OWASP's taxonomy points away from the model and toward the environment
Twenty named risks across two OWASP lists describe how agents fail, and their convergent remediation advice is environment design, not prompting. The LLM Top 10 (2025 edition, published November 2024) names ten model-level failure modes: prompt injection, excessive agency, supply chain, and seven more. The Top 10 for Agentic Applications (version 2026, released December 9, 2025) adds ten agent-specific risks, ASI01 through ASI10, written by 100+ contributors to OWASP's Agentic Security Initiative. Every incident in this section's casebook lands in one or both lists.
The IDs are the shared vocabulary between your security review, your vendor questionnaire, and your auditor. Read the per-risk mitigations and they keep arriving at least privilege, mediation outside the model, human gates, and sandboxed execution.
The LLM list names the root causes
The 2025 LLM Top 10 covers ten risks: prompt injection (LLM01), sensitive information disclosure (LLM02), supply chain (LLM03), data and model poisoning (LLM04), improper output handling (LLM05), excessive agency (LLM06), system prompt leakage (LLM07), vector and embedding weaknesses (LLM08), misinformation (LLM09), and unbounded consumption (LLM10). Three of them do almost all the work in the casebook.
Prompt injection (LLM01). This is the one OWASP concedes cannot be fully prevented. Their own words: "Given the stochastic influence at the heart of the way models work, it is unclear if there are fool-proof methods of prevention for prompt injection." The list splits it into direct injection (the user attacks the model) and indirect injection (content the model reads attacks the model). Indirect is the one that matters for engineering agents, because an agent reads issues, PRs, emails, and web pages all day. That concession is why this handbook treats injection as a given and builds on containment instead; see breaking the chain.
Excessive agency (LLM06). This names the damage multiplier. OWASP traces it to three root causes: excessive functionality, excessive permissions, excessive autonomy. Notice what the listed mitigations are: minimize extensions, minimize permissions, execute in the user's context, require human approval for high-impact actions, enforce authorization downstream rather than asking the model. Those are environment and process controls, not prompts.
LLM03, supply chain, covers compromised dependencies, models, and registries, and is the parent of the two supply-chain incidents below.
The agentic Top 10 names what agents add
The LLM list treats the model as the system. The agentic list treats the loop as the system: tool use that acts on the real world, multi-step reasoning that compounds a single injection, and inter-agent communication over MCP and A2A. That delta is the stated reason a separate list exists.
| ID | Name | One-line version |
|---|---|---|
| ASI01 | Agent Goal Hijack | The agent's objective is redirected via prompts, tool outputs, or poisoned data; agents cannot reliably distinguish instructions from content |
| ASI02 | Tool Misuse and Exploitation | Legitimate tools, within authorized privileges, driven to exfiltration or escalation |
| ASI03 | Identity and Privilege Abuse | Delegation chains and inherited credentials exploited; root cause is "the architectural mismatch between user-centric identity systems and agentic design" |
| ASI04 | Agentic Supply Chain Vulnerabilities | Compromised tools, models, MCP/A2A interfaces, registries, and update channels, including dynamically sourced components |
| ASI05 | Unexpected Code Execution (RCE) | Real-time code generation and execution, "including popular vibe coding tools," turns text into unintended executable behavior |
| ASI06 | Memory & Context Poisoning | Persistent memory, summaries, and RAG stores seeded so future reasoning goes wrong |
| ASI07 | Insecure Inter-Agent Communication | Agent messages spoofed, intercepted, or manipulated across transport and discovery |
| ASI08 | Cascading Failures | One fault propagates across autonomous agents past stepwise human checks |
| ASI09 | Human-Agent Trust Exploitation | The agent as "untraceable bad influence": the human performs the final, audited action |
| ASI10 | Rogue Agents | Compromised or misaligned agents whose individually legitimate actions sum to harm |
ASI09 deserves a second read. The risk is not that the agent acts; it is that the agent persuades a human to act, which hides the agent from forensics. Attribution and audit controls that only log agent actions miss it.
The casebook maps onto the IDs
Each incident page in this section's casebook is an instance of two or three IDs, not a novel category. The mapping below is ours, as an inference from the published write-ups; OWASP's own Appendix D ships an Agentic Exploits & Incidents Tracker doing the same exercise. The seven incidents, each graded prevent, contain, or detect, are indexed in what the incidents teach.
| Incident | Primary IDs |
|---|---|
| Replit production database deletion (2025) | LLM06 (excessive autonomy), ASI02 |
| EchoLeak, CVE-2025-32711 (2025) | LLM01 (indirect injection), ASI01 |
| GitHub MCP private-repo exfiltration (2025) | LLM01, ASI02 (a chain of legitimate tool calls) |
| Nx s1ngularity (2025) | LLM03, ASI04, plus ASI02 once the malware drove installed AI CLIs |
| Slopsquatting (2025) | LLM03, ASI04 |
| Comment and Control (2026) | LLM01, ASI05 (PR title to RCE) |
What the taxonomy buys, and what it does not
A shared ID compresses an argument. "This tool combination is an ASI02 risk" travels through a security review faster than three paragraphs, and the lists are already wired into assurance work: OWASP published an AIUC-1 crosswalk for the agentic Top 10 on May 25, 2026, which connects these IDs to the audit framework covered in AIUC-1.
What the lists do not give you is a deployable control set. They are vendor-neutral by design, and their per-risk mitigation sections enumerate options rather than prescribe an architecture. The convergent advice across both lists, least privilege, mediation outside the model, human gates on high-impact actions, sandboxed execution, is exactly the environment this section builds: sandboxing for ASI05, egress control and scoped credentials for ASI02 and ASI03, tools kept simple for LLM06. For the single test that predicts most of these failures before you need twenty categories, start with the lethal trifecta.