In December 2025, the OWASP GenAI Security Project released its Top 10 for Agentic Applications. The important word is not “ten.” It is “agentic.”
Agent security is not limited to filtering model output. Agents plan, retain state, call tools, delegate work, and modify systems. That creates failure modes across the full execution path.
A threat list helps a team ask better questions. To reduce risk, each question has to become a control that can be enforced and evidenced.
Translate each risk into four fields
For every relevant threat, define:
- —Owner: the person accountable for the control.
- —Enforcement point: where the system can allow, deny, mask, pause, or constrain the action.
- —Evidence: what proves the control ran and what decision it made.
- —Response: what happens when the control fails or detects an exception.
Without these fields, a risk register describes the problem but does not change runtime behavior.
Put controls at the action boundary
An agent may receive unsafe instructions from a user, a document, a web page, a tool response, or its own persisted memory. Prompt filtering at the entrance cannot protect every downstream step.
The stronger boundary is the tool call. Before an agent sends a message, changes a record, runs code, or accesses sensitive data, the runtime can evaluate the proposed action against identity, policy, data classification, environment, and approval requirements.
That enforcement point should be outside the natural-language instruction itself. Telling an agent “never delete production data” is guidance. Denying destructive production credentials is a control.
Useful patterns include:
- —separate read and write tools;
- —scoped, short-lived credentials;
- —destination and operation allowlists;
- —schema validation for tool arguments;
- —transaction limits and rate limits;
- —approval gates for irreversible effects;
- —isolation between agent memory and untrusted content;
- —a circuit breaker that can suspend an agent or connector.
Preserve the delegation chain
Multi-agent systems make ownership less obvious. A parent agent may delegate to a specialist, which then calls a tool through a shared integration.
The trace must preserve that chain. Record the initiating user, parent run, delegated agent, tool identity, arguments or protected hashes, policy result, approval, and external effect. If every step appears under one generic service identity, the audit trail cannot answer who authorized what.
Test controls as behavior
Security reviews often confirm that a policy exists or a guardrail is configured. Agent controls also need behavioral tests.
Create test cases for denied tools, poisoned context, unexpected delegation, repeated retries, privilege escalation, memory contamination, and approval bypass. Assert both the outcome and the evidence: the action was blocked, the reason was recorded, and the correct owner was notified.
Re-run those cases when the model, prompt, tool set, connector, or policy changes. Agent behavior is partly non-deterministic, but the control boundary should remain deterministic.
A practical first pass
Do not attempt to solve every threat for every agent at once. Inventory the agents with the broadest authority, map the OWASP risks that apply to their actual tools and data, and implement controls at the highest-consequence boundaries first.
The result should be more than a completed questionnaire. It should be a small set of tested runtime decisions with an owner and an evidence trail.