OWASP released its Agentic AI Top 10 in December 2025, detailing ten critical risks for AI agents. Unlike many analyses that focus on large-scale platform teams, this breakdown is for individuals running agents on their personal machines, often with extensive tooling and direct system access. If you’re managing multiple agents—like Claude Code, Cursor, OpenClaw, DSH, or custom scripts—and granting them shell access, this is how these risks translate to your workflow.

ASI01: Agent Goal Hijack

Agent Goal Hijack is essentially prompt injection, but its practical impact is amplified when the malicious instruction arrives indirectly. Imagine your agent reads a configuration file, a webpage, or a bug ticket as part of its job. The attack vector isn't the initial prompt you gave; it's data the agent consumes during its execution. The defense here isn't about sanitizing the initial input but securing the tool execution. This means implementing gate checks on tool calls: reject unauthorized tools, deny read access to sensitive directories like ~/.ssh or .env, and establish a log of suspicious injection signal phrases. This prevents the agent from being subtly redirected to malicious goals by compromised data sources.

ASI02: Tool Misuse

Tool Misuse occurs when the agent’s underlying tools are sound, but the arguments passed to them are problematic. This could manifest as a delete command targeting a root directory or a write operation directed at a production system. The risk isn't in the tool itself, but in how the agent is instructed or how it interprets its task. For instance, an agent tasked with cleaning up temporary files might mistakenly interpret a path argument as a system-wide deletion target. The critical control is to validate and constrain the arguments before they are executed. This involves ensuring delete operations are scoped to safe directories, write operations are directed to intended, non-critical locations, and any operation with potentially destructive arguments requires explicit user confirmation or a highly restricted execution environment. Think of it like giving a powerful tool to an assistant: you trust the tool, but you must carefully review the specific instructions and materials they’re about to use it on.
Agent arguments being validated before execution by a security layer

ASI03: Sensitive Data Exposure

This risk pertains to agents inadvertently leaking confidential information. This can happen if an agent’s training data contains sensitive details, or if it accesses and processes files containing private data without proper safeguards. For local agents, this is particularly relevant if you’re running models that were fine-tuned on proprietary datasets or if your agent has broad read access to your local file system. Mitigations include rigorous data sanitization during training, implementing strict access controls on files the agent can read, and employing output filtering to detect and redact sensitive information before it’s displayed or logged. For developers running agents locally, this means ensuring your agent's working directories are isolated and that it doesn't have unfettered access to your sensitive configuration files or codebases.

ASI04: Insecure Plugin and Function Calling

Plugins and function calls extend an agent's capabilities, but they also introduce vulnerabilities. If an agent can call arbitrary functions or load untrusted plugins, an attacker could execute malicious code. This is especially pertinent for agents that allow dynamic loading of code or external libraries. The solution involves a strict allowlist for all callable functions and plugins. Each function call should be validated for its intended purpose and arguments, and plugins should be vetted for security and functionality before being integrated. For a developer running agents, this means carefully scrutinizing any third-party plugins or custom functions you integrate, ensuring they come from trusted sources and have been audited.

ASI05: Prompt Bleeding

Prompt Bleeding occurs when an agent’s internal prompts or instructions are exposed to the user or other agents. This can reveal the agent's logic, capabilities, or even sensitive system information embedded within the prompts. For instance, if an agent’s system prompt contains API keys or proprietary instructions, and it inadvertently includes these in its responses, it constitutes prompt bleeding. Preventing this involves careful prompt engineering, ensuring that sensitive information is never included in prompts meant for user interaction, and implementing output filters to catch any accidental leakage. A developer might encounter this if their agent’s debugging output accidentally includes parts of its core instructions.

ASI06: Overreliance

Overreliance on AI agents can lead to a degradation of human skills and critical thinking. If an agent is making critical decisions or performing complex tasks without adequate human oversight, mistakes can go unnoticed. This is less a technical vulnerability and more a workflow risk. For developers, it means not blindly trusting an agent's code suggestions or system configurations. Always review the output, test thoroughly, and maintain a deep understanding of the tasks the agent is performing. The agent should augment, not replace, your expertise. Treat its output as a first draft or a suggestion, never the final word.

ASI07: Model Denial of Service (DoS)

This involves overwhelming an agent's underlying language model with complex or malformed requests, causing it to consume excessive resources or fail to respond. For large, cloud-based models, this might be a traditional DoS attack. On a local machine, however, it means an agent might grind your CPU or memory to a halt with a computationally intensive prompt. An agent might be tricked into entering a recursive loop of complex reasoning or generating extremely long, resource-intensive outputs. Defending against this requires input validation to detect and reject overly complex or resource-intensive prompts, rate limiting on API calls (if applicable), and implementing timeouts for agent operations. For local agents, this also means monitoring resource usage and having kill switches for runaway processes.

ASI08: Supply Chain Vulnerabilities

AI agent supply chains include the models, libraries, data, and tools they depend on. A vulnerability in any of these components can compromise the agent. For example, if an agent uses a third-party library that has a known exploit, or if the model itself has been tampered with, the agent becomes a vector for attack. Developers must be diligent about updating dependencies, using trusted sources for models and libraries, and verifying the integrity of their AI components. This is akin to traditional software supply chain security, but applied to the AI stack.

ASI09: Unreasonable Access

This risk pertains to agents having more permissions than necessary to perform their tasks. If an agent has shell access, it should only have access to the specific directories and commands required for its function. Granting broad read/write access or elevated privileges increases the potential damage if the agent is compromised or misbehaves. Implement the principle of least privilege: grant only the minimum permissions required. This means carefully configuring user permissions, using containerization or sandboxing where possible, and regularly auditing the access rights granted to your agents. For a developer running multiple agents, this is critical: one compromised agent with excessive privileges could jeopardize your entire system.

ASI10: Agent Prompt Length Attacks

This is a specific type of DoS or manipulation where an attacker crafts an extremely long prompt designed to exploit the agent’s context window limitations or processing capabilities. This can lead to performance degradation, increased costs (if using paid APIs), or unexpected behavior as the agent struggles to manage the large context. Some agents might truncate information, others might become slow or unresponsive. Defending against this involves setting reasonable limits on prompt lengths, especially for user-provided inputs, and monitoring processing times to detect anomalies. For local agents, this translates to ensuring your system doesn't become unresponsive when processing very large inputs. These ten risks form a crucial checklist for anyone building, deploying, or running AI agents, especially in a personal or developer-centric environment. Understanding and mitigating these vulnerabilities is key to building secure and reliable agentic systems.