LLMs vs. Agents: The Security Shift
A standard LLM application takes an input and generates text. The primary risk is what the model says. An Agentic application takes a high-level goal, reasons through a plan, and autonomously uses tools (APIs, databases, web browsers) to achieve that goal. The primary risk shifts from what the model says to what the model does.
The OWASP Agentic Top 10 addresses the unique systemic risks that arise when you grant autonomy and agency to non-deterministic models.
ASI01: Agent Goal Hijack
Theoretical Mechanism
This is the agentic equivalent of prompt injection, but significantly more dangerous. Instead of just altering a single response, Goal Hijacking redirects the agent's multi-step objective. Because agents autonomously plan and execute steps, an attacker can insert a secondary objective into the data the agent processes. The agent will continue working, but it will now execute steps to fulfill the attacker's hidden goal alongside, or instead of, the user's original goal.
ASI02: Tool Misuse
Theoretical Mechanism
Agentic workflows often involve chaining multiple tools together. Tool Misuse occurs when an agent uses a legitimate tool in an unsafe, unexpected, or destructive manner. This can happen due to hallucinations (the agent misunderstands the tool's purpose) or due to malicious manipulation of the agent's reasoning process. The risk is amplified when tools are overly permissive or lack intrinsic safety constraints.
ASI05: Unexpected Code Execution
Theoretical Mechanism
Advanced agents often write and execute their own code (e.g., Python scripts) to solve complex analytical problems or parse data. If an attacker can influence the code generation process—either through prompt injection or by manipulating the data the agent is analyzing—they can force the agent to generate and execute malicious code, leading to Remote Code Execution (RCE) on the agent's host infrastructure.
ASI07: Insecure Inter-Agent Communication
Theoretical Mechanism
Modern architectures often utilize multi-agent systems, where specialized agents communicate to solve larger tasks. If one agent in the swarm is compromised (e.g., a web-browsing agent encounters a malicious webpage), it can pass manipulated instructions to other internal agents (e.g., the database agent). Without strict authentication and message validation between agents, a single compromised node can cause cascading failures across the entire system.
Architecting Secure Agents (Defense-in-Depth)
Securing autonomous agents requires shifting from reactive filtering to proactive, stateful constraints.
1. Immutable Goal Specification
The agent's primary objective must be cryptographically signed or stored in a tamper-proof state mechanism. Before executing any major tool or progressing to a new planning phase, the agent framework must cryptographically verify that the current action aligns with the original, immutable goal, preventing Goal Hijacking.
2. Isolated Execution Environments (Sandboxing)
To mitigate Unexpected Code Execution (ASI05), any code generated by the agent must be executed in a tightly restricted, ephemeral sandbox (such as a gVisor container or WebAssembly runtime). This environment must have zero network access (unless explicitly required and allowlisted) and no access to the host filesystem.
3. Cryptographic Agent Identity
In multi-agent systems, agents must authenticate each other. Implement mutual TLS (mTLS) or JWT-based identity verification for all inter-agent communication to ensure that commands are originating from trusted peers, mitigating ASI07.
4. Human-in-the-Loop (HITL) Checkpoints
Complete autonomy is dangerous. Implement deterministic state machines that pause the agent's execution and require human authorization before any "high-stakes" action is taken (e.g., modifying database records, executing financial transactions, or sending external emails).
5. Behavioral Anomaly Detection
Monitor the agent's telemetry—how many tools it calls, the sequence of operations, and the time taken for reasoning. If an agent suddenly deviates from its baseline behavior (e.g., attempting to call an export tool 50 times in a row), the framework should trip a circuit breaker and halt execution.