AI Security
A chatbot answers; an agent acts. That autonomy is the whole value proposition of 2026’s agentic AI wave — and a brand-new, poorly understood attack surface. Here’s what the OWASP framework says, and how to defend against it.
A chatbot answers. An agent acts. It calls tools, queries databases, sends emails, moves money, and chains those actions together with minimal human oversight. That autonomy is the entire value proposition of 2026’s agentic AI wave — and it is also a brand-new, poorly understood attack surface.
Recognising this, the OWASP Gen AI Security Project released the OWASP Top 10 for Agentic Applications (2026) — a globally peer-reviewed framework built with input from more than 100 industry experts. It exists because traditional application-security models were never designed for software that makes its own decisions at runtime. Below is a practitioner’s guide to the risks that matter most and how to defend against them.
OWASP’s framework catalogues ten agent-specific risk classes. Four of the most consequential — and most frequently exploited in early real-world incidents — are worth understanding in depth:
Agents are given “tools” — the ability to run code, hit APIs, query systems. Through ambiguous prompts or injected instructions, an attacker can turn a legitimate tool into a weapon: exfiltrating data with the same function meant to fetch it. Nothing looks malicious; the agent is simply using its permissions as designed.
Agents frequently inherit cached credentials or run with broad service-account privileges. If an agent reuses a token or operates with more access than the task requires, a single compromised prompt can reach far beyond its intended blast radius.
Agents dynamically load tools, plug-ins, models and components at runtime. Each dynamically pulled dependency is an unvetted supply-chain entry point — the AI-era version of a poisoned package.
Many agents rely on persistent memory and retrieval-augmented generation (RAG). Poison that memory or the underlying knowledge base, and you alter the agent’s future behaviour — a slow, stealthy compromise that survives across sessions.
The remaining categories in the framework extend these themes to areas such as goal manipulation, unsafe autonomy, insufficient human oversight and traceability gaps. The through-line is consistent: an agent’s permissions, memory and autonomy are now part of your attack surface.
It is tempting to file agent security under “LLM problems.” That underestimates it. The difference is consequence. A jailbroken chatbot says something embarrassing. A compromised agent with tool access and standing credentials can execute the embarrassment — moving data, triggering transactions, or pivoting into connected systems. Autonomy converts a content problem into an operations problem.
This is also why the threat is timely. IBM’s 2026 Cost of a Data Breach report found that more than 20% of organisations reported a breach that targeted their AI models or applications, with compromised APIs, apps and plug-ins and cloud misconfigurations each implicated in 27% of those cases. The agentic attack surface is not theoretical — it is already being probed.
OWASP’s guidance, distilled into an operating model, comes down to four disciplines:
Maintain an inventory of every agent, the tools it can call, the datasets it reads, the models it uses and the identities it holds. Unmanaged agents are the new shadow IT.
Scope each agent to the minimum access its task needs, issue short-lived credentials, and re-authorise actions rather than trusting a one-time grant. Behavioural monitoring should flag when an agent acts outside its normal pattern.
Validate the integrity of every tool, plug-in and model before execution — signature checks, allow-lists and provenance, not runtime trust.
Enforce policy at the moment of action, inspect agent memory for injected instructions, and keep a tamper-evident audit trail of what each agent did and why.
Agentic AI will deliver real productivity — and it will do so on top of infrastructure most security programmes have never had to defend. The organisations that win are the ones treating agents as privileged, autonomous identities that require the same rigour as a human employee with admin rights: scoped access, monitored behaviour, verified tooling and a full audit trail.
Next step
A 30-minute call, then a scope document with what is in, what is out and what it costs. No obligation, and no charge for the conversation.
