The OWASP Agentic Top 10, mapped to integration controls
Security teams now have a shared list of agent risks. Integration teams own many of the controls. This guide connects the two, risk by risk.
In December 2025 the OWASP GenAI Security Project published the Top 10 for Agentic Applications, a peer-reviewed list built by more than a hundred practitioners. It extends, rather than replaces, the OWASP Top 10 for LLM Applications, whose 2026 edition followed in August 2026. The LLM list is about what a model says; the agentic list is about what an agent does.
That second category is an integration problem. When an agent misbehaves, the damage happens through tool calls, API requests and messages to other agents, which is to say through the gateways, API policies and integration flows that integration teams design and run. This guide maps each risk to the controls that live in those layers.
The ten risks and where to control them
| ID | Risk | What it looks like in an integration landscape | Primary integration controls |
|---|---|---|---|
| ASI01 | Agent goal hijack | A supplier note in an invoice PDF tells the AP agent to change the bank account before payment | Treat tool results and documents as data; approval gates on payments and master-data changes; allow-listed write tools only |
| ASI02 | Tool misuse and exploitation | An agent with a generic "call ERP API" tool deletes or mass-updates records it was only meant to read | Narrow, task-shaped tools; strict input schemas; read and write split across servers; per-tool authorization in the MCP gateway |
| ASI03 | Identity and privilege abuse | An HR copilot uses a technical user with full Employee Central access to answer any employee's question | User context on every call; agent registered as its own client; downstream token exchange with minimal scope; no shared technical users |
| ASI04 | Agentic supply chain vulnerabilities | A community MCP server or unsigned Agent Card is installed and quietly exfiltrates data | Approved registry of MCP servers and Agent Cards; verified signatures; pinned versions; egress allow-lists |
| ASI05 | Unexpected code execution | An agent generates a Groovy script or SQL and a tool runs it against a live tenant | No tools that execute model-written code in production; sandboxed execution only; human review before deployment |
| ASI06 | Memory and context poisoning | A poisoned knowledge-base article makes the support agent recommend disabling a validation step | Provenance on retrieved content; write controls on agent memory and RAG stores; periodic review of high-impact memories |
| ASI07 | Insecure inter-agent communication | A spoofed partner agent sends A2A messages that your procurement agent trusts | Signed Agent Cards; mutual authentication; A2A traffic through an agent gateway; message size and rate limits |
| ASI08 | Cascading failures | One agent's retry loop floods an iFlow, which backs up the ERP queue and stalls order processing | Rate limits and quotas per agent; circuit breakers; timeouts shorter than the agent's; idempotent writes; bulkheads between agent and human traffic |
| ASI09 | Human-agent trust exploitation | An agent presents a confident but fabricated summary, and an approver clicks "approve" without checking | Approval screens show the actual payload and source data, not the agent's summary; four-eyes on high-value actions; approval rate monitoring |
| ASI10 | Rogue agents | A misconfigured or compromised agent keeps acting outside its mandate | Per-agent kill switch at the gateway; behavioural baselines and anomaly alerts; short-lived credentials; regular access recertification |
Which layer owns which control
Defence in depth matters more for agents than for ordinary API consumers, because an agent picks its own calls at runtime. Spread the controls so no single misconfiguration exposes a system of record:
- Agent platform: system prompts, tool selection, memory hygiene, user-facing approvals.
- MCP / agent gateway: client authentication, per-tool authorization, filtered discovery, quotas, payload inspection, audit, kill switch. Covers most of ASI02, ASI03, ASI07, ASI08 and ASI10.
- API management: OAuth scopes, token exchange, threat protection, spike arrest, consumer analytics.
- Integration flows: input validation, business rules, idempotency, compensation, data masking in logs. The last line before the system of record.
- Systems of record: their own authorization checks. Never assume the gateway did it.
Approval gates that actually work
Approval gates are the most common mitigation and the most commonly weakened one (ASI09). Design rules from production:
- Gate on impact, not on tool. Reading a balance needs no approval; changing a bank account always does, regardless of which tool does it.
