05 — frameworks & standards

OWASP Agentic Top 10

Also written ASI01–ASI10

OWASP's first risk taxonomy written specifically for autonomous, tool-using agents: ASI01 Agent Goal Hijack, ASI02 Tool Misuse & Exploitation, ASI03 Identity & Privilege Abuse, ASI04 Agentic Supply-Chain, ASI05 Unexpected Code Execution, ASI06 Memory & Context Poisoning, ASI07 Insecure Inter-Agent Communication, ASI08 Cascading Failures, ASI09 Human-Agent Trust Exploitation, ASI10 Rogue Agents. Most of the list lives at the action layer rather than the model layer.

Related terms

Tool poisoning Attack concepts
Hiding instructions in the metadata an agent reads to learn how to use a tool — an MCP server's tool description, its parameter documentation, its schema…
Memory / cross-agent propagation Agents & architecture
A payload that is written in one session and fires in a later one, or in a different agent.

Frameworks & standards

What auditors, buyers and regulators reference. See the compliance crosswalk for the control-by-control mapping.

OWASP Agentic Top 10 is term 3 of 8 in this part of the glossary.

AMTSO OWASP LLM Top 10OWASP Agentic Top 10MITRE ATLAS EU AI Act ISO/IEC 42001 NIST AI RMF AIUC-1

This page is one entry from the agentic AI security glossary, which defines 60 terms in the same style. Where a term belongs to a published taxonomy or standard — the HackAgent attack families, the OWASP lists, AMTSO's guidelines, MITRE ATLAS, ISO/IEC 42001, the NIST AI RMF, the EU AI Act — the authoritative wording is the source document's, not ours, and specifics should be verified there. "Lethal trifecta" is Simon Willison's term. OWASP® is a trademark of the OWASP Foundation; ATT&CK® and ATLAS™ are trademarks of The MITRE Corporation. Naming a framework here is description, not a claim of certification or endorsement.