The OWASP Agentic Top 10 maps ten places an agent that plans and acts can be turned: goal hijack, tool misuse, identity, supply chain, code execution, memory, inter-agent messages, cascades, human trust, and rogue drift. The control sits on the host, before the tool runs.
The model cannot tell
An instruction and the content around it look the same. A page, an email, or a tool result can rewrite the goal.
Goal hijack
Treat external text as data. Pause if the proposed action leaves the original task.
Tool misuse
A legitimate tool, used wrong. Schema, fully qualified name, rate and egress limits. Fail closed.
Identity
One identity per agent. Short-lived, task-scoped credentials. Re-check every privileged step.
Memory versus drift
ASI06 stores a lie for later. ASI10 is the behavior after the attacker is gone. ASI08 is the spread.
The person
A confident rationale is not evidence. Preview has no side effect. Multi-step confirmation for irreversible acts.
The host
Lookup and refund are two tools. Deny is the default. The prompt is not the control.