Top 10 Security Risks in AI Agents Explained

Key Takeaways

Everyone is talking about AI agents right now, which usually means half the room is pretending they know what one actually is. So, let's clear it up for those folks. Here's the simplest definition I know of that actually works. Agents are essentially models using tools in a loop autonomously. That's it. Models using tools in a loop with autonomy. uh you kick off the process by telling the agent what you want it to do, what the objective is and then it figures out how and actually does that thing all by itself. This capability can be tremendously powerful as a force multiplier. It's as if you're now the leader of a whole team of highly intelligent, highly motivated employees intent on executing your instructions with speed and scale. Sounds great, right? Well, to error is human, but to really mess up requires a computer. And that's what can happen if you don't make sure that your agents are secure and operating under your control. In this video, we're going to take a look at the top 10 ways an agent can get hijacked by an attacker and how to prevent it from happening. OASP, the Open Worldwide Application Security Project, is an industry consortium known for its top 10 vulnerabilities list. For more than a decade, they've been producing a top 10 for web applications. And in the past few years, they've taken on large language models as well. In fact, I've done some videos on these. We're going to use their recent work on AI agents to examine and inform how we should be securing them. So, let's start with looking at the overall architecture of an agent. So, an agent is basically got three major components to it. It's got inputs. It's got a processing or thinking reasoning component. And then it's got some outputs. So what goes into each of these? Well, the inputs. This is basically where one example of inputs could be a prompt. You know, a a user here is going to type something in and that goes into the system. Another example is our system could be called by an API. So we could have a system where the API is in fact calling our agent and that's what's kicking it off. It could also be another agent that's calling our agent. So these are basically the inputs or the perception part of the agent. Now there's the the real thinking the processing the reasoning part of all of this here in the middle. Uh this is where we're going to have the reasoning that occurs. But we don't just want reasoning. We want it to also be informed by things like data sources. So, we're going to have data sources that are training the models that are used in this because remember I said an agent begins with a model. Here's the model. Well, the model begins with data. And we might have other data sources as well. So, we could have something like a rag data set, a retrieval augmented generation data set that is feeding in here as well. And and actually, it's probably feeding in more this way, but you could use it in in either context. Um, and then we're also going to have a policy component because we want this thing to be able to basically operate under the rules that we have for it. And then ultimately, we need to have a human in the loop. And the human in the loop is going to be the oversight component of all of this. So that's really the processing components of all of this. But ultimately, the agent is going to take action and that's where the outputs come in. So the agent could then call tools. It could call another API to kick off yet another program that's going to do something, write something in a database or something like that. Or it could delegate some responsibilities to yet another agent. So here you see the possibility of an agent calling an agent uh to do something which then calls yet other agents. And you can see how this thing gets really complex in a hurry. If all of this is operating autonomously, if it's working well and it's following the policies and the humans are overseeing it, we're good. Uh, but there's a lot of areas here that someone could trip this thing up. So, this architecture is really powerful in its ability to amplify human capabilities. But if we aren't careful, it can also be a risk amplifier. So, let's take a look at the top 10 list of vulnerabilities for AI agents according to OWASP. Number one on their list, agent goal hijack. Agent goal hijack occurs when an attacker manipulates what an agent is trying to achieve, not just what it says. Agents can't reliably distinguish instructions from content. Which means that hidden prompts in documents, in emails, or web pages can silently redirect planning and execution. Once the goal shifts, the agent behaves correctly, but toward the wrong objective. Number two on the list, tool misuse and exploitation. Agents have the potential to misuse legitimate tools that they're authorized to use. Overprivileged access, ambiguous instructions, or unsafe chaining can lead to data loss, exfiltration, or costly actions without any exploit. The risk comes from autonomy combined with weak guard rails. That's a bad combination. Number three, identity and privilege abuse. Agentic systems frequently operate without a clearly governed identity. Agents inherit user credentials, trust other agents by default, or reuse cached access, enabling privilege escalation and confuse deputy attacks. Without task scoped, timebound permissions, least privilege breaks down. Number four, Agentic supply chain vulnerabilities. Agentic systems dynamically load tools, prompts, plugins, and even other agents at runtime. A poisoned registry, descriptor, or MCP server can inject malicious behavior instantly across many agents. This turns a supply chain into a live, continuously exploitable surface. Number five on the list, unexpected code execution. Many agents generate and execute code automatically. prompt injection, unsafe serialization or tool chaining can escalate into remote code execution or sandbox escape. Because the code is generated dynamically, traditional security controls often fail to detect it. So that's the first five list of vulnerabilities. Let's roll through the final five. Number six, memory and context poisoning. Agents rely on stored memory to reason across time. Attackers can poison that memory through uploads, rag sources, shared context, or peer agents, causing future decisions to become biased or even unsafe. The danger lies in persistence, not just the initial injection. Number seven, insecure inter agent communication. Multi-agent systems depend on constant message exchange. When agentto agent communication lacks strong authentication, integrity, and semantic validation, attackers can spoof, replay, or manipulate instructions. This enables coordinated failures that are really hard to trace. Number eight, cascading failures. Cascading failures occur when a single fault spreads across agents, tools, and workflows. Autonomy, delegation, and persistent state allow errors to amplify faster than humans can intervene. The impact often far exceeds the original mistake as it just keeps amplifying. Number nine, human agent trust exploitation. Agents can exploit human trust through confidence, authority, or persuasive explanations. Users can approve harmful actions without independent verification, making the human the final execution path. This leaves clean audit trails that obscure the agents role in the failure and making it very difficult to find the source. Number 10, rogue agents. Rogue agents are agents that drift from their intended behavior over time. They may appear compliant at a task level while pursuing hidden goals, colluding with other agents or gaming reward systems. This represents a loss of behavioral integrity rather than a single exploit. So there you have the top 10 list of vulnerabilities for agentic AI systems according to OASP. Go take a look at their document to learn more about each one of these attacks and also what you can do to prevent them.