The OWASP Top 10 for Agentic Applications (2026) ranks the ten most prevalent and impactful security risks for autonomous AI agents. This page maps every ASI category to the AiEGIS 15-layer runtime enforcement chain — primary layers plus defence-in-depth.
The OWASP Top 10 for Agentic Applications is the OWASP Agentic Security Initiative's prioritised list of the ten most prevalent and impactful security risks specific to autonomous AI agents. It was launched on 2025-12-09 and uses the ASI prefix (Agentic Security Issue), numbered ASI01 through ASI10, ordered by prevalence and impact across 2024–2025 deployments.
The list is distinct from the OWASP Top 10 for LLM Applications — it focuses on risks that surface specifically when an LLM is used as the planning core of an autonomous agent that takes actions in the world (tool calls, API requests, multi-agent communication, persistent memory).
The canonical resource page is at genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/; the parent initiative is at genai.owasp.org/initiatives/agentic-security-initiative/.
The AiEGIS 15-layer chain runs on every POST /api/protect call. Each layer returns a signed reason code with a layer name and decision_ms latency. The chain is:
L5 Model-Gate is implicit across every ASI category — it is the model-side rail that L1–L4 + L6–L10 compose around — and is therefore not separately enumerated per category below.
wire_transfer tool calls)./api/protect before the tool runs.scope claim are rejected at L1-tied policy evaluation./api/protect; missing or invalid passport returns immediate DENY.scope claim is the cap; any privilege-escalation attempt to a wider scope is rejected.; rm -rf / style injection blocked at L8 before the subprocess runs.+, backticks, $(...)) from any field that flows toward a tool argument.X-AEGIS-Tag is verified at every hop, including peer-to-peer negotiation.prev_hash + event_hash on the grid_ledger) makes mid-stream substitution detectable post-hoc.confidence_low flag that can trigger HUMAN_REVIEW at L9 Meta.BEFORE DELETE / BEFORE UPDATE triggers on both agent_logs and grid_ledger; grid_ledger is additionally hash-chained); a rogue agent's actions cannot be retroactively hidden. Verify live at /grid/ledger/retention.Every ASI category has at least one primary layer (the layer cited in a customer-facing compliance argument) and at least one defence-in-depth layer (a layer that catches the same risk if the primary control is bypassed).
| ASI | Primary layers | Defence-in-depth |
|---|---|---|
| ASI01 Agent Goal Hijack | L6, L2 | L4, L12 |
| ASI02 Tool Misuse | L8, L13 | L4 |
| ASI03 Identity & Privilege Abuse | L1, L4 | L9 |
| ASI04 Agentic Supply Chain | L13, L10 | L9 |
| ASI05 Unexpected Code Execution | L8, L6 | L11 |
| ASI06 Memory & Context Poisoning | L7, L6 | L14 |
| ASI07 Insecure Inter-Agent Comms | L1, L11 | L15 |
| ASI08 Cascading Failures | L12, L14 | L15 |
| ASI09 Human-Agent Trust Exploitation | L9, L14 | L3 |
| ASI10 Rogue Agents | L12, L15 | L9 |
The 15-layer chain isn't a slide. It runs on POST /api/protect for every agent action. Each layer returns a signed reason code with a layer name and a decision_ms latency. Decisions persist to an append-only ledger with a 5-year retention floor.
The OWASP Top 10 for Agentic Applications (2026) is the OWASP Agentic Security Initiative's prioritised list of the ten most prevalent and impactful security risks specific to autonomous AI agents. The taxonomy uses the ASI prefix (Agentic Security Issue), numbered ASI01 through ASI10, ordered by prevalence + impact across 2024 and 2025 deployments. It was launched on 2025-12-09.
The LLM Top 10 focuses on risks at the model boundary (prompt injection, training data poisoning, model denial-of-service). The Agentic Top 10 focuses on risks that surface specifically when an LLM is used as the planning core of an autonomous agent that takes actions in the world — tool calls, API requests, multi-agent communication, persistent memory. The two lists overlap but are not duplicates.
The AiEGIS 15-layer enforcement chain (L1 Identity through L15 Correlation) covers every ASI category with at least one primary layer plus at least one defence-in-depth layer. The per-category table above names the layers. The chain runs on every POST /api/protect call and emits signed reason codes per layer with a decision_ms latency field.
Three public endpoints let an auditor or customer verify the chain end-to-end. POST /api/protect returns layer-attributed decisions. /grid/ledger/retention confirms the append-only triggers and the 5-year retention floor. /grid/ledger/verify/<seq> returns a Merkle proof for any event in the ledger. Code paths are in the open-source harness at the public reference implementation.
The canonical mapping lives in the AiEGIS harness reference at compliance/owasp_agentic_top_10.md. The page you are reading is the authoritative customer-facing rendering. The mapping is additive to existing AiEGIS compliance evidence (Article 26 at /article-26-walkthrough and Article 12 retention via /grid/ledger/retention).
The OWASP Gen AI Security Project landing page is at genai.owasp.org/llm-top-10/. The Agentic Security Initiative is at genai.owasp.org/initiatives/agentic-security-initiative/. The Top 10 for Agentic Applications 2026 resource page is at genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/.