In short
The OWASP GenAI Security Project publishes agentic-AI guidance that catalogues threats specific to autonomous agents — memory poisoning, tool misuse, privilege compromise, identity spoofing and cascading failures — alongside the OWASP Top 10 for LLM Applications. Together they give enterprises a shared vocabulary and a mitigation checklist for securing agents and their tooling.
Definition
OWASP's work on agentic AI extends its LLM application guidance from model-level risks to systems that act. The agentic material describes threat classes in terms of agent architecture — reasoning, memory, tools, identity and orchestration — and pairs each with practical mitigations rather than abstract principles.
The OWASP Top 10 for LLM Applications remains the entry point for model-level risk, with prompt injection at the top and supply-chain, data-poisoning and excessive-agency entries that translate directly to agents. Read the two together: the Top 10 tells you how manipulation starts, the agentic guidance tells you how it spreads.
OWASP guidance is a floor, not a ceiling. It is deliberately vendor-neutral and does not, for example, define the creation layer — the AI Principals that spawn and train agents — as a first-class asset, which enterprises should add to their own threat models.
Security risks
Memory poisoning
Manipulated entries in short- or long-term memory persist and steer later decisions. OWASP recommends provenance, validation and isolation of memory writes.
Tool misuse
Agents invoke legitimate tools for illegitimate purposes. Mitigations centre on strict tool scoping, parameter validation and execution monitoring.
Privilege compromise
Dynamic role inheritance and over-broad grants let agents exceed intended authority. Mitigations require granular, per-action authorization.
Identity spoofing and impersonation
Agents that share or borrow identities defeat attribution. Mitigations require unique, verifiable agent identity.
Cascading hallucination and failure
Unverified output flows between agents as trusted input. Mitigations include validation gates and confidence thresholds between agents.
Excessive agency
Carried over from the LLM Top 10: capability granted beyond need, with insufficient human oversight of consequential actions.
Examples
Mapping an incident to OWASP classes
An exfiltration via a support agent maps to indirect prompt injection plus tool misuse plus excessive agency — three control gaps, not one.
Using the taxonomy in design review
Each new agent design is walked through the threat list, and every applicable class must have a named enforcement point before launch.
Vendor evaluation
Ask suppliers which OWASP agentic threat classes their product enforces against, and where enforcement physically happens.
Audit evidence
Mapping controls to OWASP classes and NIST AI RMF functions produces defensible documentation for regulators and customers.
Architecture
Threat class to component mapping
Bind each OWASP threat to the concrete component in your stack — memory store, tool broker, identity provider, orchestrator.
Enforcement inventory
For every mitigation, record where it is enforced and what proves it is working.
Coverage gaps register
Track accepted gaps explicitly, with owner and review date, rather than leaving them implicit.
Framework alignment
Cross-map to NIST AI RMF functions and ISO/IEC 42001 clauses so one control set serves multiple obligations.
Creation-layer extension
Add AI Principals as an asset class in your own model, since generic guidance does not yet cover it.
Controls
Adopt the vocabulary
Standard threat names make findings comparable across teams, vendors and auditors.
Assign an enforcement point per threat
A mitigation without a named enforcement component is a wish, not a control.
Validate with red-teaming
Test each threat class against real agents rather than asserting coverage from documentation.
Cross-map to NIST and ISO
Align OWASP mitigations to AI RMF and ISO/IEC 42001 to satisfy governance requirements once.
Extend beyond the checklist
Add creation-layer, lineage and blast-radius controls that generic guidance does not yet require.
Comparison
| Framework | Focus | Best used for |
|---|---|---|
| OWASP LLM Top 10 | Model-level application risk | Design review and developer training |
| OWASP agentic guidance | Agent architecture threats | Threat modelling agentic systems |
| MITRE ATLAS | Observed adversary techniques | Red-teaming and detection engineering |
| NIST AI RMF | Organizational risk management | Programme structure and governance |
| ISO/IEC 42001 | AI management system | Certification and audit evidence |
Frequently asked questions
Is there an official OWASP agentic top 10?
OWASP's GenAI Security Project publishes agentic threat and mitigation guidance alongside the LLM Top 10; check the project site for the current version, as the material is updated frequently.
Does OWASP cover multi-agent systems?
Yes. Cascading failures, inter-agent trust and orchestration risks are treated explicitly in the agentic material.
How does this relate to NIST AI RMF?
OWASP is technical and threat-oriented; NIST AI RMF is organizational and process-oriented. Most enterprises need both.
What does OWASP not cover well yet?
The creation layer. Threats are framed around running agents rather than the Principals that produce and train them.
Sources
How Andeavour addresses it
Threat-class aligned enforcement
AgentGuard controls map to OWASP agentic threat classes, so coverage and gaps can be demonstrated rather than asserted.
Evidence for audit
Traces and policy decisions provide the artifacts auditors ask for under ISO/IEC 42001 and NIST AI RMF.
Beyond the checklist
Principal discovery, lineage tracking and population-scale revocation extend past what current guidance requires.
See it against your own environment
A 30-minute technical session with the Andeavour team — no integration required to start.