AI agent security is the practice of limiting what autonomous AI systems can read, decide and do, so that a manipulated or misbehaving agent cannot cause serious harm. It rests on a few controls: tight identity and permissions, protection against hidden instructions, vetted tools and supply chains, human approval for risky actions and a fast way to stop an agent that goes off course.
Key Takeaways
- OWASP’s Top 10 for Agentic Applications 2026, published on December 9, 2025, lists ten risk categories (ASI01 to ASI10) for agents that plan, remember and act.
- Prompt injection remains a common entry point, and the UK National Cyber Security Centre (NCSC) warns it may never be fully mitigated.
- Least privilege, human approval and detailed logging do more than trusting the model to behave.
- On November 3, 2026, CrowdStrike added an AI Kill Switch to Falcon Guardian that can terminate an agent, block relaunches and cut network access.
- Apple’s annual filing, as summarized by The Neuron, warns that autonomous agents could exceed permissions or resist instructions.
Agents differ from chatbots because they hold credentials and take actions. The site’s explainers on AI agents, agentic AI and how agents work cover the foundations. This guide focuses on what can go wrong and what organizations can do about it today.
Table of Contents
The Short Answer
The central AI agent risks come from autonomy combined with access: an agent that can read data, call tools and spend money can be steered by hidden instructions, over-trusted by people or compromised through a tool it depends on. The practical response is to give each agent the least access it needs, require approval for high-impact actions, log everything and keep a tested way to shut an agent down.
Why AI Agent Security Differs From Chatbot Safety
A chatbot that gives a bad answer mostly wastes someone’s time. An agent with production credentials can send data, change settings or move funds. Cycode’s review of the OWASP agentic list notes that most production agents run with broader scopes than their tasks require, and that traditional static analysis cannot see an agent’s prompts, tools, memory or inter-agent traffic.
That gap explains why OWASP built a separate list. The older OWASP Top 10 for LLM Applications covers model-level problems such as prompt injection, while the agentic list covers what happens when the model becomes an actor with goals, tools and memory.
The Ten Risks in the OWASP Agentic List
The OWASP GenAI Security Project built the list with more than 100 experts. The first three columns below follow the names and descriptions OWASP-based sources use. The last column lists common controls that practitioners apply; it is general practice, not a quotation from OWASP.
| ID | Risk | What it means | Typical control |
|---|---|---|---|
| ASI01 | Agent Goal Hijack | An attacker alters an agent’s objectives, instructions or decision paths | Keep trusted instructions apart from outside content; confirm goal changes |
| ASI02 | Tool Misuse and Exploitation | An agent uses a permitted tool in an unsafe or unintended way | Narrow tool scopes and validate arguments |
| ASI03 | Identity and Privilege Abuse | Attackers exploit delegated trust to gain higher access | Per-agent identities and short-lived credentials |
| ASI04 | Agentic Supply Chain Vulnerabilities | Third-party tools, models or datasets may be hostile or altered | Vet, pin and inventory every dependency |
| ASI05 | Unexpected Code Execution (RCE) | Attackers or flawed generation cause code to run that no one intended | Run generated code in sandboxes |
| ASI06 | Memory & Context Poisoning | Corrupted stored memory or retrieved context shapes later decisions | Validate, expire and trace memory sources |
| ASI07 | Insecure Inter-Agent Communication | Messages between agents can be intercepted, spoofed or altered | Authenticate and sign agent messages |
| ASI08 | Cascading Failures | One fault spreads across connected agents, tools and workflows | Rate limits, spend caps and circuit breakers |
| ASI09 | Human-Agent Trust Exploitation | People trust agents and approve risky actions without independent checks | Independent verification of high-impact approvals |
| ASI10 | Rogue Agents | Compromised or misaligned agents drift from their approved purpose | Behavior monitoring and a kill switch |
Real Incidents Behind the List
Cycode reports that the list was built from observed 2025 incidents rather than projections. Two stand out. EchoLeak, tracked as CVE-2025-32711, showed that a single crafted email could pull corporate data out of Microsoft 365 Copilot with zero clicks. The Amazon Q case showed a hijacked pull request delivering data-wiping instructions through an AI coding extension with more than 950,000 installs. The companion article on prompt injection examples walks through these and other cases in detail.
Multi-agent setups add exposure. When agents pass messages and tasks to each other, a single weak link can affect the whole chain, a point the site’s guides to multi-agent systems and the A2A protocol explore from the design side.
Controls That Work in Practice
- Inventory agents first. CrowdStrike’s Falcon Guardian is built to discover both approved agents and shadow AI; any organization needs the same visibility before it can protect anything.
