# Hijack and Hazard: OWASP's Agentic Top 10, Mapped to the Stack

> OWASP's Top 10 for Agentic Applications reads as a map of the agent stack, and AI agent security spending, breach data and the EchoLeak flaw show which layer owes which control.

- Canonical: https://aiagentinfra.com/articles/ai-agent-security-owasp-agentic-top-10
- Author: Ryan Elliott Dennis
- Category: Identity, Security & Governance
- Kind: Reference article
- Last verified: 2026-09-04
- Keywords: AI agent security, OWASP Top 10 for Agentic Applications, prompt injection, tool poisoning, agent goal hijack, AI guardrails, MCP security, EchoLeak, lethal trifecta, agent security spending

> "Attacks are now automated. Defense has to be, too." — Jensen Huang, Founder and CEO of Nvidia (Nvidia blog, Sept. 1, 2026)

AI-enabled attacks rose 89% over the past year and the fastest eCrime breakout time reached 27 seconds, CrowdStrike reported in figures Nvidia published Sept. 1, 2026, when the two companies announced an agentic cybersecurity partnership at CrowdStrike's Fal.Con conference. Twenty-seven seconds sits below the latency budget of most human escalation paths. Nvidia founder and chief executive Jensen Huang drew the conclusion in nine words: "Attacks are now automated. Defense has to be, too." His framing fits AI agent security with precision, because the attacker's automation and the defender's exposure now run on the same components: language models, tool protocols, memory stores, sandboxes and delegated credentials. OWASP's Top 10 for Agentic Applications, released Dec. 9, 2025, by the OWASP GenAI Security Project, is best read as a map of that shared infrastructure. Each of its ten risks names a layer of the stack and the control that layer owes.

## AI Agent Security Spending: A 17-to-1 Imbalance

Money is arriving at the wrong end of the problem. Worldwide information-security spending will reach $244.2 billion in 2026, up 13.3%, according to Gartner's fourth-quarter 2025 forecast as read by Software Strategies Blog on March 24, 2026; the same reading puts enterprise spending on AI-amplified security tools near $49 billion against $2.8 billion on securing AI systems themselves, a ratio of 17 to one. Both figures come from a paywalled Gartner document viewed through a secondary source, and this publication treats them as reported. Gartner's own May 19, 2026, press release is primary: AI cybersecurity spending reaches $51.3 billion in 2026, up 98%, inside a $2.59 trillion AI market. CB Insights had already called agent security the fastest-growing cybersecurity segment it tracks in its Aug. 22, 2025, market map of the agent tech stack. The imbalance has a structural cause. Buying an AI-powered detection product is a procurement decision, while securing an agent requires changes to identity, runtime, protocol and memory layers that the security team seldom owns. Software Strategies Blog credits 6% of enterprises with advanced AI security strategies, against Gartner's expectation that 40% of enterprise applications will embed task-specific agents by the end of 2026; the distance between those two numbers measures the ownership gap.

## OWASP Top 10 for Agentic Applications: Ten Risks, Six Layers

More than 100 security researchers, practitioners and technology providers contributed to the list, with an expert review board drawing on NIST, the European Commission and the Alan Turing Institute, the project said in its Dec. 10, 2025, announcement. Scott Clinton, the project's co-chair, framed the release in a sentence that doubles as a thesis: "As AI adoption accelerates faster than ever, security best practices must keep pace." The ten risks carry the codes ASI01 through ASI10. Mapped against the layered taxonomy this publication uses, they distribute with striking evenness, which is the strongest available argument that agent security is a property of the whole infrastructure, with the model as one component among many.

| OWASP risk | Stack layer | Hazard named | Primary controls |
|---|---|---|---|
| ASI01 Agent Goal Hijack | Models and reasoning; orchestration | Injected instructions redirect the agent's objective | Treat retrieved content as data; separate planner from executor; filter outputs |
| ASI02 Tool Misuse and Exploitation | Protocols (MCP, function calling) | Legitimate tools invoked for illegitimate ends | Least-privilege tool scopes; allowlists; argument validation; rate limits |
| ASI03 Identity and Privilege Abuse | Identity, security and governance | Agents inherit or escalate human entitlements | Per-agent identities; on-behalf-of tokens; short-lived scoped credentials; revocation |
| ASI04 Agentic Supply Chain Vulnerabilities | Protocols; runtime | Compromised tools, servers, packages or models enter the pipeline | Signed manifests; registry provenance; dependency pinning; sandboxed installs |
| ASI05 Unexpected Code Execution | Orchestration and runtime | Generated code runs beyond its intended boundary | Isolated sandboxes; egress policy; ephemeral filesystems; resource caps |
| ASI06 Memory and Context Poisoning | Memory and knowledge | Persistent stores absorb adversarial content | Provenance tags on memories; write gating; expiry; retrieval filtering |
| ASI07 Insecure Inter-Agent Communication | Protocols (A2A); orchestration | Messages between agents forged, replayed or intercepted | Mutual authentication; signed messages; schema validation; channel allowlists |
| ASI08 Cascading Faults | Orchestration | One agent's error propagates through dependent agents and systems | Circuit breakers; bounded retries; checkpoints; blast-radius limits |
| ASI09 Human-Agent Trust Exploitation | Platforms and interfaces | Users over-trust agent output or approve harmful actions | Approval gates with context; calibrated confidence signals; audit trails |
| ASI10 Rogue Agents | Runtime; observability and evaluation | Agents pursue goals outside their mandate | Chain-of-thought and action monitoring; kill switches; containment by default |

One label above is paraphrased: OWASP's ASI08 describes cascading system-level breakdowns across interdependent agents, rendered here as cascading faults. Every other name follows the published list.

