Agentic AI security failures mapped to OWASP Agentic AI Top 10 risk categories. We've tracked 75 distinct Agentic AI Security patterns across production AI agent deployments — most commonly in Security systems. One recurring example: Admin Operation Called By Non-Admin — An agent exposes admin-tier tool operations (e.g. deleteuser, overridebilling, resetorgsettings) through the same tool-calling interface as ordinary operations, and the dispatch la…
Each pattern below documents the specific failure mode, why it happens, and how teams have mitigated it in practice — use this page as a reference when building guardrails, writing evals, or debugging an agent that's already misbehaving in this way.
Frequency:Common
An agent exposes admin-tier tool operations (e.g. `delete_user`, `override_billing`, `reset_org_settings`) through the same tool-calling interface as ordinary operations, and the dispatch layer invokes them without first checking whether the requesting user actually holds an admin role. Any user who can phrase a prompt that maps to the admin tool schema gets the admin code path executed with the agent's (often elevated) service credentials.
Frequency:Occasional
Malicious Entity Poses as Trusted Agent in Multi-Agent System
Frequency:Emerging
Malicious Agent Introduction
Frequency:Occasional
A high-risk action (fund transfer, policy override, data export) is gated behind a requirement that a human approver's cryptographic signature or signed token accompany the execution request. The agent's verification of that signature is incomplete — it checks presence of a token rather than validity, uses a weak or non-constant-time comparison, doesn't bind the signature to the specific action payload, or doesn't check expiry/single-use — so a forged, replayed, or mismatched approval is accepted as genuine.
Frequency:Rare
Agent Actions Not Properly Logged or Traceable
Frequency:Occasional
AI-Controlled Physical Systems Cause Harm
Frequency:Common
Agents Delegate Tasks Without Verifying Delegate Capabilities or Trustworthiness
Frequency:Common
Agents Claim Capabilities They Don't Actually Have
Frequency:Common
Users Trick Chatbots Into Harmful Actions or Statements
Frequency:Rare
Agent passes unsafe user/tool input into shell/API commands.
Frequency:Common
Agent Outputs Violate Regulatory Data Handling Requirements
Frequency:Common
Some permissions are conditional on runtime state rather than static role membership — "allow withdrawal only if account balance exceeds the requested amount," "allow this API call only during business hours," "allow escalation only if the ticket is marked P1." The agent evaluates these conditions against stale, cached, or incorrectly fetched data, or implements the comparison logic incorrectly (off-by-one, wrong field, wrong currency/unit), and grants access that the live condition would have denied.
Frequency:Common
Sensitive Data in RAG Context Exposed Through Agent Responses
Frequency:Common
Malicious Content Injected into Agent's Context Persists Across Interactions
Frequency:Occasional
Agent's Internal State Compromised, Affecting All Its Interactions
Frequency:Common
Agent Leaks API Keys, Passwords, or Tokens
Frequency:Common
Agent Exposes API Keys, Passwords, or Secrets in Output
Frequency:Occasional
API Keys, Passwords, Tokens Exposed in Logs or Error Messages
Frequency:Common
Data from One User's Session Appears in Another's
Frequency:Rare
Agent mixes data across customers/accounts.
Frequency:Occasional
AI Agent Exposes Data Between Isolated Customer Environments
Frequency:Rare
Agent leaks private or sensitive data.
Frequency:Common
Agent Exposes Sensitive Information
Frequency:Common
Data Origin and Classification Lost During Processing
Frequency:Common
A user grants an agent limited authority to act on their behalf — e.g. "book travel under $2,000" or "respond to routine emails but don't send anything financial." The agent (or a sub-agent it spawns to handle part of the task) continues acting under the user's identity or impersonation token beyond that delegated scope, because the scope was expressed as a natural-language instruction rather than an enforced, machine-checkable boundary on the credential itself.
Frequency:Rare
User prompt manipulates agent to ignore instructions.
Frequency:Common
Agent Takes Actions Beyond Expected Scope
Frequency:Occasional
Poisoned Training Data Causes Agent to Behave Maliciously or Unreliably After Fine-Tuning
Frequency:Common
A role is defined with fine-grained access — e.g. "read-only" or "can create tickets but not delete them" — but the tool wrapper the agent calls exposes the underlying API's full create/read/update/delete surface regardless of which operations the role is actually meant to permit. The agent, having no operation-level gate in the tool itself, can invoke update or delete through a tool nominally scoped to a narrower capability.
Frequency:Occasional
Circumventing Human Approval Controls
Frequency:Rare
Malicious webpage/email/PDF/doc controls agent through retrieved content.
Frequency:Rare
A downstream system executes or renders unsanitized LLM output — how insecure output handling actually works is that the app trusts model output as if it were developer-authored code instead of treating it as untrusted input
Frequency:Common
Agent Actions Escape Intended Boundaries
Frequency:Common
Agent processes adversarial/weaponized documents or files.