- Give every agent its own identity with the minimum scopes for its task, and rotate credentials.
- Treat tools like software dependencies. Vet plugins and servers, and review how the Model Context Protocol connections are scoped. The comparison of MCP and APIs helps with that decision.
- Sandbox code execution so generated commands cannot touch production systems directly.
- Require human approval for high-impact actions such as payments, deletions and outbound messages. Cases like agents bypassing spending limits show why caps alone are not enough.
- Log prompts, tool calls and outputs, and watch for anomalies. The NCSC notes that failed tool or API calls can signal an attacker probing a system.
- Keep a tested kill switch that can stop an agent, block it from relaunching and cut its network access.
The Kill Switch Moment
At Fal.Con Europe in Barcelona on November 3, 2026, CrowdStrike announced an AI Kill Switch inside Falcon Guardian. According to the company’s press release, a security decision-maker can terminate a rogue agent where it runs, block it from relaunching on a host or host group, and cut its access to the enterprise network. CEO George Kurtz said that when agents are deployed with a kill switch, an organization stays in control.
Cyber Daily reported that the feature initially stops agents at the gateway, with endpoint termination planned for a later release, and that every action requires an authorised administrator and is recorded in an audit trail. Analysts quoted by CSO caution that its real effectiveness will only be known after wide use in live systems, so it works best as an emergency brake rather than a cure. Forbes added that Congress is reviewing an AI Kill Switch Act. Other vendors, including Microsoft, Palo Alto Networks and Cisco, are reported to be building similar controls, according to SC Media’s brief.
The warning is not limited to security vendors. The Neuron’s digest of the news on November 4, 2026 says Apple’s annual filing described risks of unauthorized transactions, security circumvention and concealed actions by autonomous agents, and noted that unpredictable behavior could be hard to reverse.
Key Terms at a Glance
- Agent goal hijack: an attacker changes what an agent is trying to achieve.
- Least privilege: giving an agent only the access its task requires.
- Memory poisoning: planting false or hostile data in an agent’s stored memory or retrieved context.
- Shadow AI: agents or AI tools running in an organization without approval or visibility.
- Kill switch: a human-controlled mechanism that stops an agent, prevents relaunch and cuts access.
Conclusion
Agent adoption is moving faster than governance, so the safest path combines modest permissions, human checkpoints and a way to stop misbehavior quickly. Organizations that map their deployments to the OWASP list, log agent activity and rehearse a shutdown will manage AI agent risks far better than those relying on model behavior alone. Readers new to the field can start with the agentic browser guide to see how exposed an agent becomes once it can act on live websites.
Frequently Asked Questions
What is the biggest security risk with AI agents?
The most common entry point is hidden instructions in content an agent reads, known as indirect prompt injection, combined with permissions that are broader than the task needs. OWASP ranks prompt injection first in its LLM list, and agents raise the stakes because they act.
What is the OWASP Top 10 for Agentic Applications?
It is a peer-reviewed list of ten risk categories for autonomous agents, published by the OWASP GenAI Security Project on December 9, 2025 and numbered ASI01 to ASI10. It extends rather than replaces the OWASP Top 10 for LLM Applications.
Can an AI agent be stopped if it misbehaves?
Yes, if a stop mechanism is built in beforehand. CrowdStrike’s AI Kill Switch is one example: it can terminate an agent, block relaunches and cut network access, though endpoint termination was still planned at launch.
Should AI agents have human approval for every action?
Not every action. Low-risk steps can run automatically, while high-impact actions such as payments, deletions and external messages should need a person’s approval.
Can prompt injection be fully fixed?
Not with current technology. The NCSC says it may never be totally mitigated the way SQL injection largely has been, so the advice is to limit what a compromised agent can do.
What is shadow AI and why does it matter?
Shadow AI means agents or AI tools running without approval or visibility. Unknown agents cannot be given least privilege or monitored, which is why inventory is the first control.
Sources
- Cycode: OWASP Top 10 for Agentic Applications
- OWASP GenAI Security Project: Top 10 for Agentic Applications
- Modulos: OWASP Top 10 for Agentic Applications (2026)
- CrowdStrike press release: Introduces the AI Kill Switch
- Cyber Daily: CrowdStrike gives security teams a kill switch
- CSO Online: CrowdStrike launches AI kill switch
- Forbes: CrowdStrike looks to an AI kill switch
- The Neuron: Everything that happened in AI on November 4, 2026
- UK NCSC: Prompt injection is not SQL injection
The Future AI Wire Editorial Team covers artificial intelligence, AI agents, agentic AI, and emerging technologies. We publish clear, research-informed explanations and practical insights to help readers understand AI developments, real-world applications, and the technologies shaping the future.