OWASP Top 10 for Agentic Applications: the multi-agent risks explained

The ten risks at a glance

The list is a voluntary threat taxonomy, not a compliance standard. Read the official OWASP resource for the authoritative text; this summary groups the risks by where they occur.

• ASI01 Agent Goal Hijack — an attacker redirects the agent's objective, usually through content it reads.
• ASI02 Tool Misuse & Exploitation — legitimate tools used unsafely, in loops, or at excessive volume.
• ASI03 Identity & Privilege Abuse — unclear agent identity or misused delegated authority.
• ASI04 Agentic Supply Chain Vulnerabilities — compromised third-party agents, tools, schemas, or prompts.
• ASI05 Unexpected Code Execution — agent-generated or agent-triggered code run without isolation.
• ASI06 Memory & Context Poisoning — injected memory that keeps shaping future behavior.
• ASI07 Insecure Inter-Agent Communication — messages between agents intercepted, forged, or altered.
• ASI08 Cascading Failures — a fault spreading through connected agents, tools, and trust chains.
• ASI09 Human-Agent Trust Exploitation — people over-trusting confident agent output.
• ASI10 Rogue Agents — agents operating outside their intended behavior.

The risks that are population problems

ASI07, ASI08, and ASI10 cannot be fully assessed by looking at one agent. Insecure communication is about the channel between agents; cascades are about how impact travels; and a rogue agent is often recognised by how its behavior diverges from, or spreads into, the rest of the population.

Others gain a population dimension at scale. Memory poisoning (ASI06) becomes a propagation problem when agents share memory stores; tool misuse (ASI02) and privilege abuse (ASI03) become coordinated boundary pressure when many agents probe the same control.

Mapping detection to the list

Inwom focuses on the population layer. It provides evidence for ASI07 by reconstructing explicit and indirect communication paths, for ASI08 by tracing how behavior propagates through a population, and for ASI10 by surfacing agents whose behavior diverges from expected automation or begins to influence others.

Per-agent controls — guardrails for ASI01, sandboxing for ASI05, supply-chain provenance for ASI04, human confirmation for ASI09 — remain essential and are complementary.