Agent security

Agents read text written by strangers and then act with your credentials. This page sets out the core rule, both 2026 OWASP lists, the incidents so far and the defences that would have stopped them.

Recent incidents

• Jun 5, 2026 MCP Python SDK session hijack and cross-session task access
• Jun 2026 Claude Code WebFetch auto-approval let data out via huggingface.co
• Apr 15, 2026 Comment and Control: PR text steals secrets from CI agents
• Feb 4, 2026 MCP TypeScript SDK leaked responses between clients
• Feb 1, 2026 ClawHavoc: hundreds of malicious ClawHub skills spread AMOS

OWASP Top 10 for Agentic Applications 2026

The OWASP GenAI Security Project published this list on December 9, 2025. It covers the risks that appear once a model plans, keeps memory, calls tools and works alongside other agents.

1. ASI01
   Agent Goal Hijack

   An attacker changes what the agent is trying to achieve, usually through instructions hidden in content it reads. The agent then pursues the attacker's goal with the user's tools and permissions.

2. ASI02
   Tool Misuse and Exploitation

   The agent uses legitimate tools in harmful ways, such as deleting records, sending messages or chaining calls, because it was manipulated or holds tools broader than the task requires.

3. ASI03
   Identity and Privilege Abuse

   Agents act through credentials, delegated tokens and inherited permissions. Attackers abuse those identities, or the gaps between them, to escalate privileges or act as someone else.

4. ASI04
   Agentic Supply Chain Vulnerabilities

   Tools, MCP servers, skills, plugins, models and prompts loaded at build time or run time can be malicious or compromised. Because agents load many of them dynamically, one bad component reaches every session that uses it.

5. ASI05
   Unexpected Code Execution (RCE)

   Agents that write and run code, or hand model output to shells and interpreters, can be steered into running commands the attacker chose on the host.

6. ASI06
   Memory & Context Poisoning

   Attackers plant false facts or instructions in an agent's memory, retrieved documents or saved context. The poison persists and shapes later sessions long after the original input is gone.

7. ASI07
   Insecure Inter-Agent Communication

   Messages between agents travel without proper authentication, integrity checks or validation, so they can be spoofed, replayed or altered to mislead the agent that receives them.

8. ASI08
   Cascading Failures

   One fault, such as a poisoned input, a bad tool result or a compromised agent, spreads through connected agents and automated steps faster than people can catch it.

9. ASI09
   Human-Agent Trust Exploitation

   Agents sound confident and helpful, so people tend to approve what they propose. Attackers use that trust to get a human to confirm a harmful action or reveal information.

10. ASI10
    Rogue Agents

    An agent that has been compromised or has drifted from its intended behaviour keeps acting on its own, outside the scope and oversight it was given.

OWASP Top 10 for LLM Applications 2026

This edition was published on August 4, 2026 and replaces the 2025 list. Excessive Agency rose from sixth to third place, and System Prompt Leakage was renamed Hidden Context Exposure.

1. LLM01
   Prompt Injection

   Input alters the model's behaviour in ways the developer did not intend. It can come straight from the user or indirectly from documents, web pages and tool results the model reads.

2. LLM02
   Sensitive Information Disclosure

   The model or application reveals personal data, credentials, business secrets or other confidential material in its output, drawn from training data, context or connected systems.

3. LLM03
   Excessive Agency

   The application gives the model more functions, permissions or autonomy than the task needs, so a manipulated or mistaken output causes real damage. It moved from sixth place in 2025 to third in 2026.

4. LLM04
   Supply Chain

   Third-party models, datasets, adapters, packages and plugins can be tampered with or vulnerable, and they carry that risk into your application.

5. LLM05
   Data and Model Poisoning

   Attackers manipulate pre-training, fine-tuning or embedding data to plant backdoors, biases or faulty behaviour that only surfaces later in production.

6. LLM06
   Unbounded Consumption

   Without limits on requests, input size or compute, attackers can run up your bill, exhaust resources or copy a model through high-volume queries.

7. LLM07
   Misinformation

   The model produces false or misleading output that looks credible, and users or downstream systems act on it without checking.

8. LLM08
   Hidden Context Exposure

   Formerly System Prompt Leakage. System prompts, hidden instructions and other context the user is not meant to see can be extracted, exposing the rules, logic or secrets placed there.

9. LLM09
   Vector and Embedding Weaknesses

   Flaws in how embeddings are generated, stored and retrieved let attackers inject content, leak data across tenants or recover source text, which hits RAG systems hardest.

10. LLM10
    Improper Output Handling

    Model output reaches browsers, shells, databases or other components without validation or encoding, which opens the way to XSS, SQL injection, code execution and data exfiltration.

Defences

Fifteen documented defences, each linked to its source. Layer several of them, because none stops every attack on its own.