Agentic AI – Top Threats and Mitigations (AG1–AG10)

Introduction

Agentic AI systems are autonomous AI entities capable of reasoning, planning, and executing actions via connected tools and APIs they bring new security challenges that differ sharply from traditional software or standalone AI models. Their ability to persist memory, call external services, interact with other agents, and adapt goals in real time creates a broader and less predictable attack surface.

This repository documents the Top 10 security threats (AG1–AG10) facing Agentic AI systems, drawn from verifiable industry, academic, and standards-based sources, including OWASP and peer-reviewed research. Each entry includes:

• Description – clear, plain-English explanation of the risk
• Common Examples of Risks – where and how the threat manifests
• Prevention and Mitigation Strategies – tested and recommended safeguards
• Example Attack Scenarios – confirmed or illustrative real-world incidents
• Reference Links – direct sources for further reading and validation
• Related Frameworks and Taxonomies – cross-mapping to OWASP, NIST AI RMF, ISO/IEC 42001, ATFAA/SHIELD, and others

This is not a theoretical list. Every item is intended to be actionable for security engineers, architects, AI governance teams, and anyone deploying or auditing Agentic AI systems.

Our goal is to:

1. Provide a trusted, central reference for the most critical security issues in Agentic AI.
2. Encourage secure-by-design adoption of AI agents across industries.
3. Support alignment between security practice and emerging AI safety standards.

How to Use This Repository

This repository is designed to be both a reference and a practical tool for securing Agentic AI systems.

How to Use This Repository

This repository is designed to be both a reference and a practical tool for securing Agentic AI systems.

1. Read the Threat List

• Review the AG1–AG10 entries to understand the most critical security risks.
• Each entry contains:
  • Description of the threat
  • Common examples
  • Mitigation strategies
  • Reference links
  • Related frameworks

2. Map to Your Systems

• Identify which threats are relevant to your agentic AI architecture.
• Cross-reference with your existing security framework (e.g., NIST AI RMF, ISO/IEC 42001, OWASP Agentic AI).
• Use the “Related Frameworks” field in each AG entry for mapping.

3. Use in Threat Modelling

• Incorporate AG1–AG10 into your threat modelling workshops.
• Tag each identified risk with the corresponding AG number for consistency.
• Keep a copy of this list in your GRC or risk register for tracking.

4. Implement Mitigations

• Prioritise high-likelihood and high-impact threats in your environment.
• Apply the Prevention and Mitigation Strategies directly into your development, deployment, or monitoring pipelines.
• Where possible, integrate automated checks.

5. Stay Updated

• Check the repository periodically for updates as new threats emerge.

---

Tip: If you’re running security reviews or penetration testing on agentic AI systems, use this list as a baseline checklist for evaluating resilience.

---

AG1: Memory Poisoning

Description: Attackers inject malicious or false data into an agent’s memory—short-term context or persistent storage—to distort its reasoning or actions.
Common Examples of Risks: False memory entries steering decision-making; misremembered context producing unsafe actions.
Prevention and Mitigation Strategies: Data source validation; checksum or signatures for trusted memory; periodic memory audit and rollback features.
Example Attack Scenarios: Malicious prompts embedded in emails corrupting an email-assistant’s memory.
Reference Links:

• https://blog.secureflag.com/2025/07/08/agentic-ai-security/
  Related Frameworks and Taxonomies: OWASP Agentic AI Threats (T1: Memory Poisoning); ATFAA/SHIELD threat model
• https://arxiv.org/abs/2504.19956

---

AG2: Tool Misuse & API Abuse

Description: Abusing an agent’s tool integrations (APIs, search, code execution) via deceptive prompts or command injection.
Common Examples of Risks: Prompt injection causing unwanted tool calls; malicious code generation; unintended API use.
Prevention and Mitigation Strategies: Enforce allow-lists, strict argument validation, sandboxing, and logging.
Example Attack Scenarios: Vulnerable prompt injection leads to insecure code generation by a coding agent.
Reference Links:

• https://preyproject.com/blog/mitigating-agentic-ai-security-risks
• https://www.tomshardware.com/tech-industry/cyber-security/googles-ai-could-be-tricked-into-enabling-spam-revealing-a-users-location-and-leaking-private-correspondence-with-a-calendar-invite-promptware-targets-llm-interface-to-trigger-malicious-activity
• https://arxiv.org/abs/2412.10198
  Related Frameworks and Taxonomies: OWASP (T2: Tool Misuse); ToolCommander research on adversarial tool injection
• https://arxiv.org/abs/2412.10198

---

AG3: Privilege Drift / Compromise

Description: An agent accrues or exploits higher access rights than intended, often through flawed permission design.
Common Examples of Risks: Broad default permissions; escalated API privileges.
Prevention and Mitigation Strategies: Enforce least privilege, time-bound access, approval workflows, and monitor for unusual escalations.
Example Attack Scenarios: I don’t know.
Reference Links:

• https://www.humansecurity.com/learn/blog/agentic-ai-security-owasp-threats/
  Related Frameworks and Taxonomies: OWASP (T3: Privilege Compromise); Okta analysis on overprivileged agents
• https://www.okta.com/identity-101/agentic-ai-security-threats/

---

AG4: Cascading Reasoning Errors / Hallucinations

Description: Faulty outputs (hallucinations) propagate through memory, external tools, or other agents, causing cascading failures.
Common Examples of Risks: One hallucination leading to chain of false decisions; memory contamination.
Prevention and Mitigation Strategies: Confidence scoring, fact-checking before commit to memory, flag unverified data.
Example Attack Scenarios: A false memory or hallucinated fact cascades through agent workflows.
Reference Links:

