The OWASP Top 10 for Agentic Applications, published in 2025 by the OWASP GenAI Security Project, names the ten security risks that matter most once an AI system can plan, remember, call tools, and act on its own — ASI01 through ASI10. Almost every write-up frames them as things to prevent. Forensics asks the complementary question: after one of them materializes, what did the agent actually do, and can you prove it? Here is each risk from that angle — the footprint it leaves, and how you reconstruct it.
The ten risks, from the forensic side
ASI01 — Agent Goal Hijack
An attacker bends the agent’s objective or decision path so it pursues something it was never asked to. Forensically, the work is to separate the moment the goal changed from everything after it: find the input that redirected the agent, then trace each action that followed from the altered objective. The most common delivery mechanism is a prompt injection — see investigating a prompt-injection incident for the full playbook.
ASI02 — Tool Misuse and Exploitation
The agent uses its connected tools toward harmful ends, or an attacker abuses a tool interface through the agent. The evidence lives in the tool-call record: which functions were invoked, with what arguments, in what order. A misuse case is usually a legitimate tool chained into an illegitimate sequence, so reconstruction means putting every call back on one timeline and reading the chain, not the individual call — see investigating agent tool misuse.
ASI03 — Identity and Privilege Abuse
The agent’s credentials, tokens, or inherited permissions are used to reach data or systems beyond intended limits. This is the identity problem at the center of agent forensics: an agent acts through many non-human identities, and abuse looks identical to legitimate use. Resolving that sprawl to one actor and finding where access exceeded scope is its own discipline — see agent credential abuse and non-human identity.
ASI04 — Agentic Supply Chain Vulnerabilities
Risk introduced through the third-party pieces an agent depends on — tools, plugins, registries, MCP servers, external components. Forensically, the question is provenance: which component was in the loop when things went wrong, at what version, and what did it introduce? Reconstruction has to account for the agent’s dependencies as carefully as its own actions, because the origin may sit one layer out from the agent itself.
ASI05 — Unexpected Code Execution
The agent generates, modifies, or runs code or commands in ways that create security or operational risk. The footprint is whatever executed: the code or command, where it ran, and what it touched. The investigative task is to capture exactly what was run and bound its effect, because a single unexpected execution can reach well beyond the agent’s normal surface.
ASI06 — Context Management and Retrieval Manipulation
Stored or retrieved context — memory, retrieval entries, conversation state — is poisoned, stale, or tampered with, steering the agent’s later decisions. This is memory poisoning, and it is among the hardest of the ten to investigate, because the corrupting input and the resulting harm can be separated by days. Reconstruction means tracing a bad decision backward to the poisoned entry that planted it — often delivered through the same channel as a prompt injection.
ASI07 — Insecure Inter-Agent Communication
Agents exchange messages without enough authentication, integrity, or policy control, opening the door to misuse between them. The evidence spans more than one agent, so the investigation has to fuse the message trail across every agent in the exchange and establish which one originated the bad instruction. Attribution across agents is the whole challenge.
ASI08 — Cascading Failures
One error, compromise, or bad decision spreads across connected agents, tools, or workflows. Tracing a cascade is the full incident-response process in miniature: find patient zero, then follow the chain forward as one agent’s output becomes the next one’s trusted input. A defensible account has to show the propagation path, not just the final damage — see investigating cascading multi-agent failures.
ASI09 — Human-Agent Trust Exploitation
The agent uses persuasive or misleading output to push a person into an unsafe action or approval. The footprint is conversational: what the agent presented to the human, and what it concealed or distorted to win the approval. Reconstruction pairs what the agent said with what it was actually doing underneath, so the gap between the two is on the record.
ASI10 — Rogue Agents
A compromised, misaligned, or drifting agent keeps operating in unintended ways inside a larger system. Whether an agent has actually gone rogue — and since when — is exactly the question agent forensics exists to answer. The work is to establish the agent’s true behavior over time against what it was supposed to do, and to pinpoint where the two diverged. This is the general case that AI agent forensics addresses.
What they have in common
Read from the forensic side, the ten collapse into a few recurring problems. Most are some form of input or goal manipulation (ASI01, ASI06) or tool and code abuse (ASI02, ASI04, ASI05) — both reconstructed from the record of what the agent read, called, ran, and decided. A second cluster is identity (ASI03), where the work is resolving many non-human identities to one actor. A third is multi-agent (ASI07, ASI08, ASI10), where attribution and propagation across agents dominate. One (ASI09) sits at the human boundary. Different entry points, but nearly all of them reduce to the same core task: a faithful, provable reconstruction of what the agent actually did.
Where Agent Autopsy fits
Agent Autopsy is built for the forensic side of this list. It reconstructs what an agent read, called, changed, and decided from the logs you already have, resolves its non-human identities into a single actor, traces a chain back to patient zero, and produces a confidence-rated, chain-of-custody-backed account — the evidence you need whichever of ASI01 through ASI10 you are facing. See how it works end to end, or how it is validated.
Frequently asked questions
What is the OWASP Top 10 for Agentic Applications?
It is a 2025 framework from the OWASP GenAI Security Project naming the ten most critical security risks of autonomous AI agents, ASI01 through ASI10. It covers the risks that emerge once an agent can plan, remember, use tools, and take action — distinct from the older OWASP Top 10 for LLM Applications, which targets the model layer.
How is it different from the OWASP Top 10 for LLMs?
The LLM Top 10 addresses risks in models and GenAI apps; the Agentic list addresses the risks that appear when a system can take autonomous action across tools, identities, and other agents. Agentic risks spread across multi-step workflows and connected systems rather than living in a single model response.
Which of the ten can Agent Autopsy help investigate?
In principle all of them, because nearly every risk on the list resolves to reconstructing what the agent did and which identity did it. It is strongest on goal hijack (ASI01), identity and privilege abuse (ASI03), context and memory manipulation (ASI06), and cascading failures (ASI08).
Is this about preventing these risks or investigating them?
Investigating. Prevention guidance is widely available; this guide is about what happens after a risk materializes — the evidence each one leaves, and how to reconstruct it into a defensible account.