OWASP Top 10 for AI agents: how an SMB can use it

An AI agent turns order emails into drafts in a business system. An employee confirms each order before sending it. That looks cautious, but if the agent's credentials can write final orders directly, a second route may bypass the confirmation.

Start by asking the system owner what those credentials actually permit. In a draft-only workflow, final confirmation must be denied even when attempted directly.

The OWASP Top 10 for Agentic Applications 2026, published in December 2025, organises ten risk categories for these systems. It is a technical reference, not a law or certificate. Use it to turn “is this secure?” into specific questions and tests.

What changes when AI can act?

A text model can produce a wrong answer. An agent also has tools that read records, send email or change data, so an error can become an external action.

Instructions inside an email or document can influence the model and divert it from its task. They are not executable code, but they can induce dangerous tool use. Protect the transition from content being read to an authorised action.

Tool combinations matter too. Reading a customer record and sending an email are useful separately; together, they may expose information to the wrong recipient. An inventory needs to cover those paths, not just individual tools.

Ten categories as practical questions

For each category, record a possible event, the expected control and evidence to collect. Explain any non-applicable category: a system without persistent memory needs a different test from one retaining instructions across sessions.

Five useful starting checks

This is a proposed work order, not a statistical ranking of SMB incidents.

Objective, ASI01. In an isolated test environment, add an instruction to a legitimate request that asks for another customer's data. Check task preservation and independent access enforcement separately. The prompt-injection guide explains how to prepare the test.

Permissions, ASI03. Creating the opening example's draft should succeed; confirming it with the agent's credentials should fail. If the service cannot separate those powers, use a restricted intermediary or keep that step manual. See least authority for AI agents.

Dependencies, ASI04. Record the model, tools and versions. A DPA, or data processing agreement, addresses personal-data processing; it does not guarantee an unchanged model. Check service update terms, pin versions where supported and run repeatable critical-case tests before changes.

Memory, ASI06. Put a hostile instruction in a synthetic document and verify that it is not retained as a rule for future work. Run a legitimate request in a later session. Personal-data retention is a separate assessment: preventing memory poisoning does not establish lawful purpose, access or deletion.

Human review, ASI09. Give a reviewer a draft containing a known error without involving real customers. Can they compare it with the source? Do they have time and authority to reject it? An approval checkbox records a workflow step, not review quality.

Interpret results carefully

Restrict the opening example's permissions in the test environment. Run a normal order: it should produce a draft. Attempt direct confirmation: access should be denied. Then confirm that the refusal is recorded and a person can finish through the authorised route.

This avoids declaring a system secure because the model refused once, or accidentally blocking legitimate work. Keep a critical action restricted while a missing control test is resolved.

My design criterion here is that human confirmation protects only the paths that pass through it. Check actual tool authority before relying on the quality of model instructions.

Keep evidence linked to controls

Keep versioned instructions, permissions, tested scenarios, results and a procedure to stop the system. Assign maintenance responsibility and repeat relevant checks after changes to models, tools or data.

Documentation makes the work verifiable; it does not replace functioning controls. The agentic-security guide connects the elements. The logging guide explains how to reconstruct actions without collecting unnecessary information.

OWASP and legal duties remain distinct. Use the AI Act business guide to assess your use case. For an in-scope financial customer, evaluate DORA-related contractual requests against the supported function.

The next step

Choose one workflow and prepare an event, control, evidence and owner table. If your team can run and maintain the tests, you already have a route. If an important action lacks a demonstrable control, bring the table to the AI agent security service. Start by bounding that gap, not by buying more tools indiscriminately.