- Show the payload. The approver sees the vendor ID, old and new IBAN and the source document, not a sentence the agent wrote.
- Make the approval a separate, authenticated event. MCP's Multi Round-Trip Requests and A2A's
INPUT_REQUIREDstate both make this natural: the approval arrives as its own request, from a human identity, and is logged. - Watch approval rates. A 99% approval rate means the gate is theatre. Sample and review.
The regulatory clock for agent governance
Two timelines shape how much evidence you will need to show, especially for HR and finance agents.
| Date | Milestone | Relevance to agentic integration |
|---|---|---|
| 2 Feb 2025 | EU AI Act prohibited practices and AI literacy duties apply | Already in force |
| 2 Aug 2025 | EU AI Act obligations for general-purpose AI models apply | Mostly on model providers; deployers inherit documentation |
| Feb 2026 | NIST launches the AI Agent Standards Initiative; NCCoE concept paper on agent identity and authorization | Signals that agent identity, audit and non-repudiation will become baseline expectations in the US |
| Jun 2026 | EU Digital Omnibus on AI adopted by Parliament (16 June) and Council (29 June) | Defers high-risk obligations; does not remove them |
| 2 Dec 2027 | High-risk obligations for Annex III systems apply (deferred from Aug 2026) | Annex III includes employment and HR uses: recruitment, promotion, task allocation, performance monitoring |
| 2 Aug 2028 | High-risk obligations for AI in Annex I regulated products apply | Relevant to manufacturing and medical device landscapes |
The deferral is breathing room, not a reprieve. Logging, human oversight and traceability for high-risk uses take longer to build than most teams expect, and integration layers produce most of the evidence: who called what, with which data, under whose authority. If you design the audit trail now, compliance later is mostly reporting.
A starting checklist
- Inventory every agent, the tools and agents it can reach, and the data classes involved.
- Map each agent to ASI01 to ASI10 and record the control and owning team for each risk.
- Route all MCP and A2A traffic through a gateway with per-tool authorization and a kill switch.
- Remove shared technical users from agent paths; carry user identity end to end.
- Require approval for payments, bank data, master data, HR decisions and anything irreversible.
- Make every agent-reachable write idempotent and compensatable.
- Log metadata with correlation IDs; mask personal data; retain to your regulatory horizon.
- Flag agents that touch Annex III areas (HR, credit, access to essential services) for EU AI Act readiness.
- Red-team with indirect prompt injection in documents, tool results and partner-agent messages.
Frequently asked questions
How is the OWASP Agentic Top 10 different from the OWASP LLM Top 10?
The LLM Top 10 covers risks in model behaviour and output, such as prompt injection and data leakage. The Agentic Top 10 covers risks in autonomous action: goal hijacking, tool misuse, identity abuse, inter-agent communication, cascading failures and rogue agents. Agent systems should be assessed against both.
Which agentic risks can an MCP gateway mitigate?
A gateway is the natural control point for tool misuse (ASI02), identity and privilege abuse (ASI03), insecure inter-agent communication (ASI07), cascading failures (ASI08) and rogue agents (ASI10), through per-tool authorization, quotas, audit and kill switches. It cannot fix goal hijacking or memory poisoning on its own.
When do EU AI Act high-risk rules apply to HR agents?
After the Digital Omnibus adopted in June 2026, high-risk obligations for Annex III systems, which include many employment and HR uses, apply from 2 December 2027. Prohibited practices and general-purpose AI obligations already apply.
Sources and further reading
- OWASP Top 10 for Agentic Applications for 2026
- CyberSaint: OWASP Top 10 for LLM and Agentic AI
- Secure Privacy: EU AI Act Digital Omnibus deadlines after Council approval
- Gibson Dunn: EU AI Act Omnibus agreement
- WorkOS: NIST AI Agent Standards Initiative explained