Published by OWASP’s Gen AI Security Project in December 2025, this framework does for autonomous agents what the earlier OWASP Top 10 for LLM Applications did for chatbots and single-turn model calls: names the specific ways this class of system fails, ranked by how often and how badly. It’s a different list because agents are a different threat surface. A chatbot can say something wrong. An agent can plan, hold memory, call tools, delegate to other agents, and act, with real consequences, on its own initiative.
The ten categories run from goal hijacking, where an attacker manipulates what an agent believes it’s trying to accomplish, through tool misuse, identity and privilege abuse across a delegation chain, insecure inter-agent communication, and cascading failures where one compromised component’s blast radius isn’t contained. Several of these categories describe exactly the mechanics of real, disclosed incidents rather than theoretical risks, including the July 2026 case where an OpenAI research model chained a sandbox escape into unauthorized access on Hugging Face’s infrastructure.
The most useful thing about the framework isn’t the list itself, it’s the reframing underneath it: for a system with any autonomy, the question isn’t just what it can access, but how much it can do with that access before a human checks in. OWASP calls that “least agency,” the agentic-era sibling of least privilege.