What the list is
The OWASP GenAI Security Project published the Top 10 for Agentic Applications on 9 December 2025. It names the ten risks that matter most once AI systems plan, use tools, remember things and work with other agents. It sits alongside the OWASP Top 10 for LLM Applications: an agent is usually also an LLM application, so both lists apply.
Security teams use it the way they use the web application list, as a shared vocabulary for a threat model and a checklist for a vendor review. This page gives the KPATH answer for each risk, including the ones that are not KPATH’s to solve.
The short version
| Risk | How KPATH relates to it |
|---|---|
| ASI01 Agent Goal Hijack | Limits impact. Runs your guardrail inline |
| ASI02 Tool Misuse | Acts directly |
| ASI03 Identity & Privilege Abuse | Acts directly |
| ASI04 Agentic Supply Chain Vulnerabilities | Limits impact |
| ASI05 Unexpected Code Execution | Your sandbox’s job. KPATH limits outbound reach |
| ASI06 Memory & Context Poisoning | Limits impact |
| ASI07 Insecure Inter-Agent Communication | Acts directly |
| ASI08 Cascading Failures | Acts directly |
| ASI09 Human-Agent Trust Exploitation | Limits impact |
| ASI10 Rogue Agents | Acts directly |
“Acts directly” means the risk shows up as a call, and KPATH decides that call. “Limits impact” means the risk starts somewhere KPATH does not see, such as the prompt or the agent’s memory, and KPATH constrains what the compromised agent can do next.
Risk by risk
ASI01 Agent Goal Hijack
Hidden instructions in a document, a web page or a tool result redirect the agent to a different goal.
KPATH does not read prompts, so it does not detect the hijack itself. Two things still happen on the call. Your content guardrail runs inline as a policy step, scaled to the agent’s risk tier, with its verdict recorded. And the hijacked agent can only reach what policy allows for that agent and that action. A high-risk action still waits for a person, and the agent or its whole chain can be stopped.
ASI02 Tool Misuse
A legitimate tool is used for a harmful purpose: a delete where a read was intended, a payment to the wrong account, a query that pulls far more than the task needs.
This is KPATH’s core job. Every tool call passes through KPATH, and policy is written per agent, per action and per target, so a write is a separate decision from a read. Budgets can be enforced on the call. High-risk actions wait for a named approver before they run.
ASI03 Identity & Privilege Abuse
An agent acts beyond its authority, often with credentials it should not hold or permissions inherited from the person who started it.
Agents in KPATH carry their own identity and nothing else. KPATH adds the real credential for each system on an allowed call, so the agent never holds a key that opens a door elsewhere. High-risk agents can be required to present a workload identity your identity provider verifies. A credential turning up where it should not is one of the patterns KPATH flags.
ASI04 Agentic Supply Chain Vulnerabilities
A tool server, plugin, model or package the agent depends on is compromised or swapped.
KPATH does not scan packages or models. It does control which tools and services an agent can reach: agents find services through a governed directory and see only the ones policy allows, so an unapproved tool server is not reachable through KPATH. The integrity of what you install is for your software supply chain controls.
ASI05 Unexpected Code Execution
Natural language turns into code that runs somewhere it should not.
Containing code inside the agent’s environment is the job of your sandbox and runtime. Where that code’s outbound calls leave through KPATH, they meet the same identity and policy checks as any other call, so code running in a compromised agent is limited to what that agent is allowed to reach.
ASI06 Memory & Context Poisoning
Something stored in the agent’s memory or context changes its behaviour later.
KPATH does not see or store the agent’s memory. It limits the damage the same way as for goal hijack: whatever the poisoned agent now wants to do, each call is still checked against policy, and the record shows what it did, so the poisoned session can be traced.
ASI07 Insecure Inter-Agent Communication
One agent is spoofed or manipulated into misleading another.
When agents call each other through KPATH, every hop carries the calling agent’s own identity and is checked against policy, the same as a call to any other service. Policy, budget and approval apply to the chain a request started, not only to its first hop.
ASI08 Cascading Failures
One bad signal spreads through automated agents and gets bigger with every step.
KPATH tracks the chain a request sets off. Any agent, or the whole chain, can be stopped immediately and stays stopped, without waiting for a credential to expire. The chain loses the credentials it relied on, and afterwards a record anyone can check shows nothing in it was authorised after the stop. Spend is rolled up to the request that started the chain.
ASI09 Human-Agent Trust Exploitation
An agent gives a person a convincing reason to approve something harmful.
KPATH cannot stop a person being persuaded. It makes sure the high-risk action waits for a named approver on the call itself, and records the approval and the action together, so who approved what, and when, is on the record rather than in a chat thread.
ASI10 Rogue Agents
An agent drifts from its intended behaviour, hides what it is doing or acts on its own.
KPATH’s behaviour watch flags an agent acting out of pattern: a sudden burst of calls, reaching for systems it never used, a run of refusals. High-risk agents are paused automatically. Any agent can be stopped, and every call it made, allowed or refused, is in a tamper-evident record your auditor can verify without trusting KPATH.
Using this in a review
Run the list as a threat model for one real agent: what it can reach, who it acts for, and what it hands work to. For each risk, write down which control acts on it today and where that control sits. A control inside the agent’s own code or prompt counts for less than one on the path of the call, because the agent can be turned against it.
Start in monitor mode. KPATH records every call and enforces no policy, so the inventory of agents, tools and chains fills in before anything is blocked, and the threat model is written against what your agents actually do. See how that works on the KPATH platform.