In December 2025 the OWASP GenAI Security Project's Agentic Security Initiative published the Top 10 for Agentic Applications . Most write-ups walk through the ten risks, and this one does too, briefly. It then reads the prevention sections for a narrower question: what the list asks you to record about your agents, and what properties it expects those records to have. The answer is more demanding than "keep logs", and the most useful sentence on the subject comes in the last entry.

The ten risks in one pass

The entries are numbered ASI01 to ASI10. Condensed from the document's own descriptions:

ASI01 Agent Goal Hijack. An attacker redirects the agent's objectives or decision pathways, because agents "cannot reliably distinguish instructions from related content." The mechanics are in our piece on indirect prompt injection .

ASI02 Tool Misuse and Exploitation. Legitimate tools used harmfully through injection, misalignment, unsafe delegation or ambiguous instructions.

ASI03 Identity and Privilege Abuse.…