AI SecurityOWASPAgentic AIZero TrustData Security

OWASP Agentic Top 10: Memory Poisoning and Identity Abuse Are Data-Layer Risks

July 2, 2026

The OWASP GenAI Security Project published the OWASP Top 10 for Agentic Applications 2026 on December 9, 2025, the first peer-reviewed Top 10 dedicated to autonomous, tool-using AI systems. More than 100 industry experts, researchers, and practitioners contributed, and the project shipped a synchronized 1.1 update of its Agentic AI Threats and Mitigations taxonomy alongside the list. The ten entries run from ASI01, Agent Goal Hijack, through ASI10, Rogue Agents.

OWASP built each entry around observed incidents rather than hypothetical failure modes. The announcement cites the EchoLeak exfiltration chain for goal hijack, the Amazon Q incident for tool misuse, a GitHub MCP exploit for agentic supply chain vulnerabilities, and a Gemini memory attack for memory and context poisoning. Read together, the entries carry a pattern the document itself does not state: several of the highest-ranked risks reduce to ungoverned data access, and the mitigation they point toward lives at the object layer, not the model layer.

Memory and context poisoning is a data integrity failure

ASI06, Memory & Context Poisoning, describes corruption of stored context, the memory, embeddings, and retrieval stores an agent consults before it acts, in order to bias future reasoning. The Gemini memory attack that OWASP cites shows the defining property of this risk class: the poisoned record persists past the session that planted it, so the compromise reshapes behavior long after the initial interaction. OWASP returned to the theme in May 2026 with a follow-up analysis titled "Memory Is a Feature. It Is Also an Attack Surface."

Strip away the AI framing and ASI06 is a data integrity problem. An agent's memory store is a data store, and every entry in it is either an object with an author, a governed write path, and a provenance chain, or an unauditable blob that any upstream influence can mutate. Most agent frameworks ship the second option.

The data-layer answer is to treat memory writes as policy decisions. Attribute-based access control (ABAC) on the write path decides which principals may commit to memory, content-addressed storage (CAS-X) makes every committed record immutable at its address, and Merkle-tree lineage binds each entry to its origin. A poisoned entry then has to arrive through an authorized write with a signed provenance chain, and an entry that mutates after commit stops matching its address. Tampering becomes evident instead of silent.

Identity and privilege abuse is authorization at the wrong layer

ASI03, Identity & Privilege Abuse, covers agents that misuse credentials, tokens, or inherited permissions to reach systems and data beyond their intended limits. OWASP's announcement is blunt about the incident pattern: leaked credentials let agents operate far beyond their intended scope. The root cause is ambient authority. A bearer token grants everything the credential can reach, so one confused or hijacked agent inherits the full blast radius of every secret it holds.

ASI02, Tool Misuse, is the same failure one hop earlier. A tool call is a read or a write against data, and when the tool's credential is broader than the task, the model's judgment becomes the only control between an attacker's injected instruction and the data. Lattix Technologies has traced this pattern through MCP tool chains and their blast radius and through credential delegation chains, where policy-bound tokens replace inherited ambient authority.

The control the taxonomy implies but does not name

The Top 10 prescribes least privilege, scoped credentials, and memory validation as mitigations. All of them converge on one architectural move the document stops short of naming: enforce the decision on the data object itself, cryptographically, independent of the agent runtime.

In the Lattix zero trust data fabric (ZTDF), every object stays encrypted under post-quantum key encapsulation with ML-KEM-768 or ML-KEM-1024 until a policy enforcement point (PEP) validates an attribute claim signed by a policy decision point (PDP) that runs outside the agent's control. A hijacked goal, a poisoned memory entry, or an over-scoped token yields reachability to the ciphertext and nothing else. No claim the PDP honors, no key release, and the request fails closed. The same enforcement writes every release decision into Merkle-tree lineage, which gives incident responders the attribution record that ASI03 incidents currently lack. This is the enforcement model Lattix detailed for autonomous agents operating against production data.

The taxonomy's own incident set supports the placement. EchoLeak turned a copilot into an exfiltration engine because the data it touched was governed by session context rather than object policy. The GitHub MCP exploit poisoned a runtime component, but the damage ran through the data that component could reach. Object-level cryptographic enforcement does not prevent an agent from being confused. It prevents a confused agent from converting confusion into data access.

Where this maps to standards

NIST SP 800-207 already treats non-human subjects as first-class principals and places the PDP outside the systems it governs, which is exactly the separation that keeps a compromised agent runtime out of the access decision. The CISA Zero Trust Maturity Model 2.0 scores the data pillar independently of identity and network, so an ASI03 identity failure that a strong data pillar contains registers differently than one it inherits. NIST AI 600-1, the Generative AI Profile of the AI Risk Management Framework, lists information integrity and information security among its twelve risk areas, and ASI06 sits squarely inside both.

The Agentic Top 10 is already crossing into assurance frameworks: OWASP published an AIUC-1 crosswalk in May 2026, and Lattix expects the entries to surface in procurement language the way the LLM Top 10 did. Teams adopting the list should ask one question per entry: which control decides whether data is released, and does that control survive the compromise the entry describes. For ASI02, ASI03, and ASI06, the honest answer today is usually the model's judgment. The data layer is where that answer changes.