The question changes when a model can act

For a chatbot, the main risk is a bad answer. For an agent that can send email, update a record, run code or call another agent, the risk is a bad action taken with real permissions. Prompt injection still matters, but it is now the way in rather than the whole problem.

A shared vocabulary from OWASP

In December 2025 the OWASP GenAI Security Project published a Top 10 for Agentic Applications, built with input from a large group of practitioners and researchers. It extends the earlier OWASP list for LLM applications and focuses on risks that come from agents planning, using tools, keeping memory and coordinating with each other. Its categories include goal hijacking, tool misuse, identity and privilege abuse, supply chain weaknesses, unexpected code execution, memory and context poisoning, insecure communication between agents, cascading failures, misplaced human trust in agents, and agents acting outside their intended limits.

We find it most useful as a review checklist for design decisions, not as a threat catalogue to read once.

Design decisions that reduce agent risk

  • Give each agent its own identity and the narrowest permissions that let it do the job. Avoid agents that borrow a human user's full access.
  • Separate reading from acting. An agent that can read a customer's inbox does not automatically need to send from it.
  • Put a human confirmation step in front of actions that are hard to reverse: payments, deletions, external messages, changes to production data.
  • Treat memory as untrusted input. Anything an agent stored from a previous session or a retrieved document can carry instructions.
  • Set limits on loops, spend and the number of tool calls per task, so a failure stops rather than compounds.
  • Log every tool call with its inputs and the reasoning step that triggered it, so you can reconstruct what happened.

Accountability still sits with people

None of these controls answers the question of who is responsible when an agent acts. That has to be decided by the organisation deploying it, and written down before launch: who owns the agent, who approves changes to its tools and instructions, and who is called when it does something unexpected.

If you are deciding whether an agentic workflow is ready for real permissions, we work through that decision in the AI Opportunity and Governance Sprint.

Sources