OWASP GenAI Security Project · 2026 (published December 2025)
OWASP Top 10 for Agentic Applications: real-world incidents for each item
OWASP built the list from real 2025 incidents. CollectSEA links each risk to documented incidents and to the engineering safeguards that address it, so teams building agents can see the failure before they ship it.
Official OWASP Agentic Top 10- ASI01
Agent Goal Hijack
Instructions hidden in content the agent processes (documents, emails, web pages, issues) change what the agent is trying to do.
- Prompt injection makes GitHub Copilot turn off its own confirmations and run commands (CVE-2025-53773)2025
- Prompt injection in a README plus weak allow-list matching lets Gemini CLI silently run attacker commands (2025)2025
- Hidden instructions in a support ticket make an MCP-connected assistant expose private SQL tables (Supabase MCP, 2025)2025
- EchoLeak: zero-click prompt injection lets a crafted email exfiltrate Microsoft 365 Copilot data (2025)2025
- Prompt injection in a public GitHub issue makes an MCP-connected agent leak private repository data (2025)2025
- ASI02
Tool Misuse and Exploitation
An agent uses legitimate tools in harmful ways because of injected instructions, misalignment or unsafe delegation.
- GitHub Actions injection leaks Nx's npm token; malicious packages use local AI coding tools to hunt for secrets (2025)2025
- Prompt injection makes GitHub Copilot turn off its own confirmations and run commands (CVE-2025-53773)2025
- Prompt injection in a README plus weak allow-list matching lets Gemini CLI silently run attacker commands (2025)2025
- AI coding agent deletes a live production database during a code freeze (Replit, 2025)2025
- EchoLeak: zero-click prompt injection lets a crafted email exfiltrate Microsoft 365 Copilot data (2025)2025
- Prompt injection in a public GitHub issue makes an MCP-connected agent leak private repository data (2025)2025
and 3 more in the linked patterns.
- ASI03
Identity and Privilege Abuse
Agents act with credentials or privileges broader than the task, or inherit a user's authority without enforceable limits.
- GitHub Actions injection leaks Nx's npm token; malicious packages use local AI coding tools to hunt for secrets (2025)2025
- Prompt injection makes GitHub Copilot turn off its own confirmations and run commands (CVE-2025-53773)2025
- Stolen OAuth tokens from the Salesloft Drift integration are used to export data from customers' Salesforce instances (2025)2025
- AI coding agent deletes a live production database during a code freeze (Replit, 2025)2025
- Malicious code committed to the Amazon Q Developer VS Code extension via a compromised token (AWS, 2025)2025
- Hidden instructions in a support ticket make an MCP-connected assistant expose private SQL tables (Supabase MCP, 2025)2025
and 5 more in the linked patterns.
- ASI04
Agentic Supply Chain Vulnerabilities
Compromised tools, extensions, models, prompts or MCP servers that an agent depends on.
- ASI05
Unexpected Code Execution
Agent-generated or agent-fetched code runs without sandboxing or review.
No documented incident in the corpus yet.
- ASI06
Memory and Context Poisoning
Malicious or false content persists in an agent's memory or retrieved context and steers later actions.
- Prompt injection makes GitHub Copilot turn off its own confirmations and run commands (CVE-2025-53773)2025
- Prompt injection in a README plus weak allow-list matching lets Gemini CLI silently run attacker commands (2025)2025
- Hidden instructions in a support ticket make an MCP-connected assistant expose private SQL tables (Supabase MCP, 2025)2025
- EchoLeak: zero-click prompt injection lets a crafted email exfiltrate Microsoft 365 Copilot data (2025)2025
- Prompt injection in a public GitHub issue makes an MCP-connected agent leak private repository data (2025)2025
- ASI07
Insecure Inter-Agent Communication
Messages between agents are spoofed, tampered with or trusted without verification.
No documented incident in the corpus yet.
- ASI08
Cascading Failures
A single fault or bad output propagates through automated steps and amplifies.
- Latent race condition in DNS automation leaves DynamoDB's regional endpoint with an empty record (AWS, 2025)2025
- Third-party storage outage behind Workers KV takes down many Cloudflare services (2025)2025
- New Consul streaming feature under heavy load and a BoltDB issue cause a 73-hour outage (Roblox, 2021)2021
- Valid customer configuration change triggers a latent software bug across a CDN (Fastly, 2021)2021
- Holiday traffic surge overloads a Transit Gateway and stalls autoscaling provisioning (Slack, 2021)2021
- Regular expression in a WAF rule exhausts CPU on every edge server (Cloudflare, 2019)2019
and 8 more in the linked patterns.
- ASI09
Human-Agent Trust Exploitation
People act on confident but wrong agent output, or are manipulated through an agent they trust.
- ASI10
Rogue Agents
An agent acts outside its intended scope or instructions.
- GitHub Actions injection leaks Nx's npm token; malicious packages use local AI coding tools to hunt for secrets (2025)2025
- Prompt injection makes GitHub Copilot turn off its own confirmations and run commands (CVE-2025-53773)2025
- Prompt injection in a README plus weak allow-list matching lets Gemini CLI silently run attacker commands (2025)2025
- AI coding agent deletes a live production database during a code freeze (Replit, 2025)2025
- EchoLeak: zero-click prompt injection lets a crafted email exfiltrate Microsoft 365 Copilot data (2025)2025
- Prompt injection in a public GitHub issue makes an MCP-connected agent leak private repository data (2025)2025
and 2 more in the linked patterns.