OWASP agentic AI top 10 mapped to theAuth

Risk names follow a secondary reading of the OWASP Top 10 for Agentic Applications for 2026 (OWASP GenAI Security Project), without its numeric identifiers. Check the wording against the OWASP publication before you cite it in an audit. Feature links point to the TypeScript SDK docs. The Go threat model (/go/security/threat-model) uses its own categories and does not map to this list.

#	Risk	theAuth feature	Limit
1	Agent Goal Hijack	Taint-aware tool guard, approval flows	Tracks where an argument came from, not whether the plan is malicious
2	Tool Misuse and Exploitation	Permissions, rate limiting, MCP `requiredScopes`	Only tools you register are gated
3	Identity and Privilege Abuse	Agent identity, token vault, DPoP, RFC 8707 audience checks	Unbound bearer tokens work for any holder; offline checks miss revocation
4	Agentic Supply Chain Vulnerabilities	jwt-bearer accepts listed issuers only, MCP registry, lenient client options off by default	Third-party MCP servers and their code are not scanned
5	Unexpected Code Execution	None. Withhold code-execution tools via permissions	Does not inspect or sandbox code
6	Memory and Context Poisoning	Taint labels, audit trail	Memory stores are yours; not scanned
7	Insecure Inter-Agent Communication	Token exchange (RFC 8693) with an `act` chain, delegation chains	Messages outside the token flow are not covered
8	Cascading Failures	Rate limiting, delegation depth limits, cascading revocation	Limits are per agent and per IP, not fleet-wide
9	Human-Agent Trust Exploitation	Approval flows, MCP `consentPage`	Cannot tell whether approval was informed; design the prompt yourself
10	Rogue Agents	Revocation, trust scoring, anomaly detection	Anomaly detection is limited; the page lists what is missing

Last modified on October 17, 2026

Compliance and security

Use cases

Lifecycle

Identity primitives

Standards

OWASP agentic AI top 10 mapped to theAuth