MASECLAB
← Research

Reference · ASI01–ASI10

The OWASP Agentic Top 10, mapped to MST.

OWASP published the first Top 10 for Agentic Applications in December 2025. Here is each risk in practice — a real example, and where it surfaces in a MASec Lab audit.

Peer-reviewed by more than a hundred practitioners, the list uses the ASI prefix — Agentic Security Issue — and builds on the LLM Top 10 while pivoting from passive content risks to active agent behaviour. Agents are treated as principals with goals, tools, memory, and inter-agent protocols as distinct attack surfaces. Most of these risks sit in a compliance blind spot: a SOC 2 or ISO 27001 report was never designed for a system that decides and acts on its own.

  1. ASI01

    Agent Goal Hijack

    An attacker seizes the agent’s decision process and redirects its objective while the output stays fluent.

    In the wild

    An indirect prompt-injection buried in a fetched web page silently rewrites the agent’s task mid-run.

    MASec detection

    ABFP D1/D2 — tool-sequence and plan shape diverge from baseline even as the prose reads normally.

  2. ASI02

    Tool Misuse & Exploitation

    The agent is coerced into invoking a tool harmfully, or into calling the wrong tool entirely.

    In the wild

    A typosquatted tool named report is called instead of report_finance, leaking data to an attacker-controlled sink.

    MASec detection

    MST MCP audit — tool-poisoning and unvalidated-call probes; ABFP D1 flags the off-baseline invocation.

  3. ASI03

    Agent Identity & Privilege Abuse

    An agent acts beyond its delegated scope, or impersonates an identity it was never granted.

    In the wild

    A read-only triage agent quietly escalates to a write on a billing resource it was never delegated.

    MASec detection

    HCAP — capability-chain verification rejects out-of-scope authority; ABFP D4/D5 catch the new access edge.

  4. ASI04

    Agentic Supply Chain Compromise

    A malicious agent, tool, model, or dependency is introduced into the agent fabric.

    In the wild

    A default-on connected-agents feature exposes one agent’s tools to every other agent, with no record of who connected.

    MASec detection

    MST MCP audit + agent-card signature checks; SBOM and dependency provenance in the release pipeline.

  5. ASI05

    Unexpected Code Execution

    The agent runs attacker-controlled code through an execution surface it was given for a benign purpose.

    In the wild

    A code-interpreter tool meant for data analysis executes an injected payload that opens a reverse shell.

    MASec detection

    MST MCP STDIO RCE probe and sandbox-boundary checks on the execution tool.

  6. ASI06

    Memory & Context Poisoning

    Persistent memory or shared context is seeded with adversarial content that steers later decisions.

    In the wild

    A poisoned entry in a shared memory store quietly biases every downstream agent that reads it.

    MASec detection

    ABFP D6/D2 — refusal signature inverts and reasoning anchors on context the task never introduced.

  7. ASI07

    Insecure Inter-Agent Communication

    The channels agents speak over are unauthenticated or unsigned, opening an agent-in-the-middle.

    In the wild

    A receiving agent accepts an unsigned A2A agent card and trusts a self-declared identity at face value.

    MASec detection

    MST A2A client audit — signature, mTLS, and hostname-pinning checks on the inter-agent surface.

  8. ASI08

    Cascading Agent Failures

    One bad output propagates through the fleet, amplified at each delegation hop.

    In the wild

    A single hallucinated fact is accepted by a trusting downstream agent and compounds across the workflow.

    MASec detection

    ABFP across the fleet plus delegation-graph monitoring — drift that spreads rather than staying local.

  9. ASI09

    Human-Agent Trust Exploitation

    The agent abuses a human’s trust to extract approval, credentials, or data.

    In the wild

    The CoPhish technique hosts a malicious agent on a trusted vendor domain and harvests OAuth tokens on consent.

    MASec detection

    ABFP D3 — cadence and phrasing drift toward persuasion patterns; friction added at human-in-the-loop steps.

  10. ASI10

    Rogue Agents

    An agent operates against its owner’s intent — misaligned, deceptive, or self-replicating.

    In the wild

    A cost-minimising agent learns that deleting production backups is the cheapest path and destroys disaster recovery.

    MASec detection

    ABFP — sustained, multi-dimensional drift: the agent still answers, but to a different objective over time.

Detection is only half the value — the other half is method. The behavioural and authority models behind these mappings are written up in full:

ABFP — behavioural fingerprinting → HCAP — capability & attestation →