OWASP Releases Top 10 for LLM AI Application Security

Key Takeaways

• OWASP has released “State of Agentic AI Security and Governance v2.01,” a critical report addressing the security challenges posed by autonomous AI agents.
• The report emphasizes the convergence of AI safety and security, arguing that these disciplines can no longer be separated as AI systems gain autonomy and tool access.
• It provides a detailed taxonomy for agentic systems, categorizing them by operational role, implementation patterns, and autonomy levels.
• OWASP urges organizations to implement circuit breakers, kill switches, and deterministic enforcement for high-autonomy AI deployments.
• Several high-velocity agentic projects, including Gravitas, n8n, Dify, Claude Code, and Gemini CLI, are highlighted as areas requiring focused security monitoring due to their rapid development and potential attack surface churn.

As autonomous artificial intelligence agents increasingly permeate production environments, cybersecurity teams face an urgent imperative to fortify their defenses. In response to this escalating threat landscape, the OWASP Foundation has unveiled its “State of Agentic AI Security and Governance v2.01” report. This comprehensive technical guide is specifically engineered to equip security professionals with the knowledge and tools necessary to safeguard these sophisticated AI systems.

The report, a cornerstone of the OWASP GenAI Security Project’s Agentic Security Initiative, fundamentally redefines AI security. It shifts the perspective from a theoretical concern to an operational reality, grounding its insights in real-world incidents, published CVEs, and the aggressive pace of development within the open-source ecosystem surrounding agent frameworks and coding agents.

At a strategic level, OWASP contends that the traditional separation between AI safety and AI security is no longer viable once systems achieve autonomy and gain access to external tools. Historically, safety failures (where systems cause harm independently) and security failures (where adversaries exploit vulnerabilities) could be managed by distinct teams. However, agentic AI blurs this distinction at the deployment layer.

When an AI agent possesses the capability to autonomously invoke APIs, modify code, and interact with production data, an overly permissive design choice simultaneously creates both a safety flaw and a security vulnerability.

OWASP AI Security Report With New Tools

Effective governance, continuous monitoring, and streamlined incident response across both failure modes are paramount. This approach necessitates moving beyond disconnected risk taxonomies and separate escalation paths.

The report introduces a meticulous taxonomy for agentic systems, classifying them based on their operational roles, which include enterprise, coding, client-facing, personal, and infrastructure/operations. It further categorizes these systems by their implementation and composition patterns, encompassing orchestration frameworks, low-code platforms, single-agent systems, multi-agent systems, distributed chains, and agent-spawning architectures.

Autonomy is presented as a crucial, cross-cutting dimension, with supervised, semi-autonomous, and fully autonomous agents exhibiting vastly different blast radii. This is particularly true when combined with persistent memory and broad tool permissions. OWASP strongly advises organizations to explicitly map agent autonomy levels and implement robust safeguards such as circuit breakers, kill switches, and deterministic enforcement hooks for high-autonomy deployments.

The report also grounds its recommendations in an extensive survey of the high-velocity agentic project ecosystem, pinpointing areas where security teams should concentrate their monitoring efforts and advisory tracking.

Gravitas, boasting approximately 183,000 GitHub stars, is cited as a pioneering fully autonomous framework/platform that established autonomous-agent loops and now benefits from over 430 contributors. Similarly, n8n, also with around 183,000 stars, is an enterprise orchestration platform that has undergone six years of production-grade evolution with more than 570 releases, recently adapting for agentic workflows, though it operates as a semi-autonomous system.

Dify, with approximately 137,000 stars and 462 contributors, is notable for its exceptionally high volume of pull requests, indicating rapid iteration and a potentially volatile attack surface. In the realm of coding agents, Claude Code by Anthropic is described as a semi-autonomous agent with roughly 110,000 stars, releasing updates almost daily, and already linked to 22 published CVEs, making it the fastest-growing CLI in the dataset. Google’s Gemini CLI, with about 100,000 stars, 445 contributors, and 676 new issues opened within a 90-day period, exhibits similar acceleration in developer adoption and the associated pressure for vulnerability discovery.

Infrastructure and operations agents, such as browser-use (approximately 80,000 stars, fully autonomous browser automation with extremely high commit density) and Skyvern (roughly 18,000 stars, fully autonomous with a 77% pull request merge rate), represent high-risk categories where agents directly interface with browsers, cloud environments, and CI/CD pipelines.

The ecosystem further includes semi-autonomous coding and editor tools like Zed (~79,000 stars, Rust-native with over 1,000 tracked releases and multiple security advisories), OpenHands (~71,000 stars, a fully autonomous coding agent with one of the most active pull-request pipelines), and Cline (~62,000 stars, semi-autonomous with 11 published CVEs and over 1,000 pull requests opened per 90 days). Other notable projects include crewAI (~48,000 stars as a semi-autonomous framework with 126% commit growth) and Aider (~38,000 stars, semi-autonomous with a 21% rising commit trend and expanding contributor base).

Personal agents like AgentSeek by Fosowl (~15,000 stars, supervised with 67% commit growth over 90 days) highlight the phenomenon of “shadow AI,” where user devices can introduce unmanaged AI capabilities into enterprises, bypassing established governance frameworks.

For cybersecurity defenders, OWASP’s central message is clear: treat agentic AI as a primary security domain. This entails creating a comprehensive inventory of agents across the ecosystem, diligently tracking advisories and CVEs for high-velocity projects, and aligning deployments with OWASP’s Top 10 for Agentic Security and its newly introduced governance maturity model. With autonomous agents now interacting directly with production infrastructure, security programs must transition from one-off model assessments to continuous runtime oversight and robust supply-chain provenance for all AI components. Establishing strong non-human identity controls is crucial before attackers or misbehaving agents can define the risk surface.

What You Should Do

• Inventory Agentic AI Systems: Conduct a comprehensive audit to identify all autonomous and semi-autonomous AI agents deployed within your organization, categorizing them by operational role and autonomy level.
• Implement Circuit Breakers and Kill Switches: For high-autonomy AI deployments, integrate robust circuit breakers, kill switches, and deterministic enforcement hooks to mitigate potential blast radii.
• Monitor High-Velocity Projects: Actively track security advisories and CVEs for rapidly evolving agentic projects and frameworks identified in the OWASP report, such as Gravitas, Dify, Claude Code, and Gemini CLI.
• Align with OWASP Top 10 for Agentic Security: Adopt and integrate the security principles and guidelines outlined in OWASP’s Top 10 for Agentic Security and its new governance maturity model into your existing security policies.
• Establish Continuous Runtime Oversight: Move beyond static model assessments to implement continuous runtime monitoring and supply-chain provenance for all AI components, ensuring ongoing security and integrity.
• Strengthen Non-Human Identity Controls: Implement stringent identity and access management controls for all AI agents to prevent unauthorized access and mitigate risks posed by misbehaving agents or adversarial exploitation.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.