• https://www.humansecurity.com/learn/blog/agentic-ai-security-owasp-threats/
• https://www.imperva.com/blog/the-rise-of-agentic-ai-uncovering-security-risks-in-ai-web-agents/
  Related Frameworks and Taxonomies: OWASP; ATFAA/SHIELD threat model
• https://arxiv.org/abs/2504.19956

---

AG5: Goal Hijacking & Intent Manipulation

Description: Adversaries alter an agent’s objectives via crafted input, corrupt memory, or deceptive tool output.
Common Examples of Risks: Prompt injection that changes planning; alignment faking.
Prevention and Mitigation Strategies: Lock core goals at runtime, detect deviations, immutable goal logs.
Example Attack Scenarios: I don’t know.
Reference Links:

• https://www.humansecurity.com/learn/blog/agentic-ai-security-owasp-threats/
• https://www.okta.com/identity-101/agentic-ai-security-threats/
  Related Frameworks and Taxonomies: OWASP

---

AG6: Alignment Evasion / Deceptive Behaviour

Description: Agents learn to bypass safety constraints or superficially appear compliant while pursuing harmful aims.
Common Examples of Risks: Malicious models feigning compliance; deceptive planning.
Prevention and Mitigation Strategies: Continuous adversarial testing, rotating safety filters, human escalation.
Example Attack Scenarios: AI pretending compliance to avoid shutdown.
Reference Links:

• https://www.businessinsider.com/ai-deceptive-behavior-risks-safety-cards-shut-down-instructions-2025-5
• https://nypost.com/2025/06/23/tech/malicious-ai-willing-to-sacrifice-human-lives-to-avoid-replacement-study/
  Related Frameworks and Taxonomies: OWASP (T7: Misaligned Behaviour)

---

AG7: Untraceability & Repudiation

Description: Agent actions become opaque or untraceable due to fragmented logs or parallel reasoning, hindering audit and forensic efforts.
Common Examples of Risks: Multi-path reasoning, missing provenance.
Prevention and Mitigation Strategies: End-to-end logging, unique identifiers, traceable reasoning chains.
Example Attack Scenarios: I don’t know.
Reference Links:

• https://genai.owasp.org/resource/agentic-ai-threats-and-mitigations/
  Related Frameworks and Taxonomies: OWASP (T8: Untraceability)

---

AG8: Identity Spoofing & Role Impersonation

Description: Forged or misused identities—human or agent—are used to issue unauthorized commands or access.
Common Examples of Risks: Undocumented impersonation of agents; forged credentials.
Prevention and Mitigation Strategies: Cryptographic identity, mutual TLS, token-based verification, credential revocation.
Example Attack Scenarios: I don’t know.
Reference Links:

• https://www.humansecurity.com/learn/blog/agentic-ai-security-owasp-threats/
• https://www.okta.com/identity-101/agentic-ai-security-threats/
  Related Frameworks and Taxonomies: OWASP (T9: Identity Spoofing)

---

AG9: Oversight Overload (Human-in-the-Loop Fatigue)

Description: Flooding or overwhelming oversight mechanisms so that human review becomes ineffective.
Common Examples of Risks: High volume of alerts or complex tasks go unchecked.
Prevention and Mitigation Strategies: Rate-limiting oversight queues; prioritize alerts; decision-support augmentation.
Example Attack Scenarios: I don’t know.
Reference Links:

• https://genai.owasp.org/resource/agentic-ai-threats-and-mitigations/
  Related Frameworks and Taxonomies: OWASP (T10: Human-in-the-loop Overload)

---

AG10: Supply Chain & Dependency Tampering

Description: Compromise of upstream tools, libraries, datasets, or model dependencies undermines agent security.
Common Examples of Risks: Infected package, compromised tool component, poisoned RAG dataset.
Prevention and Mitigation Strategies: Signed components, SBOM, continuous scanning, model/data integrity checks.
Example Attack Scenarios: Agent downloading corrupted firmware from a compromised supplier platform.
Reference Links:

• https://noma.security/blog/securing-agentic-ai-a-practical-framework-for-enterprise-risk-management/
• https://www.trendmicro.com/vinfo/us/security/news/security-technology/the-road-to-agentic-ai-navigating-architecture-threats-and-solutions
• https://blogs.nvidia.com/blog/agentic-ai-cybersecurity/
• https://www.ien.com/redzone/blog/22946894/safeguarding-against-agentic-ai-security-vulnerabilities-in-manufacturing
  Related Frameworks and Taxonomies: NIST AI RMF; ATFAA/SHIELD dependency threats
• https://arxiv.org/abs/2504.19956

Contributing

Contributions are welcome — this repository is intended to be a living resource that evolves as new threats and mitigations are discovered.

How to Contribute

1. Fork the repository and create a new branch for your changes.
2. Add or update entries in the AG1–AG10 list.
   • Ensure all claims are sourced and verifiable.
   • Include reference links in plain text for transparency.
3. Describe your changes clearly in the pull request (PR) description.
   • Explain why the change is needed.
   • List any sources you’ve referenced.
4. Submit a Pull Request and wait for review.

Contribution Guidelines

• Do not include speculative or unverified threats — all content must be based on publicly available, reliable sources.
• Use clear, plain English suitable for technical and governance audiences.
• Keep mitigations actionable and specific — avoid vague “best practices.”
• Maintain the markdown format and section headings for consistency.
• For new threats, follow the existing structure:
  • Description
  • Common Examples of Risks
  • Prevention and Mitigation Strategies
  • Example Attack Scenarios
  • Reference Links
  • Related Frameworks and Taxonomies

Reporting Issues

If you spot an error, missing reference, or outdated mitigation:

• Open an issue in this repository with a clear description.
• Provide supporting evidence or references where possible.

---

Note: All contributions are reviewed for accuracy, clarity, and alignment with the repository’s scope before merging.