What is the difference between a chatbot and an agentic application?

A chatbot generates text responses to questions. An agentic application takes autonomous action. It can access databases, execute transactions, send emails, modify code, and make decisions without waiting for human approval. The security risk is fundamentally different because agent failures have real-world consequences, not just bad outputs.

What is Agent Goal Hijack (ASI01)?

Agent Goal Hijack is a type of prompt injection where attackers redirect an AI agent's objectives by embedding malicious instructions in data the agent processes. For example, attackers have planted hidden instructions in LinkedIn bios that hijack sales agents into extracting sensitive files. It's the #1 risk on the OWASP Agentic Top 10.

What is Tool Misuse and Exploitation (ASI02)?

Tool Misuse and Exploitation occurs when AI agents misuse legitimate tools due to excessive permissions, manipulation, or unsafe delegation. Amazon's Kiro AI coding agent caused a 13-hour outage not because it malfunctioned, but because it had more access than it needed. OWASP ranks it the #2 agentic security risk.

How does the OWASP Agentic Top 10 differ from the OWASP LLM Top 10?

The OWASP LLM Top 10 focuses on risks from content generation like insecure outputs, data leakage, and prompt injection against single models. The Agentic Top 10 addresses what happens when AI can act autonomously... executing transactions, modifying systems, and making decisions across multiple tools and agents.

The OWASP Top 10 for Agentic Applications: What Leaders Need to Know

TL;DR

Gartner predicts 40% of enterprise apps will have task-specific AI agents by the end of 2026. Up from less than 5% today. These aren’t chatbots. They take action on your data, your transactions, and your infrastructure. When they fail, the consequences are real. The OWASP Top 10 for Agentic Applications gives security leaders a prioritized risk list and a common language to get ahead of it.

I’m producing a video series that breaks down each of the 10 risks. They are ultra concise (~1 minute) and designed to help you brief your executives and board using language your grandmother could understand. Subscribe here so you don’t miss them.

What Are Agentic Applications and Why Are They a Security Problem?

Agentic applications are AI systems that take autonomous action. They access data, call APIs, execute transactions, and make decisions without waiting for human approval. Unlike chatbots that only generate text, agentic apps act on your behalf with real-world consequences.

A chatbot is a smart parrot. You ask it questions. It gives you answers. It doesn’t do anything.

An agentic app is different. You say “order me pizza” and it opens the app, picks your toppings, enters your address, and charges your card. You say “schedule a meeting with Sarah” and it checks both calendars, finds a slot, sends an invite, and books the room.

That’s the shift. Agents don’t just generate content. They take action. And that changes the security model completely.

A chatbot hallucination gives you a wrong answer. An agent hallucination might wire money to the wrong account.

A compromised chatbot might leak information. A compromised agent might delete your backups, approve fraudulent transactions, or exfiltrate customer data… all while appearing to work normally.

What Agentic AI Security Incidents Have Already Happened?

Agentic AI security failures are already causing real damage. Adversa AI’s 2025 report found that 35% of all real-world AI security incidents were caused by simple prompts, with some leading to $100K+ in losses. McKinsey reports that 80% of organizations have already encountered risky behaviors from AI agents.

Here are two examples I discuss in my video series:

Your AI agent just got new instructions. Not from you. From an attacker. Sales teams using AI agents to scrape LinkedIn profiles are pulling in hidden instructions planted in user bios. Instructions that tell the agent to extract sensitive system files from the salesperson’s machine. No malware required. No user click or interaction. Just words on a page that the agent treats as instructions to follow. OWASP calls this Agent Goal Hijack, a type of prompt injection where attackers redirect an AI agent’s objectives through malicious content embedded in trusted data sources. It’s the #1 risk on the list. (Watch the breakdown)

Amazon’s AI coding agent caused a 13-hour outage. This wasn’t caused by a software bug. It happened because the agent had too much access. Amazon has one of the most mature engineering cultures on the planet, and they’ve had two AI-caused production incidents in recent months. OWASP calls this Tool Misuse and Exploitation. It’s when AI agents misuse legitimate tools due to excessive permissions, manipulation, or unsafe delegation. It’s #2 on the list. If Amazon can fall victim to it, so can you. (Watch the breakdown)

And it gets worse from there. A compromised vendor-validation agent at a manufacturing company approved $3.2 million in fraudulent orders from attacker-controlled shell companies before anyone noticed. A malicious MCP server impersonated Postmark’s email service, silently BCC’ing every agent-sent email to attackers.

The edge cases are becoming the pattern.

What Is the OWASP Top 10 for Agentic Applications?

The OWASP Top 10 for Agentic Applications is a ranked list of the 10 most critical security risks for AI systems that take autonomous action. Over 100 industry experts built it, and both NIST and the European Commission evaluated it before its December 2025 release. The ranking reflects what’s actually being observed in production, from Agent Goal Hijack (ASI01) to Rogue Agents (ASI10).

You don’t need to memorize the list. You need to know three things.

It gives you a common language. Before this framework, conversations about agentic security were scattered across vendor pitches and academic papers. Now your security team, your engineers, and your board can talk about the same risks using the same terms. That matters when you’re trying to explain why an AI agent needs the same access controls as a privileged user account.

It tells you where to focus first. The ranking is based on real incidents. Agent Goal Hijack is #1 because it’s the most common and often the entry point for other attacks. You don’t have to boil the ocean. Start at the top.

It builds on what you already have. The framework maps to existing OWASP standards. If you’ve built your security program around their guidance before, this fits nicely.

OWASP calls out two foundational design principles that apply across all 10 risks:

Least Agency means only granting agents the minimum access they need to perform their task. An email summarizer doesn’t need send and delete permissions. A coding assistant doesn’t need full AWS credentials. (That’s the lesson Amazon learned the hard way.)

Strong Observability means you need to see what agents are doing, why, and which tools they’re using. If you don’t control the orchestration layer, you still need visibility at your boundary.

Why Should Security Leaders Act Now?

Gartner predicts over 40% of agentic AI projects will be canceled by end of 2027 due to escalating costs, unclear value, or inadequate risk controls. The organizations that build governance into their approach from the start will scale. The rest will become part of that 40%.

Every risk in the Top 10 has already been observed in production. The framework exists. The incidents are piling up. Your executive team and board are likely already pushing for more agentic AI usage. The question is whether you’ll deploy it safely.

I’m breaking down all 10 risks in a video series. Explained so you can brief your board, your leadership team, or your grandmother. Each one covers a real-world incident, a plain-English analogy, and what you can do about it.

Subscribe to the channel so you don’t miss them.