In December 2025, the OWASP GenAI Security Project published a second top ten list. The original OWASP Top 10 for Large Language Model Applications addresses systems that generate content. The newer list, the OWASP Top 10 for Agentic Applications, addresses systems that take action. It was announced at Black Hat Europe, assembled with input from more than a hundred security practitioners and researchers, and uses the identifiers ASI01 through ASI10.

The decision to publish a separate list is the most useful thing about it. A language model that produces a wrong answer produces bad text, and a person reads it and decides what to do next. An agent that reaches a wrong conclusion books the travel, merges the branch, sends the message or moves the data. The failure mode changes from misinformation to unauthorized action, and the controls that address the first do not address the second.

The entries reflect that shift. Agent Goal Hijack sits at the top of the list: manipulation of what an agent is trying to achieve, rather than of any single response. Tool Misuse and Exploitation covers abuse of the capabilities an agent has been granted. Identity and Privilege Abuse addresses what happens when an agent's permissions exceed the task in front of it. Memory and Context Poisoning deals with contamination that persists beyond a single interaction. Human-Agent Trust Exploitation covers the confidence people place in an agent's output. Rogue Agents closes the list.

Memory poisoning deserves particular attention, because it breaks an assumption most security teams still hold. A conventional injection attack ends when the request ends. An agent with persistent memory can carry a planted instruction forward into later sessions, triggered by a condition the attacker chose, long after the interaction that introduced it has been forgotten. The containment boundary is no longer the session.

The same movement is visible in the language model list, where prompt injection remains the first entry and excessive agency — granting a model more capability, permission or autonomy than its function requires — has climbed. Both lists are converging on the same point from different directions: the risk increasingly lies in what the system is allowed to do, not in what it says.

Neither list is a compliance standard, and OWASP is explicit about that. They are risk awareness tools. Nobody is certified against them. Their value is as a shared vocabulary and a checklist for a class of system that most organizations deployed faster than they governed.

Practically, four things are worth doing before an incident forces them.

Inventory the agents. Most organizations cannot currently produce a list of the agents running against their data, the tools each one can call, and the identity each one uses. That inventory is the prerequisite for every other control.

Give each agent its own identity. Shared service accounts make it impossible to attribute an action, and attribution is the basis of every investigation you will ever run.

Scope tools to the task. An agent that only needs to read should not hold a credential that can write. Capability granted for convenience is the mechanism by which goal hijack turns into damage.

Put approval gates on irreversible actions. The question is not whether an agent will ever be manipulated. It is what it can complete unaided when it is.

The organizations that handle this well will not be the ones with the most sophisticated AI. They will be the ones that treated their agents as privileged actors from the start, and can still answer, on any given day, exactly what those agents are permitted to do.