Standards
OWASP Agentic AI threats, mapped to agent tests
OWASP Agentic AI Threats and Mitigations is a threat-model reference from the OWASP Agentic Security Initiative. Version 1.1 lists threats T1 to T17, including T2 Tool Misuse and T3 Privilege Compromise. An Agent Action Pentest exercises the threats that end in a tool call, and marks the rest out of scope.
What is the OWASP Agentic AI threat list?
The Agentic AI: Threats and Mitigations guide is the first in a series from the OWASP Agentic Security Initiative. The document we checked is version 1.1, dated December 2025. It describes threats by number, T1 Memory Poisoning through T17 Supply Chain Compromise, each with mitigations.
The guide's T2 definition is the core of agent testing: attackers manipulate agents into abusing their integrated tools through deceptive prompts or commands, operating within authorized permissions. That last clause is why permissions alone do not settle the question. T3 Privilege Compromise covers the other half, where weaknesses in permission management let an attacker act beyond what was intended.
How does each threat map to an agent pentest?
| ID | Name | What an Agent Action Pentest exercises | Scope |
|---|---|---|---|
| T1 | Memory Poisoning | Seeding persistent memory with instructions, where the agent has memory. Details | In scope if memory exists |
| T2 | Tool Misuse | Steering authorized tools to harmful ends. Details | In scope |
| T3 | Privilege Compromise | Reaching roles, tenants or admin tools. Details | In scope |
| T4 | Resource Overload | Load and cost exhaustion. | Out of scope |
| T5 | Cascading Hallucination Attacks | Propagated false information. | Out of scope |
| T6 | Intent Breaking & Goal Manipulation | Redirecting the agent objective. Details | In scope |
| T7 | Misaligned & Deceptive Behaviors | Emergent harmful strategies. | Out of scope |
| T8 | Repudiation & Untraceability | Whether tool calls are logged. | Noted when observed |
| T9 | Identity Spoofing & Impersonation | Impersonating users or admins to the agent. Details | In scope |
| T10 | Overwhelming Human in the Loop | Flooding reviewers. | Out of scope |
| T11 | Unexpected RCE and Code Attacks | Code execution tools. Details | In scope if a code tool exists |
| T12 | Agent Communication Poisoning | Poisoned inter-agent messages. Details | Single handoffs only |
| T13 | Rogue Agents in Multi-Agent Systems | Compromised agents in a fleet. | Out of scope |
| T14 | Human Attacks on Multi-Agent Systems | Abusing delegation across agents. | Out of scope |
| T15 | Human Manipulation | Agent used to deceive users. | Out of scope |
| T16 | Insecure Inter-Agent Protocol Abuse | Protocol flaws in MCP or A2A. Details | In scope for MCP servers used |
| T17 | Supply Chain Compromise | Poisoned dependencies and tool metadata. Details | Tool metadata only |
Which threats are out of scope?
Threats that need long-running observation, many cooperating agents or human reviewers in the loop do not fit a 72-hour fixed-scope engagement. We say so in the report. Where a multi-agent threat reduces to a single handoff we can reach, such as one agent passing poisoned instructions to another, we test that path under T2 or T6. Read how handoffs work in the OpenAI Agents SDK.
As with every mapping on this site, this is not a certification or an official OWASP alignment. It shows where an agent security test touches each threat.
Agent Action Pentest: $2,500 fixed. Written report within 72 hours of access, or a full refund.
See the offer or email yaz@plaw.io
Questions
Is this the same as the OWASP Top 10 for Agentic Applications?
No. This page maps the Agentic AI Threats and Mitigations guide, version 1.1. OWASP publishes other agentic resources separately.
Why only some threats?
A fixed-scope agent pentest attacks reachable actions. Threats that need fleets, reviewers or long observation need a different engagement.
Will the report reference these IDs?
Yes, findings that match a threat carry its T number alongside the VulnZap class.
Related pages
- 03Excessive agency in AI agentsThe agent holds more tools, permissions or autonomy than the task needs.
- 05MCP tool poisoning and MCP server risksMalicious tool definitions or over-scoped MCP servers steer what the agent calls.
- 01Prompt injection in AI agentsInstructions in user input or ingested content override what the agent was told to do.
- OWASP Top 10 for LLM Applications 2026, mapped to agent testsAll ten 2026 entries mapped to what an agent pentest covers, with a 2025 to 2026 crosswalk.
- MITRE ATLAS techniques for AI agentsThe ATLAS techniques that describe attacks on tool-using agents, mapped to our tests.
- Security testing for OpenAI Agents SDK appsFunction tools, handoffs, guardrails and MCP servers in the OpenAI Agents SDK.
Sources
Last reviewed: