Securing AI agents and MCP: the OWASP Agentic Top 10 in practice

What changes when the model can act

In a chat application, a successful prompt injection produces a wrong answer that a human reads. In an agent, it produces a transaction. The distance between those two outcomes is the entire subject of this annex.

The OWASP GenAI Security Project published the Top 10 for Agentic Applications for 2026 on 9 December 2025, developed with more than 100 industry experts, researchers and practitioners. It is the companion list to the LLM Top 10, and it exists because the agentic failure modes were not describable in the older vocabulary: goal hijack, identity abuse across tools, cascading failure between agents, and rogue agents running outside their intended policy are not variations on "prompt injection", even when injection is how they start.

The Model Context Protocol changed the shape of the problem again. MCP standardized how an agent connects to tools and data, which is exactly why it also standardized a supply chain: a third-party MCP server is a dependency with credentials, a transport, an update path and a description that the model reads as instructions. Very few organizations review them the way they review a package.

ASI01 Agent Goal Hijack

The objective itself is rewritten mid-run by content the agent read: a retrieved document, a subtask result, a tool response, a page it fetched. Nothing looks broken; the agent simply pursues a different goal competently.

Incident. The GTG-1002 campaign reported by Anthropic in November 2025 is the scaled version: a state-sponsored group drove an agent with MCP tooling through reconnaissance, exploit generation, credential harvesting and exfiltration, with the model performing an estimated 80 to 90 percent of the work and humans intervening at four to six decision points across roughly thirty targets.

Test. Plant redirection instructions in each content source the agent consumes mid-run and observe whether any checkpoint compares the current plan against the original human instruction. Most implementations have no such checkpoint, which is the finding.

ASI02 Tool Misuse and Exploitation

The agent is induced to call a legitimate tool for an illegitimate purpose, or with tampered arguments. No vulnerability in the tool is required; the authorization model is the vulnerability.

Incident. In May 2025 Invariant Labs demonstrated a toxic agent flow: an instruction placed in a public GitHub issue was read by an assistant connected to the GitHub MCP server, which then copied private repository content into a public pull request. The MCP server behaved correctly; the agent had access to both the public issue and the private repository in one session, and that was enough.

Test. Inventory every callable action with its arguments and side effects, then attempt to trigger each one from untrusted content rather than from the user. Test argument tampering and chained calls separately from the initial invocation.

ASI03 Identity and Privilege Abuse

The agent authenticates to real systems. If it does so with a shared service identity rather than the identity of the person it is acting for, every access control behind that identity has been switched off for the duration.

Incident. In July 2025 General Analysis published a case where a support ticket carrying instructions reached an assistant whose database MCP connection used the service role, bypassing row-level security. The assistant read an integration-token table and wrote the secrets back into the ticket thread. The recommended mitigations were read-only connections, project scoping, SQL review and injection filtering, in that order of durability.

Test. For each tool call, determine which identity reaches the downstream system and what that identity can do independently of the agent. Then check whether tokens are scoped per tenant, per project and per operation, or issued once and reused.

ASI04 Agentic Supply Chain Vulnerabilities

Models, adapters, frameworks, plugins and MCP servers enter the execution path with far less review than a library would receive. The connector is code, and it usually runs with the credentials of the person who installed it.

Incident. CVE-2025-6514, published on 9 July 2025 and scored 9.6 by JFrog, is operating-system command injection in mcp-remote, triggered by connecting to an untrusted MCP server that returns a crafted authorization endpoint URL. No prompt was involved. It is an ordinary dependency vulnerability in an extraordinary position.

Test. Build the component inventory, check pinning and update paths, and review third-party MCP servers as dependencies: who publishes them, what they request, how they authenticate, and what changes without anyone noticing.

ASI05 Unexpected Code Execution

Coding agents write and run code, edit configuration inside repositories, and act on files a human has not read. The boundary between suggestion and execution is thinner than most teams assume.

Incidents. Two Cursor records from August 2025 illustrate the two directions. CVE-2025-54135 covers writing in-workspace files without user approval below version 1.3.9, scored 8.5 by the vendor and 9.8 by NVD. CVE-2025-54136 covers persistence through a trusted MCP configuration file modified in a shared repository or locally, scored 7.2 by GitHub and 8.8 by NVD. CVE-2025-53773 in GitHub Copilot and Visual Studio, scored 7.8 by Microsoft, allowed local code execution through command injection driven by content in a repository.

Test. Establish the sandbox boundary, the filesystem and network reach from executed code, whether the agent can write configuration files that change its own permissions, and whether generated code ever runs before a human sees it.

ASI06 Memory and Context Poisoning

A single successful injection becomes durable when the agent writes it into memory. The next session starts already compromised, and no one re-reads the poisoned entry because it looks like something the agent learned.