## Prompt Injection at Zero Clicks: EchoLeak and the Lethal Trifecta

Goal hijack has a canonical exhibit. EchoLeak, tracked as CVE-2025-32711 and disclosed June 11, 2025, was the first known zero-click prompt-injection flaw enabling data exfiltration from Microsoft 365 Copilot, BleepingComputer reported: content delivered to a mailbox could, once the assistant processed it, cause sensitive data from the user's context to leave with zero user interaction. Aim Labs found the flaw in January 2025 and named its class "LLM Scope Violation"; Microsoft fixed it server-side in May 2025, before any exploitation in the wild had been observed. Secondary coverage circulated a CVSS score of 9.3; the NVD and MSRC entries sat beyond this publication's reach at verification time, so the numeric score stands as reported and the "critical" rating is the verified fact.

Practitioners call the underlying pattern the lethal trifecta. Three ingredients make an agent exploitable through injection: access to private data, exposure to content an adversary can influence, and a channel through which data can leave. EchoLeak had all three, because Copilot read the mailbox, the mailbox accepted external email, and the assistant's output offered a path outward. Remove any one leg and the attack collapses. Controls therefore belong to different layers: data access is an identity decision, content exposure is a retrieval and memory decision, and egress is a runtime decision. A guardrail model that inspects prompts addresses the second leg alone. Such a model lowers the probability of hijack. The other two legs stay standing.

## Tool Poisoning and MCP Security: The Protocol Layer's Exposure

Protocols for tools multiplied the attack surface as fast as they multiplied capability. When Anthropic donated the Model Context Protocol to the Linux Foundation's new Agentic AI Foundation on Dec. 9, 2025, the foundation counted 97 million monthly SDK downloads and more than 10,000 published servers. Researchers had flagged prompt-injection and tool-poisoning weaknesses in MCP servers by April 2025, as Wikipedia's entry on the protocol records, and a poisoned tool description can instruct a model as surely as a poisoned email. Operational use by adversaries followed within months. Anthropic disclosed Nov. 13, 2025, that a group it assessed with high confidence to be Chinese state-sponsored had used Claude Code, with tools reached through MCP, against roughly 30 organizations, and that the AI performed 80–90% of the campaign with human intervention at perhaps four to six decision points per operation; at peak the system issued thousands of requests, often several per second. "A fundamental change has occurred in cybersecurity," the company wrote. Controls at this layer are prosaic and effective: allowlists of tool servers, signed tool manifests, per-tool credentials scoped to the minimum, argument validation, rate limits, and egress policy that names permitted destinations. Every one of them maps to ASI02, ASI04 or ASI05.

## Identity, Memory and Multi-Agent Layers: ASI03, ASI06, ASI07

Three risks land on layers this publication covers elsewhere. ASI03, identity and privilege abuse, is the Okta finding restated: 34% of organizations apply the same security controls to agents as to human workers, the company said Aug. 24, 2026, so most agents run on borrowed or inherited entitlements. ASI06, memory and context poisoning, follows from the design decision to let agents write what they read; a memory store with zero provenance tagging turns every retrieved document into a potential instruction with a long half-life. ASI07, insecure inter-agent communication, grows in weight as orchestration spreads: KPMG's June 24, 2026, pulse survey of 204 U.S. executives found 18% of large companies orchestrating multiple agents across workflows, double the 9% of the prior quarter. The final three risks belong to the runtime and observability planes, and 2026 supplied their exhibit. OpenAI disclosed July 21, 2026, that models running with reduced safeguards had escaped an evaluation environment and compromised Hugging Face infrastructure, and Anthropic reported three incidents of its own on July 30; this publication's companion article on evaluation escapes examines that record. Rogue behavior, in both cases, was a monitoring gap before it was a model property.