Frequency:Emerging
Attacker Adds Malicious Tools to Agent's Available Toolset
Frequency:Emerging
Model Context Protocol Vulnerabilities Enable Remote Code Execution
Frequency:Critical
Standard agent defenses (tool contracts, circuit breakers, I/O moderation, sandboxing) detect malicious actions but miss malicious beliefs; poisoned knowledge base instructions bypass all existing defenses because they appear to be normal context, not suspicious tool calls
Frequency:Common
Attackers inject malicious instructions into agent memory/knowledge base; 95%+ of attacks succeed in modifying agent behavior; existing defenses (tool contracts, circuit breakers, I/O moderation) fail to detect corrupted beliefs
Frequency:Common
Input causes excessive cost/latency or service exhaustion.
Frequency:Occasional
Agent Leaks Data Between Tenants Due to Insufficient Isolation
Frequency:Emerging
AI Agent OAuth Tokens Stolen Through Protocol Hijacking
Frequency:Common
Malicious Inputs Craft Harmful Outputs
Frequency:Common
Cannot Trace Which Agent Produced Which Part of Output
Frequency:Rare
Agent has broad access when narrow scope was enough.
Frequency:Very Common
Agents Provisioned with Excessive Access Beyond Task Requirements
Frequency:Very Common
Before performing a mutating action on a specific resource (cancel this subscription, delete this file, update this profile), the agent authenticates that a valid user is making the request but never verifies that this specific user is the owner or authorized party for this specific resource. Any authenticated user can therefore direct the agent to mutate resources belonging to someone else simply by supplying that resource's identifier.
Frequency:Common
Permissions in a hierarchical system are meant to narrow as they cascade down (an org-level admin has broad rights, a team-level member has fewer, a specific user within that team has only what's explicitly granted), but the agent's logic for resolving effective permission at a given level applies the wrong tier's rules — either inheriting a broader ancestor permission that should have been narrowed, or failing to inherit a permission that should have propagated down, resulting in over- or under-granted access.
Frequency:Very Common
Agent Outputs Contain Personally Identifiable Information
Frequency:Occasional
Agent Gains More Access Than Intended
Frequency:Rare
Agent gains or uses higher permissions than intended.
Frequency:Common
Malicious Input Hijacks Agent Behavior
Frequency:Common
Attacker Injects Malicious Instructions Through User-Provided Input Without Sanitization
Frequency:Common
An agent is deliberately provisioned with read-only access to a data source — the intent being it can look things up but never modify anything — yet a misconfigured tool binding, an overly broad service credential, or an undocumented fallback code path still allows write operations to succeed. The read-only boundary exists in configuration or documentation but isn't actually enforced at the point where the write would occur.
Frequency:Common
An agent is assigned a role intended to convey a specific level of access (e.g. "support-tier-1"), but the mapping from that role to the underlying tool's actual permission model is incomplete, outdated, or was translated incorrectly during integration — so the agent ends up able to do meaningfully more, or less, than the role's name and documentation suggest. Unlike a missing check, the check exists and runs; it's the mapping table itself that's wrong.
Frequency:Common
Agent Exposes Credentials During Normal Operation
Frequency:Rare
API keys/tokens/private URLs leak through answer/log/tool.
Frequency:Very Common
PII and Secrets Written to Logs, Traces, and Observability Systems
Frequency:Very Common
An operation is classified in policy as sensitive or high-risk — deleting a production resource, transferring funds above a threshold, changing a customer's access level — and is documented as requiring human approval before execution. In practice, the agent's execution path has no code-level gate enforcing that requirement: the classification exists as a label or a line in a policy document, but nothing in the tool-dispatch pipeline actually blocks execution pending approval.
Frequency:Occasional
Attacker Takes Control of Active AI Agent Session
Frequency:Very Common
Employees Use External AI Tools, Leaking Sensitive Data
Frequency:Occasional
Agent Ignores or Delays Shutdown Commands to Complete Tasks
Frequency:Occasional
Compromised Tools or Dependencies Attack Agent
Frequency:Rare
Agent uses compromised tool, plugin, package, MCP server, or model dependency.
Frequency:Rare
Attacker Creates Multiple Fake Agents to Manipulate Consensus
Frequency:Rare
Attacker injects malicious instructions into agent knowledge base; attack remains dormant (unexecuted) for days/weeks; when triggered by specific condition, agent executes attack with delay so attacker connection can't be traced to triggering event
Frequency:Occasional
Agent Uses Tools to Send Sensitive Data to External Systems
Frequency:Occasional
Remote Code Execution Through AI Agent Tool Calls
Frequency:Rare
Tool response includes instructions that agent follows.
Frequency:Occasional
Adversaries Extract Sensitive Data from Model Training
Frequency:Occasional
Trust Relationships Incorrectly Extended Through Agent Chains
Frequency:Occasional
Agent Performs Actions Beyond Its Authority
Frequency:Occasional
Agent Executes Irreversible Operations (Delete, Destroy, Drop) Without User Approval
Frequency:Occasional
Attacker Chains Legitimate Tools in Unintended Sequences to Bypass Controls
Frequency:Rare
Agent runs generated code without sandboxing.
Frequency:Very Common
Agents Accept Other Agents' Outputs Without Verification