OWASP Agentic Top 10 — 2026 (ASI)

Inkog covers 7 of 10 OWASP Agentic risks today. 10 of 10 by Q3 2026.

The OWASP Agentic Security Initiative published the Top 10 for Agentic Applications (ASI) in 2026. We map every Inkog finding to the specific ASI item it covers — by file, line, and rule ID.

Source: OWASP Top 10 for Agentic Applications 2026 — full text at genai.owasp.org.

7
Strong coverage
1
Partial — closing
2
Gap → ≤30 days
Strong coverage
ASI01

Agent Goal Hijack

User input or environmental data overrides the agent's intended goal.

prompt_injectiongoal_conflict

Notes: Detection across all 15 framework adapters via the universal IR.

Strong coverage
ASI02

Tool Misuse & Exploitation

Agents misuse tools — recursive call loops, code execution, privilege escalation.

recursive_tool_callingexcessive_permissionsexec_evalcommand_injection

Notes: Inkog's strongest category. Catches the AutoGen CodeExecutor + LangChain ReAct loop patterns.

Partial — see notes
ASI03

Agent Identity & Privilege Abuse

Agents act with inherited or escalated privileges they shouldn't hold.

missing_authztoken_validation

Notes: Missing: agent-identity-chain modeling. Coming Q3 2026.

Strong coverage
ASI04

Agentic Supply Chain Compromise

Compromised models, skills, MCP servers, or training data poisoning the agent.

supply_chaininkog_audit_mcp_serverdata_poisoning

Notes: Inkog's MCP server audit is unique — covers ClawHavoc + Smithery patterns.

Strong coverage
ASI05

Unexpected Code Execution

Agent generates and executes code (or eval-style content) without sandboxing.

exec_evalcommand_injectionunsafe_deserialization

Notes: AST-level taint analysis catches LLM-output → subprocess.run flow.

Partial — see notes
ASI06

Memory & Context Poisoning

Persistent memory or RAG context is poisoned by adversarial input.

data_poisoningcontext_window_accumulationrag_overfetching

Notes: Missing: persistent memory-store probing. Coming Q3 2026.

Partial — see notes
ASI07

Insecure Inter-Agent Communication

Multi-agent messages lack signing, encryption, or replay protection.

unsigned_messagesinkog_audit_a2a

Notes: Detects unsigned messages today; no encryption/replay checks yet.

Gap — shipping ≤30 days
ASI08

Cascading Agent Failures

One agent's failure propagates through a delegation chain.

Notes: Static-analysis-hard. Shipping in 30 days: delegation depth >3 without bounded recursion, agents writing shared memory without scoping.

Strong coverage
ASI09

Human-Agent Trust Exploitation

Operators over-rely on agent decisions, automate bias, or skip review.

overreliancemissing_oversight

Notes: Maps directly to EU AI Act Article 14(4)(b) automation bias.

Gap — shipping ≤30 days
ASI10

Rogue Agents

Agents act outside their declared scope (drift, misalignment, or compromise).

Notes: Static approximations shipping in 30 days: kill-switch absence, rate-limit + audit-log combined.

See your OWASP Agentic coverage in 60 seconds

Paste a GitHub URL or upload a zip. Inkog returns findings mapped to OWASP ASI + OWASP LLM Top 10 + NIST AI RMF + EU AI Act Article 14.

Scan now 15-min walkthrough