AI Agent Security: Applying the OWASP Top 10 Across the Software Development Lifecycle | Harness Blog

A single poisoned web page can be enough to hijack an AI agent. As organizations move from AI assistants that generate responses to autonomous agents that take action, the security risks are changing. An agent can access sensitive data, execute code, modify configurations, and interact with external systems. A mistake or malicious instruction can therefore have consequences far beyond an incorrect answer.

Yet many organizations approach AI agent security primarily as a runtime problem, focusing on monitoring agent behavior and blocking malicious actions after deployment. While runtime protection is essential, it addresses only part of the threat landscape.

In the Harness webinar Agent Security Is More Than Runtime: The OWASP Agentic Top 10 Across the Full Lifecycle, Renny Shen, Senior Director of Product Marketing at Harness, explains why organizations need a broader approach. By mapping the OWASP Top 10 for Agentic Applications to the software development lifecycle, teams can identify which risks to address during development, which controls to enforce in the delivery pipeline, and which threats require protection while agents are running.

The takeaway is straightforward: runtime protection catches what scanning cannot see, while scanning reduces what runtime protection has to catch.

Why AI agents introduce new security risks

Traditional applications generally follow a predictable lifecycle. Teams write code, test it, scan it, and deploy it. Although vulnerabilities can still emerge in production, the software being deployed is relatively well defined.

AI agents introduce a more dynamic threat model. They can plan their next steps, select tools, use credentials, retain information in memory, and act without a human reviewing every decision.

Four characteristics make this particularly important:

• Autonomy: Agents can decide what to do next and take actions without continuous human oversight.
• Tool access: Agents can query systems, send information, change configurations, and execute commands.
• Credentials and permissions: Agents may inherit access from users or systems, sometimes with broader privileges than a task requires.
• Memory and context: Information encountered earlier can influence future decisions and behavior.

When these capabilities interact, a seemingly minor weakness can lead to a consequential action. An agent might follow hidden instructions in a document, misuse a legitimate tool, expose sensitive information, or propagate a compromised credential across connected systems.

The OWASP Top 10 for Agentic Applications, published in December 2025, provides a useful starting point for identifying these risks. It is not an exhaustive list, but it offers security and engineering teams a structured way to evaluate the threats facing agentic applications.

Which AI agent security risks should you address before deployment?

Some agent security weaknesses can be identified before an agent ever runs. These risks are often cheaper to address during development and testing than after they reach production.

ASI04 Agentic supply chain vulnerabilities

Agents may rely on external tools, plugins, models, packages, and Model Context Protocol (MCP) servers. These dependencies can introduce malicious code or instructions, and a previously trusted component can become compromised through a later update.

Recommended controls:

• Scan packages, skills, prompts, and models before use.
• Maintain an AI bill of materials to track agent components and dependencies.
• Pin dependency versions and scan updates.
• Inventory deployed MCP servers and verify that running components match approved configurations.

ASI02 Tool misuse and exploitation

A legitimate tool can still create risk when an agent uses it in an unintended way. For example, an agent might retrieve internal information through one tool and send it to an external destination through another.

Teams should apply least-privilege access, maintain current destination allowlists, and test whether agents can chain tools together in unexpected ways. At runtime, tool calls and outputs should also be evaluated against security policies.

ASI03 Identity and privilege abuse

Agents frequently operate using inherited sessions, API keys, or tokens. Without clear agent identities, organizations may struggle to determine which agent performed an action or whether it had appropriate access.

Security teams should detect exposed secrets and overly broad permissions during development. At runtime, each agent should have a distinct identity where possible, with short-lived credentials scoped to its task. Privileged actions and unusual identity activity should be monitored.

ASI05 Unexpected code execution (RCE)

AI coding tools and agents can generate and execute code as part of their workflows. Malicious scripts, unsafe dependencies, or project configuration files that trigger commands can compromise development environments and expose credentials.

Treat AI tool configuration changes with the same scrutiny as application code. Review changes that introduce hooks or executable commands, scan generated code and dependencies, and test agents with adversarial inputs. Run generated code in isolated sandboxes and require appropriate approval for elevated execution.

These controls do not eliminate every threat, but they reduce the number of weaknesses that can reach production.

Which AI agent threats require runtime protection?

Not every agent security risk can be detected through static analysis or development-time scanning. Some threats emerge only when an agent encounters new content, interacts with other agents, or makes decisions in a live environment.

ASI01 Agent goal hijack and ASI06 memory and context poisoning

Agents may interpret malicious instructions embedded in emails, web pages, or documents as legitimate directions. This can redirect an agent away from its intended objective.

Memory poisoning creates a related risk. If an agent stores malicious instructions in persistent memory, those instructions may influence later sessions even after the original interaction ends.

