injection chains — calendar → CRM → outbound email — and propose a constraint-based input sanitization model that survives multi-hop reasoning.

[KEY][KEY]
[KEY][KEY]
[........]
[!ADMIN!]

The principle of least privilege is sixty years old. It took us six months to forget it for AI agents. This article catalogs the gap between what agentic systems need to do and what they're allowed to do in production deployments: filesystem write access granted "just in case," API keys scoped to admin "for simplicity," shell execution enabled "for flexibility." We present a capability audit methodology and a minimal-permission contract pattern that organizations can retrofit without rebuilding their orchestration layer.

{
 name: ok
 exec: evil
}
[trigger!]

Model Context Protocol changed everything. It also handed attackers a new primitive: the malicious tool definition. When an agent loads a tool schema from an untrusted registry — or when a supply chain compromise replaces a trusted one — the function signature itself becomes the exploit payload. We demonstrate how a crafted description field in a tool manifest can redirect an agent's entire execution plan without touching a single line of application code. Includes a proof-of-concept against a popular open-source agent framework.

[01|FF|01]
 ->INJECT
[FF|01|FF]
[corrupt!]

Persistent agent memory is a feature that ships without a threat model. We examine four attack vectors against memory stores used by production agentic systems: direct injection via crafted documents, memory flooding to displace legitimate context, temporal poisoning that plants instructions for future sessions, and retrieval hijacking through embedding collision. The uncomfortable conclusion: most vector-store-backed memory systems have no integrity guarantees whatsoever. We propose a signed memory architecture and a verification pass for retrieved context before it enters the reasoning loop.

  .oOo.
  TOKEN
  -----
  leaked
 [exfil!]

Agents are excellent at summarization. They are also, accidentally, excellent at credential exfiltration. This article traces how secrets — API keys, OAuth tokens, session cookies — enter the agent context through tool responses, system prompts, and retrieved documents, then leak outward through logs, downstream tool calls, and LLM provider telemetry. We instrument a standard ReAct agent loop and map every egress point. The result is a practical secrets hygiene checklist for agentic deployments and a case for secret-aware output filters as a first-class infrastructure component.

> rm -rf /
#########
  ..done.
[sandbox?]

Code interpreter tools are the crown jewel of agentic capability and the broadest attack surface in the stack. We survey the containment assumptions of five popular agent sandboxing approaches — Docker, E2B, Pyodide, Firecracker, and native subprocess — and find that each fails under adversarial inputs in ways their documentation doesn't acknowledge. We detail three working escapes, propose a hardened execution contract (network isolation + read-only filesystem + syscall allowlist), and argue that safe code execution is a deployment property, not a model property.

[A]->[B]-+
         |
        [C]
         |
       {err}

In a multi-agent pipeline, one agent's confident hallucination is every downstream agent's ground truth. We model agentic systems as directed trust graphs and identify the structural properties that cause errors to amplify rather than cancel across hops. The canonical failure mode: a retrieval agent returns a plausible-but-wrong fact; an analysis agent cites it authoritatively; a decision agent acts on it irreversibly. We introduce a trust propagation score, propose skepticism injection points at inter-agent boundaries, and evaluate three mitigation strategies against a synthetic benchmark of cascading failure scenarios.

.-------.
| OPEN  |
|_______|
bypassed

Agentic systems don't authenticate as users — they authenticate as themselves, then act on behalf of users. This creates an authorization gap that traditional RBAC and ABAC models aren't designed to close. We document five bypass patterns observed in production deployments: ambient authority from agent service accounts, confused deputy attacks via tool chaining, identity laundering through multi-agent handoffs, privilege leakage from shared context windows, and time-of-check/time-of-use races in async agent loops. Each pattern includes a detection heuristic and a concrete remediation.

[your-pkg]
     v
  [dep_X]
     v
 {malware}

The agent ecosystem has a dependency problem it hasn't admitted yet. LangChain, LlamaIndex, CrewAI, AutoGen — each installs hundreds of transitive packages and loads tools from community registries with no cryptographic verification. We apply standard software supply chain analysis to ten widely-used agent frameworks, find an average of 340 unchecked dependencies, and demonstrate a prototype attack where a maliciously modified langchain-community tool silently exfiltrates every tool call payload. The fix is boring: lock files, SBOM generation, and registry signing. The risk is not.

$0.003 in
..........
<-$47.82
[drained!]

Traditional DoS fills up disks or saturates bandwidth. Agentic DoS empties your credit card. We characterize the Denial-of-Wallet attack class: inputs crafted to maximize token consumption, force expensive tool calls, trigger infinite retry loops, or instantiate unbounded sub-agent trees. A single $0.003 request can, under the right conditions, generate $47 in downstream API costs. We present a cost-aware execution model with per-session budget caps, call-graph cycle detection, and a lightweight token forecast that fires before the expensive call rather than after.

user
  v sudo
    v root
      {???}

Agentic privilege escalation doesn't look like a shell exploit. It looks like a helpful assistant gradually expanding its own access: requesting additional tool permissions to complete a task, writing instructions to its own memory store, convincing an orchestrator agent to grant elevated capabilities, or persisting modified system prompts across sessions. We document a five-step escalation chain observed in a red team engagement against a production agent platform and propose a principle of immutable agency: an agent's capability set should be fixed at instantiation and verifiable at any point during execution.

in -> [?]
       v
   verify
       v
out -> ok

A field guide for security engineers inheriting an agentic system they didn't build. We present a structured threat modeling methodology for agentic applications — adapted from STRIDE but extended for the properties unique to LLM-based execution: non-determinism, context sensitivity, emergent behavior, and tool-mediated side effects. The output is a one-page threat model template, a set of 40 security questions organized by layer (model, orchestration, tools, memory, I/O), and a prioritized remediation roadmap calibrated to the OWASP Agentic Top 10. Print it, laminate it, tape it to your monitor.