In December 2025, the OWASP GenAI Security Project published the Top 10 for Agentic Applications (2026) , the first ranked, peer-reviewed list of the risks that emerge once an LLM stops being a chatbot and starts acting: calling tools, running commands, carrying memory between sessions, and setting consequences in motion without a human in the loop. It builds on the deeper Agentic AI: Threats and Mitigations taxonomy (the T1 to T15 research).

This walkthrough covers all ten, ASI01 to ASI10, with a concrete example for each. A useful lens runs through the list: some agentic risks live inside the model's reasoning or the wire between agents, while others surface as a concrete action, a command, an install, a secret read, a tool call. The defenses differ. We build AgentTrail , an observability and action-governance layer for coding agents, so each item closes with a short, honest note on where that kind of tooling helps, where it only adds visibility, and where it does nothing.…