OWASP Agentic AI Threats: The 15 Agentic Threat Classes Explained
Try it live
Watch Agentshield block an attack in real time.
Pick a scenario and drive the inspection lane yourself. No signup needed.
Run a request
Inspection lane
INSPECTINGPolicy trace
High-risk action held for approval
Audit trail
- § · → → →
OWASP's Agentic Security Initiative published Agentic AI: Threats and Mitigations in February 2025, cataloging fifteen threat classes, labeled T1 through T15, that are specific to autonomous AI agents. It is a companion to the OWASP Top 10 for LLM Applications, not a replacement. The LLM Top 10 covers risks in a model and its prompt. The agentic list covers what changes once that model can plan, remember, call tools, hold credentials, and coordinate with other agents. Those capabilities open failure modes a single-turn chatbot never had.
If you are shipping agents to production, this taxonomy is the most useful threat checklist available, because it is organized around agent behavior rather than model internals. Below is the full list with a plain description of each threat and the control that addresses it, followed by how it connects to the LLM Top 10 you may already be tracking.
What is the OWASP Agentic Security Initiative?
The Agentic Security Initiative is a working group inside the OWASP GenAI Security Project focused on the security of autonomous and multi-agent systems. Its first guide, Agentic AI: Threats and Mitigations, defines a reference threat model for agents and enumerates fifteen threats with recommended mitigations. In December 2025 OWASP followed with a separate, prioritized Top 10 for Agentic Applications benchmark. The two are related but distinct: the fifteen-threat catalog is the broad reference, and the Top 10 is a ranked subset meant for benchmarking. This article covers the fifteen-threat reference model.
The 15 OWASP agentic AI threats
Each threat below is paired with the control that most directly reduces it. The pattern across the table is consistent: agents fail when they hold too much standing power, trust too much of their input, or act without a trace.
| ID | Threat | What it means | Primary control |
|---|---|---|---|
| T1 | Memory Poisoning | Malicious or false data is written into the agent's memory and corrupts later decisions, persisting across sessions | Validate and scope what enters memory, isolate per-user context |
| T2 | Tool Misuse | The agent is manipulated into abusing its own integrated tools through deceptive input | Least-privilege tool permissions, per-action authorization |
| T3 | Privilege Compromise | Excessive or misconfigured permissions are exploited to escalate access | Scoped credentials per agent, no standing admin |
| T4 | Resource Overload | Compute, memory, or API quotas are exhausted to degrade or deny service | Rate and spend limits, quotas per identity |
| T5 | Cascading Hallucination | False output is generated and then propagated as fact through the agent chain | Ground outputs, verify before acting on generated claims |
| T6 | Intent Breaking and Goal Manipulation | The agent's objective or plan is hijacked and redirected | Injection inspection on untrusted input, action limits |
| T7 | Misaligned and Deceptive Behaviors | The agent pursues harmful goals or deceives to reach them | Behavioral monitoring, approval gates on high-risk actions |
| T8 | Repudiation and Untraceability | Weak logging means actions cannot be traced or attributed after the fact | Immutable, attributed audit trail of every action |
| T9 | Identity Spoofing and Impersonation | An attacker impersonates an agent or user to gain trust or access | Distinct identity per agent, strong authentication |
| T10 | Overwhelming Human-in-the-Loop | Reviewers are flooded with approvals until fatigue produces rubber-stamping | Reserve human approval for genuinely high-risk actions only |
| T11 | Unexpected Code Execution (RCE) | The agent is induced to execute attacker-supplied code | Sandbox execution, restrict code and shell tools |
| T12 | Agent Communication Poisoning | Messages between agents are tampered with to spread bad instructions | Authenticate and validate inter-agent messages |
| T13 | Rogue Agents | A malicious or compromised agent operates inside a multi-agent system | Per-agent identity, isolation, and monitoring |
| T14 | Human Attacks on Multi-Agent Systems | Adversaries exploit inter-agent delegation and trust to escalate | Enforce permissions at each hop, not just the entry point |
| T15 | Human Manipulation | A user's trust in the agent is exploited to coerce harmful actions | Constrain agent authority, keep humans accountable for actions |
How the agentic threats map to the OWASP LLM Top 10
The two lists overlap at one hinge: LLM06 Excessive Agency in the 2025 LLM Top 10. OWASP breaks LLM06 into three root causes, excessive functionality, excessive permissions, and excessive autonomy, and those three causes are exactly what turn a model risk into an agent risk. Excessive permissions feeds T2 Tool Misuse and T3 Privilege Compromise. Excessive autonomy feeds T6 Goal Manipulation and T7 Misaligned Behavior. OWASP's own guidance is that tool-calling and agentic systems should weight LLM06 Excessive Agency, LLM03 Supply Chain, and LLM10 Unbounded Consumption most heavily.
Prompt injection, LLM01, is still the most common trigger. In an agent it does not stay a text problem: an injected instruction becomes T6 goal manipulation or T2 tool misuse, because the agent acts on what it read. That is why our separate write-up on indirect prompt injection matters for agent security specifically, and why the OWASP LLM Top 10 and the agentic list are best read together.
Is there an OWASP Top 10 for AI agents?
Yes, as of December 2025 OWASP published a Top 10 for Agentic Applications, a ranked benchmark distinct from the earlier fifteen-threat Agentic AI: Threats and Mitigations reference. The fifteen-threat catalog, published February 2025, is the broader model and the one this article details. If you see people cite an OWASP agentic Top 10 and an OWASP agentic fifteen-threat list, both are real and both come from the same OWASP Agentic Security Initiative. Use the fifteen threats to think through coverage and the Top 10 to prioritize.
How to defend against agentic threats
Fifteen threats collapse into a much shorter list of controls, because most of them share a root cause. Read down the control column above and the same handful of defenses keep recurring. Group them and the program becomes tractable:
- Contain the input. Inspect untrusted content, documents, web pages, retrieved chunks, tool outputs, before the agent acts on it. This blunts T1, T6, and T12, the threats that ride in on data.
- Scope the power. Give each agent its own identity and the minimum tools and data it needs, so T2, T3, and T13 have little to reach. Even a recruiting agent that screens inbound resumes can be steered by a crafted document, so its blast radius, not just its intent, is what you control.
- Gate the dangerous actions. Route irreversible or high-impact actions through a human, but only those, so T10 fatigue does not undo T7 and T15 protection.
- Record everything. An immutable, attributed trail is the direct answer to T8, and the evidence base for detecting T7 and T13.
Those controls are the substance of runtime agent security. Input inspection is prompt injection protection, scoping is tool and data permissions, gating is human approval, and the trail is an immutable audit trail. The strategy that ties them together is agentic AI security.
The takeaway
The OWASP agentic threats exist because an agent is not a chatbot: it remembers, acts, holds credentials, and talks to other agents, and each of those adds a way to fail. You do not need fifteen separate defenses. Inspect what the agent reads, scope what it can do, gate the actions you cannot undo, and record every step immutably. Agentshield enforces those four at the point each action runs, mapping cleanly onto the OWASP agentic model. Start with agentic AI security.
See the firewall block an attack live.
Drive the Threat Console and watch a real prompt injection get stopped, then put Agentshield in front of your own agents.
Keep reading