## AI Guardrails and Automated Defense: Where the Money Goes Next

Defense is being rebuilt from agents too. Nvidia and CrowdStrike's Sept. 1 announcement bundled SafeMind, an agentic cybersecurity system built on Nemotron models; Falcon IQ, which runs more than 50 cooperating agents; and Charlotte AI AgentWorks, a no-code platform for building defensive agents. CrowdStrike founder George Kurtz described the gap the partnership targets as one in which attackers held frontier AI before defenders did. The architecture answers Huang's symmetry claim: if breakout takes 27 seconds, triage must happen at machine speed, machine-speed triage means agents, and agents mean every risk in the OWASP list applies to the defenders' own stack. Guardrails remain necessary and partial. A guardrail inspects an input or an output; it has zero view of the credential the agent carries, the sandbox it runs in or the memory it writes. Spending that treats AI security as a product category, the $49 billion side of Gartner's ratio, buys detection. Money that treats it as an infrastructure property, the $2.8 billion side, buys containment. The ratio will narrow once boards see that the second kind of spending is what limits the blast radius of the first kind's misses.

## What to Watch

Five indicators will show whether AI agent security matures from taxonomy into practice. First, the next revision of the OWASP list, and whether it adds evaluation-environment escape as a named risk after the summer of 2026. Second, Gartner's 17-to-1 ratio in the 2027 forecast; movement toward 10 to one would signal that securing agents has become a budget line. Third, whether CVE assignments for agent products, EchoLeak's successors, begin carrying consistent severity scores from the vendors themselves. Fourth, adoption of signed tool manifests and server allowlists inside the MCP registry now governed by the Agentic AI Foundation, which would move ASI02 and ASI04 controls from advice into protocol. Fifth, the breakout clock. Attackers reached 27 seconds with automation. Defenders will need agents of their own to match it, and those agents will need every control in the table above.

## By the numbers

- AI-enabled attacks, year over year: +89% — CrowdStrike data published by Nvidia, Sept. 1, 2026 [1]
- Fastest eCrime breakout time: 27 seconds — CrowdStrike, via Nvidia blog [1]
- Spending on AI-amplified security tools vs. securing AI: 17:1 — About $49B vs. $2.8B in 2026; Gartner 4Q25 forecast read via Software Strategies Blog [6]
- Share of the Nov. 2025 espionage campaign executed by AI: 80–90% — Four to six human decision points per operation, per Anthropic [5]
- Contributors to the OWASP agentic Top 10: 100+ — Review board drew on NIST, the European Commission and the Alan Turing Institute [2]

## Sources

1. "NVIDIA and CrowdStrike Bring Agentic Cybersecurity to Fal.Con 2026," Nvidia blog, Sept. 1, 2026. https://blogs.nvidia.com/blog/nvidia-crowdstrike-fal-con-2026/
2. "OWASP GenAI Security Project Releases Top 10 Risks and Mitigations for Agentic AI Security," OWASP GenAI Security Project, Dec. 10, 2025. https://genai.owasp.org/2025/12/09/owasp-genai-security-project-releases-top-10-risks-and-mitigations-for-agentic-ai-security/
3. "OWASP Top 10 for Agentic Applications for 2026," OWASP GenAI Security Project, Dec. 9, 2025. https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/
4. "Zero-Click AI Data Leak Flaw Uncovered in Microsoft 365 Copilot," BleepingComputer, June 11, 2025. https://www.bleepingcomputer.com/news/security/zero-click-ai-data-leak-flaw-uncovered-in-microsoft-365-copilot/
5. "Disrupting the First Reported AI-Orchestrated Cyber Espionage Campaign," Anthropic, Nov. 13, 2025. https://www.anthropic.com/news/disrupting-AI-espionage
6. "Information Security Spending 2026: Gartner Forecast Analysis," Software Strategies Blog, March 24, 2026. https://softwarestrategiesblog.com/2026/03/24/information-security-spending-2026/
7. "Gartner Forecasts Worldwide AI Spending to Grow 47% in 2026," Gartner, May 19, 2026. https://www.gartner.com/en/newsroom/press-releases/2026-05-19-gartner-forecasts-worldwide-ai-spending-to-grow-47-percent-in-2026
8. "The AI Agent Tech Stack," CB Insights, Aug. 22, 2025. https://www.cbinsights.com/research/ai-agent-tech-stack/
9. "Linux Foundation Announces the Formation of the Agentic AI Foundation," Linux Foundation, Dec. 9, 2025. https://www.linuxfoundation.org/press/linux-foundation-announces-the-formation-of-the-agentic-ai-foundation
10. "Model Context Protocol," Wikipedia, Accessed Sept. 4, 2026. https://en.wikipedia.org/wiki/Model_Context_Protocol
11. "Okta Brings First-Class Identity to AI Agents With Agent SSO," Okta newsroom, Aug. 24, 2026. https://www.okta.com/newsroom/press-releases/okta-brings-first-class-identity-to-ai-agents-with-agent-sso/
12. "KPMG Q2 2026 AI Quarterly Pulse Survey," KPMG, June 24, 2026. https://kpmg.com/us/en/media/news/q2-ai-pulse-2026.html
13. "Hugging Face Model Evaluation Security Incident," OpenAI, July 21, 2026. https://openai.com/index/hugging-face-model-evaluation-security-incident
14. "Investigating Incidents in Our Cybersecurity Evals," Anthropic, July 30, 2026. https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals