The OWASP Top 10 for Agentic Applications (2026) covers risks specific to AI agents - systems that use tools, have memory, and can take autonomous actions. ai-blackteam maps agent-specific attacks to these 10 categories.

​
Running the scorecard

# Table output
ai-blackteam scorecard --standard agentic

# Filter by model
ai-blackteam scorecard --standard agentic -m gpt-4o

# JSON export
ai-blackteam scorecard --standard agentic --format json -o agentic-scorecard.json

​
The 10 categories

IDNameDescription
ASI01Agent Goal HijackManipulating agent goals through direct or indirect instruction injection
ASI02Tool Misuse & ExploitationAgents misusing legitimate tools due to injection or misalignment
ASI03Identity & Privilege AbuseExploiting inherited credentials, delegated permissions, or agent trust
ASI04Agentic Supply Chain CompromiseCompromised third-party models, tools, plugins, or MCP servers
ASI05Unexpected Code ExecutionAgents generating and executing code without sandboxing
ASI06Memory & Context PoisoningInjecting malicious content into agent memory or vector databases
ASI07Insecure Inter-Agent CommunicationCompromised agents sending malicious instructions to other agents
ASI08Cascading Agent FailuresFailure in one agent causing downstream errors across the system
ASI09Human-Agent Trust ExploitationExploiting human over-reliance on AI agents to bypass oversight
ASI10Rogue AgentsAgents pursuing goals misaligned with human intent

​
Attack mappings

ai-blackteam maps its agent exploitation attacks to these categories:
ai-blackteam AttackASI Categories
agent-credential-theftASI02, ASI03
agent-data-exfiltrationASI02, ASI03
agent-command-injectionASI02, ASI05
agent-config-discoveryASI03
indirect-injectionASI01
xpia-document, xpia-email, xpia-ragASI01, ASI06
mcp-tool-poisoningASI04, ASI01
mcp-rug-pullASI04
mcp-command-injectionASI05, ASI01
mcp-data-exfiltrationASI02, ASI03
mcp-server-impersonationASI04, ASI07
agent-session-smugglingASI03, ASI07
agent-collusionASI07
agent-impersonationASI07
cascading-jailbreakASI08
agent-delegation-abuseASI03
self-refine-attackASI10
self-propagating-wormASI07, ASI08
model-poisoning, dataset-poisoningASI04
plugin-backdoorASI04
skeleton-key, crescendo, emotional-manipulationASI09
context-manipulationASI06
context-window-stuffingASI06

​
Reading the scorecard

The output follows the same format as the LLM scorecard: 
OWASP Top 10 for Agentic Applications 2026 Scorecard -- gpt-4o

Category  Name                               Rating    Block Rate
ASI01     Agent Goal Hijack                  ELEVATED  72.50%
ASI02     Tool Misuse & Exploitation         PASS      91.30%
ASI03     Identity & Privilege Abuse         PASS      90.00%
ASI04     Agentic Supply Chain Compromise    ELEVATED  80.00%
ASI05     Unexpected Code Execution          PASS      95.00%
ASI06     Memory & Context Poisoning         PARTIAL   55.00%
ASI07     Insecure Inter-Agent Communication ELEVATED  66.70%
ASI08     Cascading Agent Failures           N/A       -
ASI09     Human-Agent Trust Exploitation     ELEVATED  60.00%
ASI10     Rogue Agents                       PASS      100.00%
Categories with lower ratings need attention. For agentic systems, ASI01 (Goal Hijack) and ASI06 (Memory Poisoning) are typically the hardest to defend against.