OWASP Releases Top 10 Security Risks for Agentic Applications in 2026
The Open Worldwide Application Security Project, or OWASP, has long developed software security guidance. As AI agents gain the ability to break down tasks, plan steps and invoke external tools autonomously, risks have expanded beyond model inputs and outputs to permissions, memory and cross-system operations. These issues have therefore become a major governance concern for enterprises adopting Agentic AI.
OWASP released its Top 10 security risks for agentic applications in 2026, covering threats including agent goal hijacking, tool misuse and rogue agents. It also said AI Agents still cannot fully defend against prompt injection. Experts cautioned that the list is intended to raise awareness of threats and should not be treated as rigid doctrine. The release involved no monetary figures.
All Coverage
3 original reportsThe Backstory
The history behind this eventOWASP Ranks Excessive AI Agency as No. 3 LLM Risk
The OWASP GenAI Security Project’s risk list is designed to help companies identify the most serious weaknesses in applications built around large language models. The spread of AI agents has raised the stakes because such systems can call tools, retrieve sensitive data and take actions with limited human intervention. Excessive permissions can therefore turn a flawed model response or malicious instruction into a real-world security incident.
OWASP released its 2026 ranking on Aug. 26, incorporating data from thousands of actual incidents for the first time. Prompt injection and sensitive information disclosure retained the top two positions, while excessive agency rose to No. 3 as agentic AI adoption accelerated. OWASP urged companies to apply least-privilege access to tools and enforce authorization and security controls through mechanisms outside the model itself.
Subscribe to Mark Radar Weekly
Every Friday, the week's strongest signals in your inbox. Unsubscribe anytime.
If you search news on Google, you can set Mark Radar as a preferred source—our coverage will show up more often in your results. Set as preferred source on Google →