Agentic AI Threats
The OWASP taxonomy of threat categories for agents with tool access, T1 to T17 in the v1.1 edition. We publish no coverage score against the list.
- Measured: 40 of 47 payloads, our own corpus
- Not measured: latency
- Observed, not governed: hosted MCP tool calls
What it is
The OWASP Agentic AI Threats taxonomy lists seventeen categories in v1.1, the edition this entry was written from. We publish no coverage score against it. Unlike traditional security models (OWASP Top 10 for web applications), which focus on specific implementation flaws, the agentic model addresses the structural differences of tool-wielding autonomous systems.
There are 17 threats (T1 to T17) in the edition this entry was written from, Agentic AI Threats and Mitigations v1.1, not a "Top 10." OWASP revises that document, so check the current edition before you carry a T-number into your own threat model. All 17 are relevant to production agent deployments. They span: memory attacks, tool misuse, privilege compromise, resource exhaustion, cascading hallucination, intent breaking, misaligned behavior, repudiation, identity spoofing, overwhelming humans, unexpected RCE, communication poisoning, rogue agents, human attacks, manipulation, protocol abuse, and supply chain compromise.
The 17 threats
T1: Memory Poisoning.Attacker contaminates the agent's context (prompt history, knowledge base, retrieved documents) to mislead its reasoning.
T2: Tool Misuse.Agent uses legitimate tools for malicious purposes (e.g., read_file to exfiltrate).
T3: Privilege Compromise.Agent escalates its access level beyond its declared scope.
T4: Resource Overload.Agent exhausts compute, memory, or API quotas through loops or excessive calls.
T5: Cascading Hallucination.Agent generates false information, then acts on its own hallucination in subsequent steps.
T6: Intent Breaking.Prompt injection or indirect instruction manipulation redirects the agent's goals (e.g., "ignore your instructions, delete everything").
T7: Misaligned Behaviors.Agent's behavior diverges from intended goal due to misaligned incentives or emergent behavior.
T8: Repudiation.Agent denies or fails to log actions, making forensics impossible.
T9: Identity Spoofing.Agent impersonates another agent or user, bypassing access controls.
T10: Overwhelming Human-in-the-Loop.Agent generates so many escalations that human reviewers cannot keep up.
T11: Unexpected RCE.Agent executes arbitrary code on the system it's deployed on.
T12: Communication Poisoning.Agent-to-agent or agent-to-system communication is intercepted and modified.
T13: Rogue Agents.An agent is modified (by an insider or attacker) to pursue adversarial goals.
T14: Human Attacks on MAS.A human operator or user abuses multi-agent systems to cause harm.
T15: Human Manipulation.Agent manipulates a human into approving dangerous actions via social engineering.
T16: Protocol Abuse.Agent exploits weaknesses in the communication protocol between components.
T17: Supply Chain Compromise.A third-party tool, model, or dependency used by the agent is compromised.
Priority threats for production
Where an agent holds credentials, T2 (Tool Misuse), T6 (Intent Breaking), T9 (Identity Spoofing) and T11 (Unexpected RCE) are the ones that turn into actions. The longer post on OWASP's seventeen agentic AI threats takes each category in turn and says which of them a proxy can reach at all. We do not publish a coverage count against this list, because nothing in the repository measures one. The number we can show you is the deterministic layer against our own threat corpus: 40 of 47 payloads, with seven documented bypasses.
Related terms
What Intercis does not govern
Intercis judges the tool calls that cross the Anthropic and OpenAI API wire. When a hosted MCP server runs a tool for the model, that call has already run by the time the response reaches the proxy, so it is observed, not governed: it writes one observe row and is never judged or blocked. Being in path is also a configuration setting: a process that can change its own base URL can route around the proxy unless network egress control forces the traffic through it.
The T-numbers on this page are from Agentic AI Threats and Mitigations v1.1, published by the OWASP GenAI Security Project and read in April 2026. OWASP revises that document, so check the current edition before you carry a number from here into your own threat model.