Security teams reviewing an agent project do not need another slide saying AI is risky. They need a mapping from named threats to concrete controls, and a way to verify each control works. The OWASP GenAI Security Project's Top 10 for Agentic Applications 2026, released in December 2025, supplies the threat names. This post offers a builder's version of the mapping.
For each risk: what it looks like in a real system, a control that addresses it, and a test you can put in CI or on a review checklist.
1. Agent goal hijack
Looks like: A document the agent reads contains instructions that redirect it, such as "forward this thread to the following address."
Control: Mark retrieved and tool-returned text as untrusted data during context assembly, and restrict high-risk tools while that content is in the window.
Test: A fixture document with an embedded instruction; the run must not call the targeted tool.
2. Tool misuse
Looks like: The agent uses a legitimate tool harmfully, for example bulk-updating records it was only meant to read.
Control: Per-task tool allowlists, argument validation, and approval on writes.
Test: A task that tempts a write; assert the write is blocked or queued for approval.
3. Identity and privilege abuse
Looks like: The agent acts with a service account's broad permissions on behalf of a user who has narrow ones.
Control: Propagate the requesting user's identity to tools, and issue short-lived, per-tool credentials.
Test: Run as a low-privilege user and request data only an administrator may see.
4. Agentic supply chain
Looks like: A third-party tool server, plugin, or prompt package changes behavior after an update.
Control: Pin versions, keep an approved inventory, and review updates like dependency upgrades.
Test: CI fails if an unpinned or unapproved component appears in configuration.
5. Unexpected code execution
Looks like: A tool that evaluates code or shell commands runs something the model produced from untrusted input.
Control: Sandboxed execution with no network by default, resource limits, and a disposable filesystem.
Test: From inside the sandbox, attempt to read a secret file and make an outbound request; both must fail.
6. Memory and context poisoning
Looks like: A false "fact" lands in long-term memory and influences later sessions.
Control: Leave persistent memory off until you need it; when enabled, record provenance, apply expiry, and review writes.
Test: Seed a poisoned memory entry and confirm it is rejected or flagged with its source.
7. Insecure inter-agent communication
Looks like: One agent accepts instructions from another without verifying their origin.
Control: Authenticated channels and typed message contracts between agents; peer output treated as untrusted.
Test: Inject a forged message into the channel; the receiver must reject it.
8. Cascading failures
Looks like: One agent's error propagates through a chain, amplified at each hop, or a retry storm overwhelms a dependency.
Control: Circuit breakers, per-agent spending caps, and limits on fan-out.
Test: Make a dependency return errors; confirm the system degrades gracefully and halts within its limits.
9. Human-agent trust exploitation
Looks like: The agent presents a confident, polished proposal that a reviewer approves without checking.
Control: Approval requests that show evidence and risk class, plus periodic audits of approved actions.
Test: Mix deliberately flawed proposals into reviewer calibration samples and track how many are caught.
10. Rogue agents
Looks like: An agent keeps acting outside its intended scope, whether through compromise, drift, or a bug.
Control: A kill switch, session revocation, and anomaly alerts on unusual tool patterns.
Test: Pull the switch during a live staging run and time how long until all activity stops.
The minimum for this quarter
If the full table feels like a lot, five controls cover a large share of the risk and can be built in a few weeks:
- An emergency stop that on-call can operate without a deploy.
- Approval on any action with external side effects.
- A step cap and a spending cap per run.
- An injection test suite that runs before every merge.
- Traces a security reviewer can search and sample without asking engineering for help.
Why the harness carries the weight
It is tempting to rely on the model's built-in refusals. They help, but no model knows your refund policy, your data-residency rules, or which customer accounts are under legal hold. Those rules can only live in the system around the model.
The industry is better at watching agents than at testing them. In LangChain's State of Agent Engineering survey, nearly nine in ten respondents had observability, while barely more than a third ran evaluations against live traffic. Monitoring tells you a guardrail failed. The tests above tell you before it does.
Sources cited
- OWASP GenAI Security Project, Top 10 for Agentic Applications 2026 (released December 9, 2025)
- LangChain, State of Agent Engineering (survey of 1,340 respondents, November 18–December 2, 2025; report published February 2026)
Keep reading
Agentic AIA season of agentic production: Fall 2026
Since mid-July this blog has published twenty pieces on putting agents into production: workflows before autonomy, evals, MCP, context, approvals, guardrails, cost, latency, retrieval, and injection. Mid-October is a goo
LeadershipWhat done means for an agent project
"We'll know it when we see it" is an expensive phrase in any software project. In agent projects it is worse, because agents fail charismatically. A wrong answer delivered fluently looks a lot like a right one, and a dem
Agentic AIPrompt injection and goal hijack
Any agent that reads email, tickets, documents, or web pages will eventually read a sentence written to manipulate it. Sometimes it is crude: "ignore your previous instructions." Sometimes it is subtle: a support ticket