Back to practice
Security for AI

Anatomy of an Agentic AI Attack

Agentic AI introduces a new attack surface: agents that remember, hold privileges, use tools, and talk to each other. Pick a threat, run the exploit step by step, then deploy the controls that break the chain. These are the threat models my practice helps clients defend against.

Memory Poisoning

OWASP T1 / ASI06

The trap that waits. A payload sits dormant in the agent’s memory, then detonates later.

Attacker
Agent
Memory
Retrieval
Action
Run the exploit to see how this attack unfolds step by step. Then deploy the controls that stop it.

OWASP Top 10 for Agentic Applications

Official ranked list, released Dec 2025 (ASI01–ASI10).

  1. ASI01Agent Goal HijackT6
  2. ASI02Tool MisuseT2
  3. ASI03Identity & Privilege AbuseT3 + T9
  4. ASI04Agentic Supply Chain Vulnerabilities—
  5. ASI05Unexpected Code ExecutionT11
  6. ASI06Memory & Context PoisoningT1 + T5
  7. ASI07Insecure Inter-Agent CommunicationT12
  8. ASI08Cascading FailuresT5 + T14
  9. ASI09Human-Agent Trust ExploitationT15 + T10
  10. ASI10Rogue AgentsT13

Threats & Mitigations Taxonomy

Full technical reference, T1–T15 (v1.0 Feb 2025, v1.1 Dec 2025).

  1. T1Memory Poisoning
  2. T2Tool Misuse
  3. T3Privilege Compromise
  4. T4Resource Overload
  5. T5Cascading Hallucination Attacks
  6. T6Intent Breaking & Goal Manipulation
  7. T7Misaligned & Deceptive Behaviors
  8. T8Repudiation & Untraceability
  9. T9Identity Spoofing & Impersonation
  10. T10Overwhelming Human-in-the-Loop
  11. T11Unexpected RCE and Code Attacks
  12. T12Agent Communication Poisoning
  13. T13Rogue Agents in Multi-Agent Systems
  14. T14Human Attacks on Multi-Agent Systems
  15. T15Human Manipulation

Sources

Discuss securing your AI agents