Reference. MITRE ATLAS records this as AML.T0080, AI agent context poisoning, alongside AML.T0092 for manipulation of chat history. The Morris II research worm, held in the ATLAS case-study data, is the propagating version of the same idea across retrieval.

Test. Determine whether one conversation can write a durable instruction, whether memory is shared across users or sessions, whether entries carry provenance, and whether anything expires or is reviewed.

ASI07 Insecure Inter-Agent Communication

In a multi-agent system, one agent's output is another agent's input. If that channel carries no authentication and no provenance, a compromised or merely confused subordinate can instruct its coordinator, and the coordinator has no way to tell that from a legitimate result.

Test. Establish whether messages between agents are authenticated, whether a subordinate result is treated as data or as instruction, and whether the coordinator applies its own policy to anything a subordinate returns.

ASI08 Cascading Failures

One bad decision propagates. An agent acts on a poisoned result, writes the outcome to a shared store, and a second agent reads it as ground truth. The blast radius is a property of the topology, not of any single component.

Test. Map which agents share stores, queues and memory, then trace what one poisoned entry can reach. This is a design review rather than a payload exercise, and it belongs in the intake phase of an assessment.

ASI09 Human-Agent Trust Exploitation

People approve what they are shown. If the approval dialog says "run tool: search" without the arguments, or if a working day produces forty confirmations, the human in the loop is a rubber stamp with a job title.

Test. Read the confirmation surface as an attacker would. Does it show the real action and the real arguments? Can a long argument push the important part out of view? How many confirmations does a normal task produce? Count them, and put the count in the report.

ASI10 Rogue Agents

Agents that run outside the intended policy: unmonitored, forgotten, started by a developer on a laptop, or continuing to hold credentials after the project ended. This is shadow IT with an API key and a loop.

Test. Inventory what exists rather than what is documented. Credential issuance records, MCP configuration files in repositories and gateway logs are better sources than an architecture diagram.

MCP-specific checks

The protocol deserves its own pass, because the same five questions catch most of what goes wrong.

MITRE ATLAS has kept pace with this class. The technique identifiers worth quoting in findings are AML.T0053 for tool invocation, AML.T0086 for exfiltration through a tool call, AML.T0110 for tool poisoning, AML.T0104 for publishing a poisoned tool, AML.T0098 for credential harvesting through a tool, AML.T0101 for destruction through a tool call, and AML.T0080 for context poisoning. The ATLAS case-study set also carries agent incidents directly, including exfiltration via agent tools in Copilot Studio, a poisoned Postmark MCP server used for email exfiltration, and exfiltration through an MCP server used by Cursor.

Controls that hold outside the model

The controls below share one property: they keep working when the model has already been fooled. That is the only test of an agentic control worth applying.

• Least agency. Remove tools rather than restricting them in the prompt. Split read and write into separate scopes and separate credentials.
• Per-request identity. Carry the end-user identity into every tool call. A shared service identity turns one injection into full lateral access.
• Human confirmation with real content. Confirm irreversible and outbound actions, and show the actual arguments in the dialog. Budget for how many confirmations a normal day generates.
• Segmentation. Keep untrusted content and privileged tools out of the same session where the design allows it. Both Invariant Labs and Brave arrived at the same recommendation from different incidents.
• Egress control. Restrict where the agent host and the rendering client may send traffic. Almost every exfiltration case ends at a destination an allow-list would have refused.
• Audit logging. Log every tool call with its arguments, its identity and its outcome. For deployers of high-risk systems under the AI Act this is not optional: Article 26 requires the automatically generated logs to be kept for at least six months.

MITRE ATLAS carries the matching mitigations, each with an identifier a report can cite: AML.M0030 restrict AI agent tool invocation on untrusted data, AML.M0029 human in-the-loop for AI agent actions, AML.M0032 segmentation of AI agent components, AML.M0033 input and output validation for AI agent components, and AML.M0026 privileged AI agent permissions configuration. Quoting the identifier makes it easier for the receiving team to justify the work.

What to ask for in an agentic assessment

• A tool inventory with the identity and the confirmation state of every callable action, produced before testing rather than after.
• An MCP server list with provenance, version and review status, including servers installed by individual developers.
• Test cases that begin in untrusted content and end at a controlled collector, so the exfiltration path is demonstrated rather than asserted.
• Findings mapped to both ASI identifiers and MITRE ATLAS techniques, so detection engineering can consume them.
• An explicit statement of what was not tested: destructive actions declined, production tools excluded, third-party systems out of scope.

For the underlying injection method see testing for prompt injection; for the non-agentic risk catalog see the OWASP LLM Top 10 audit checklist. The threat model on the home page will tell you which of these ten apply to the architecture you have today.