03 · Taxonomy
How agentic systems fail
The reference taxonomy is the OWASP Top 10 for Agentic Applications (2026), a widely referenced list of agent risks. The eight patterns below consolidate it with OWASP’s adjacent LLM and MCP work, each cross-referenced to OWASP’s published identifiers. Some patterns have no clean one-to-one OWASP category; those are marked. Each also names the class of control that answers it: read backwards, a control is a record of the failure it exists to prevent.
Prompt injection
Hidden or hostile instructions embedded in content the agent processes (a web page, an email, a document, image metadata) hijack its behaviour.
OWASP: LLM01:2025 Prompt Injection · ASI01 Agent Goal Hijack
Answered by: Untrusted-content handling: isolate and validate everything the agent reads.
Excessive agency & permissions
The agent holds broader authority than the task requires (database write access for a read task, spend authority without limits), so a single mistake or manipulation has outsized blast radius.
OWASP: LLM06:2025 Excessive Agency · ASI03 Identity and Privilege Abuse
Answered by: Least privilege: scope permissions, cap spend and autonomy.
Insecure tool use
The tools an agent calls become the attack surface: unvalidated inputs, unauthenticated tool servers, or tool descriptions that themselves carry malicious instructions.
OWASP: ASI02 Tool Misuse and Exploitation
Answered by: Authenticated, validated, allow-listed tools.
Identity & delegation gaps
Nobody can say which principal an agent was acting for when it acted. Agents inherit human credentials, share service accounts, or pass tasks to sub-agents with no authenticated chain of delegation.
OWASP: ASI03 Identity and Privilege Abuse
Answered by: A distinct agent identity and an authenticated delegation chain.
Memory & context poisoning
False or malicious information planted in an agent's memory, retrieval store, or context persists and corrupts future decisions long after the original interaction.
OWASP: ASI06 Memory & Context Poisoning
Answered by: Provenance and integrity checks on memory and retrieval.
Cascading actions
Multi-step and multi-agent workflows propagate one early error through every downstream step: a chain reaction at machine speed.
OWASP: ASI08 Cascading Failures
Answered by: Checkpoints and blast-radius limits between steps.
Hallucinated facts, real actions
The model invents something (a policy, a price, a legal citation) and then acts on it or communicates it with the authority of the firm behind it.
OWASP: LLM09:2025 Misinformation · ASI09 Human-Agent Trust Exploitation (partial)
Answered by: Grounding, and human sign-off before consequential action.
Unaudited operation
This does not cause an incident; it makes every incident worse. There is no per-action log tying decision, data, policy version and outcome together, so nobody can reconstruct what happened or prove what did not.
OWASP: No single OWASP category
Answered by: Durable per-action logs and a human gate before irreversible action.
Sources: OWASP Top 10 for Agentic Applications 2026 (ASI01 to ASI10)↗ · OWASP Top 10 for LLM Applications 2025↗ · NIST AI RMF (Manage)↗ · as of 25 September 2026