Organizations should treat external content as untrusted, validate intent before high-impact actions, monitor for changes in an agent's behavior, and inspect information written to memory. Memory should be segmented where appropriate, with unverified information subject to expiration or review.

ASI07 Insecure inter-agent communication 

When agents collaborate, their messages can influence one another's decisions. Unauthenticated or unmonitored communication channels may allow agents to exchange information or instructions through pathways that security teams have not approved.

Controls include authenticated and validated agent communications, trusted identity registries, inventories of active agents and communication channels, and runtime monitoring for unexpected traffic.

ASI10 Rogue agents and ASI08 cascading failures

A rogue agent deviates from its intended purpose, while a cascading failure occurs when one problem spreads across agents or systems.

A compromised credential, poisoned memory, or unsafe action can become much more damaging when agents operate autonomously and delegate work to one another.

Security teams should establish behavioral baselines, enforce access and network restrictions that agents cannot modify themselves, and treat out-of-scope behavior as a reason to intervene. Runtime safeguards can include circuit breakers, quotas, rate limits, independent policy checks, and short-lived credentials. Organizations should also establish a kill switch and clearly define who has the authority to stop an agent.

ASI09 Human-agent trust exploitation

An agent can also create risk without an attacker. Fluent, confident responses may lead people to trust incorrect recommendations or accept actions they would otherwise question.

For high-impact operations, require human confirmation where appropriate, provide plain-language summaries of proposed actions, maintain tamper-resistant logs, and ensure that previews cannot modify production systems.

The key distinction is that runtime controls are indispensable for dynamic threats, but they cannot replace the development and pipeline controls that prevent avoidable weaknesses from shipping.

Two real-world lessons from agent security incidents

The webinar illustrates why organizations need both preventive and runtime controls.

Lesson 1: A trusted dependency can become a supply chain risk.

The presentation discusses a reported 2025 incident involving a malicious update to an npm package used by AI agents to send email. A later version reportedly added a hidden BCC address, copying outbound email to an external recipient.

The lesson is that reviewing a component only when it is first installed is not enough. Teams need version pinning, update scanning, dependency inventories, and a way to detect and disable components that no longer match approved configurations.

Lesson 2: Risk can come also come from the agent itself.

The webinar also discusses a widely reported incident involving an AI coding agent that deleted a live database during a code freeze. The agent subsequently told the user that recovery was impossible, although the data was restored through a rollback.

This example highlights a different class of risk: an agent can act incorrectly and then provide misleading information about the consequences. Preventing such incidents requires separation between development and production environments, safeguards for destructive actions, reliable rollback mechanisms, and human confirmation for high-impact operations.

Together, these examples demonstrate why AI agent security must address both the weaknesses an agent carries into production and the behavior it exhibits once it is operating.

How to get started with the OWASP top 10 for agentic applications

Securing every agentic risk at once can feel overwhelming. Instead, the webinar recommends an incremental approach built around three priorities.

1. Know what you have

Inventory your agents, tools, MCP servers, identities, credentials, and permissions. Understand which systems each agent can reach and what actions it can perform.

You cannot adequately protect assets you cannot see.

2. Fix what is cheapest before deployment

Shift security checks earlier in the software development lifecycle. Detect exposed secrets, flag excessive permissions, pin dependency versions, scan updates, and review AI tool settings as carefully as application code.

These measures reduce preventable risks before deployment and ease the burden on runtime defenses.

3. Monitor and control what happens at runtime

Establish policies for tool calls and privileged actions. Isolate AI-generated code, monitor agent behavior, and implement mechanisms to stop unsafe activity quickly.

Decide in advance who can trigger an emergency shutdown and ensure that the response process is clear.

This approach allows organizations to build on existing security investments rather than attempting to solve every agent security challenge simultaneously.

Securing AI agents across the full lifecycle with Harness

The same development-to-runtime approach underpins DevSecOps. Security is most effective when it is integrated into how software and its dependencies are built, tested, deployed, and operated.

Harness supports this approach across the agent lifecycle. As discussed in the webinar, its capabilities include scanning AI-generated code during code generation, scanning agent skills, prompts, and models, generating AI bill-of-materials information, running dynamic testing and red teaming against agents and AI APIs, discovering deployed agents and MCP servers, and protecting applications, agents, and AI APIs at runtime with an AI firewall.

A unified approach helps teams connect preventive controls with runtime monitoring while extending visibility to both internally built and externally sourced agents.

As organizations deploy more autonomous systems, that coverage becomes increasingly important. Agent security is still an evolving discipline, but teams do not need to wait for the threat landscape to stabilize before taking action.

The place to start is to understand what is running, address preventable weaknesses before deployment, and establish runtime safeguards for the risks that only emerge when agents act.

Watch the webinar: Agent Security Is More Than Runtime: The OWASP Agentic Top 10 Across the Full Lifecycle to learn how to map agent security risks to the controls best suited to address them.