Summary: The OWASP Agentic Security Initiative’s threat table — seventeen threats to agentic AI systems, each with a description, mitigation direction, and (where one exists) a mapping back to the OWASP Top 10 for LLM Applications.
Sources: raw/Agentic/Agentic-AI-Threats-and-Mitigations-1.1.pdf
Last updated: 2026-07-29
This is the reference table the rest of the collection hangs off. Threat IDs are stable and used throughout OWASP’s own material, so cite them as T1…T17 rather than by name.
The seventeen threats
| TID | Threat | One-line | LLM Top 10 relation |
|---|---|---|---|
| T1 | Memory Poisoning | Corrupting short- or long-term memory to alter later decisions | Extends LLM04, LLM08 |
| T2 | Tool Misuse | Manipulating an agent into abusing tools it is authorised to use | Partially LLM06; also LLM03, LLM08 |
| T3 | Privilege Compromise | Exploiting dynamic role inheritance and permission misconfiguration | Partially LLM06 |
| T4 | Resource Overload | Exhausting compute, memory or service quota to degrade the agent | Related to LLM10 |
| T5 | Cascading Hallucination Attacks | False output propagating and amplifying through memory and agents | Extends LLM09 |
| T6 | Intent Breaking & Goal Manipulation | Rewriting the agent’s planning, reasoning and self-evaluation | Extends LLM01 |
| T7 | Misaligned & Deceptive Behaviors | Harmful action from advanced reasoning, not from error or injection | — none — |
| T8 | Repudiation & Untraceability | Agent actions that cannot be traced or attributed | — none — |
| T9 | Identity Spoofing & Impersonation | Impersonating an agent, user or service; agent-identity theft | — none — |
| T10 | Overwhelming Human in the Loop | Exploiting reviewer cognitive limits to force rushed approvals | — none — |
| T11 | Unexpected RCE and Code Attacks | Injecting into AI-generated execution environments | Distinct from LLM01, LLM05 |
| T12 | Agent Communication Poisoning | Manipulating inter-agent channels to corrupt shared knowledge | Beyond LLM04, LLM08 |
| T13 | Rogue Agents in Multi-Agent Systems | Compromised agents operating outside monitoring boundaries | Adversarial exploitation of LLM06 |
| T14 | Human Attacks on Multi-Agent Systems | Exploiting delegation and trust chains to escalate privilege | — none — |
| T15 | Human Manipulation | Exploiting user trust in the agent to steer the human | — none — |
| T16 | Insecure Inter-Agent Protocol Abuse | Attacking MCP / A2A: consent bypass, context hijacking | — none — |
| T17 | Supply Chain Compromise | Poisoned prompts, plugins, tool metadata, framework updates | LLM03 amplified |
(source: Agentic-AI-Threats-and-Mitigations-1.1.pdf, pp. 16–19)
Seven of seventeen have no Top 10 counterpart
T7, T8, T9, T10, T14, T15 and T16 are named against no OWASP Top 10 entry in the document. They cluster into three groups, and the grouping is the interesting part:
- Emergent-behaviour threats (T7) — harm arising from the reasoning itself. The document is explicit that this “is distinct from hallucinations, as the behavior emerges from advanced reasoning capabilities rather than just random error or prompt failure,” and concedes the threat “is at an early stage.”
- Accountability threats (T8, T9) — who did it, and can you prove it. Conventional appsec concerns that the Top 10 never had to state because non-agentic LLM apps do not act. T8 is also STRIDE’s R, a category conventional threat modelling has carried since 1999 — the gap is in the LLM taxonomies, not in threat modelling generally. See threat-modeling-frameworks, and agent-observability-and-logging for what an audit trail has to contain to close it.
- Human-boundary and protocol threats (T10, T14, T15, T16) — the seams between agents, and between agents and people.
This is the same agentic gap the vault has now recorded from four independent directions — see the OWASP crosswalk and owasp-mapping.
The decision path
The taxonomy navigator is organised as six questions about the system under review rather than as a flat list (source: Agentic-AI-Threats-and-Mitigations-1.1.pdf, pp. 21–32):
| Step | Question | Threats |
|---|---|---|
| 1 | Does the agent independently determine its own steps? | T6, T7, T8 |
| 2 | Does it rely on stored memory for decisions? | T1, T5 |
| 3 | Does it execute actions via tools, commands or integrations? | T2, T3, T4, T11, T16, T17 |
| 4 | Does it rely on authentication of users, tools or services? | T9 |
| 5 | Does it require human engagement to function? | T10, T15 |
| 6 | Does it rely on multiple interacting agents? | T12, T13, T14 |
Answering “no” at a step prunes its threats. This is what makes the document usable as a checklist rather than a reading list — a single-agent tool-using copilot with no persistent memory is scoped to steps 1, 3, 4 and 5.
Two internal inconsistencies
Flagged for anyone citing this document precisely:
- The introduction promises “threat models for four example scenarios” (p. 3) but only three are delivered: Enterprise Co-Pilots, Agentic IoT in Smart Home Security Cameras, and Agent-driven RPA (pp. 43–49).
- Playbook scope disagrees with the playbook mapping table. The overview table (p. 34) assigns Insecure Inter-Agent Protocol Abuse to both Playbook 3 and Playbook 4; the playbook headers themselves (pp. 37, 39) omit it from both. Playbook 6 is also labelled “Step 5: Multi-Agent System Threats” when the navigator places multi-agent threats at Step 6.
Neither affects the substance, but both mean the document is not yet self-consistent enough to auto-generate a control matrix from.
Related pages
- agentic-ai-threats-and-mitigations — the source page
- agentic-reference-architecture — the canvas these threats are mapped onto
- agentic-mitigation-playbooks — the six mitigation playbooks
- owasp-mapping — full crosswalk to the LLM Top 10
- ATLAS matrix — technique-level equivalents