The OWASP Top 10 for AI Agents (ASI Top 10)
Synopsis
A summary of the OWASP Top 10 for Agentic Applications, which extends the earlier LLM Top 10 to systems that plan, hold memory, call tools and act with delegated authority. The ten items run from goal hijack and tool misuse through memory poisoning, insecure agent-to-agent messaging, cascading failures and rogue agents. Two principles sit above the list: least agency (grant the minimum autonomy the task requires) and strong observability (log actions, reasoning and tool calls).
Where I land
This is my own position rendered as an industry standard, and I did not expect to find it there. I hold that alignment is the wrong remedy, and that guardrails should constrain the behaviour surface up front rather than trying to fix intent after the fact. Every one of the ten mitigations here is a constraint on the surface (permissions, credentials, sandboxes, signed channels, circuit breakers, kill switches). Not one of them is a claim about what the model wants. Least agency is that argument with a name on it.
Two cautions I want stated rather than assumed. First, this is not the source I have been trying to find. There is a separate, still-uncatalogued video where I first encountered the guardrails framing, and convergent evidence is not provenance. Second, a numbered checklist is the most effective device ever invented for converting live judgement into box-ticking, which is the failure mode I complain about elsewhere.
Connections
Related: Countering Misuse of AI — Threat Intelligence Report, September 2026