The OWASP Top 10 for Agentic Applications, read by a fraud team

In December 2025, the OWASP GenAI Security Project published the Top 10 for Agentic Applications for 2026, a peer-reviewed list of the most serious security risks in AI systems that plan and act across several steps. OWASP announced it as the work of more than 100 practitioners and researchers.

The list is written for teams building agents. But since October 2026, when large US banks began restricting customers' AI agents, it has another audience: the fraud and risk teams at platforms those agents visit. This post reads the list from that side of the counter.

The ten risks

Names follow OWASP's list; the one-line descriptions draw on the official document and Promptfoo's summary. The right-hand column is our judgement.

ASI01, goal hijack: the attacker writes the agent's to-do list

An attacker changes what an agent is trying to do by planting instructions in content it processes. In a banking context, this is the customer's agent reading a booby-trapped page or email and deciding to add a payee. Brave's 2025 research showed the mechanism in an agentic browser, noting the agent “operates with the user's full privileges across authenticated sessions”.

Fraud-team takeaway: the customer is not the attacker and is not being socially engineered. The usual “was the customer coached?” questions will not find it.

ASI03, identity and privilege abuse: the agent is the customer

OWASP describes agents taking on or escalating to credentials and privileges they should not use. When a customer pastes their banking password into an assistant, the agent holds every privilege the customer has, with no scope. This is the exact pattern banks objected to in October; JPMorgan said it does not allow third-party agents that obtain customers' banking credentials, Fortune reported.

Fraud-team takeaway: credential-based login tells you whose account it is. It cannot tell you whether the person or their agent is acting.

ASI09, human-agent trust exploitation: the approval is the attack

This risk is the uncomfortable one for anyone who says “just keep a human in the loop.” People over-trust fluent, confident agents. A compromised or mistaken agent can present a payment as routine, and a busy customer will tap approve.

Fraud-team takeaway: an approval step is necessary but not sufficient. It has to show the person exactly what they are approving (payee, amount, what changed), in the platform's own words, not the agent's summary. The six banks behind Building Trust in Agentic Commerce asked for consumers to have transparency over how agents make decisions for the same reason.

ASI10, rogue agents: legitimate on the outside

OWASP's last entry covers agents that are compromised or misaligned and cause harm while appearing legitimate. Jamie Dimon used almost the same words on JPMorgan's October earnings call: “You don't want rogue agents,” as reported by Fortune.

Fraud-team takeaway: the agent's identity can be genuine and its behaviour still wrong. Knowing which agent it is does not settle whether this action is wanted.

How contracts are catching up

It is striking how closely bank terms now track the OWASP list. Wells Fargo's new agreement makes customers responsible for “unintended actions performed by the AI Agent, actions resulting from incomplete, inaccurate, or manipulated inputs,” and “the AI Agent exceeding the authority granted by you” (section 15(e)). That is ASI10, ASI01 and ASI03, in legal language. The contract moves the cost. It does not prevent the event.

The controls that map across

• Least privilege, from the platform side. Prefer scoped, revocable access for agents over shared passwords. Where agents can only read, ASI01 and ASI03 cost much less.
• A separate gate for high-impact actions. Treat payee changes, transfers, withdrawals and credential changes as their own decision, checked when they happen.
• Presence at the gate. For those actions, establish that a person is in control at that moment. This answers ASI01, ASI03 and ASI10 directly: whatever the agent was told or holds, it cannot complete the action alone.
• Clarity at the gate. For ASI09, make the approval show the real action in the platform's words.
• A record of every decision, so the trace exists before anyone asks for it.

HEIP covers the third and fifth items for actions taken in a browser: a check, tied to one action, of whether a person is at the controls, and a record of the decision with its reasons. The rest is product design and access policy, and it matters as much.