Emerging Tech15 min readOct 18, 2026

AI Agent Security for Mid-Sized Companies: The OWASP Top 10 Risks and the Control for Each (2026)

Bhavesh Barot - Author

Bhavesh Barot

Founder & CEO

Free assessment

Find Out if an AI Agent Can Take the Task

Name one task your team repeats every day. We tell you whether an agent can do it or whether a tool you can buy already does, and we build a demo on your own sample files before you sign.

Bhavesh, our founder, reads every request and usually replies within 2 to 3 hours.
Seen over her shoulder, a blonde woman in a navy turtleneck reviews two monitors, one with a list showing a single orange row and one with connected boxes, while a man in a black polo stands behind her.

"The OWASP Top 10 for Agentic Applications 2026 explained in plain English for a mid-sized company, with the control for each risk, how prompt injection works and how to limit it, MCP server security, a seven-control checklist, and the security questions to ask any AI agent vendor."

Key Takeaways

  • 1Secure an AI agent by limiting what it can do, not by telling it to behave. Narrow permissions and narrow tools beat clever prompts.
  • 2OWASP published the Top 10 for Agentic Applications 2026 on 9 December 2025, from ASI01 Agent Goal Hijack to ASI10 Rogue Agents.
  • 3Prompt injection is still possible with every model. OWASP's mitigations include least privilege, human approval for high-risk actions, separating external content and adversarial testing.
  • 4MCP servers are an access-control layer. The MCP security guidance says token passthrough is explicitly forbidden and calls for per-client consent and minimal scopes.
  • 5Give every agent its own service account, read-only by default, and enforce permissions in the target system.
  • 6Log every tool call and approval, and test with hidden-instruction documents before go-live.
  • 7Put these controls in your AI agent governance policy before the first build.

The short answer

AI agent securitycomes from limiting what an agent can do: its own service account with read-only access by default, narrow tools, permissions enforced in the systems it calls, a person approving high-impact actions, every action logged, and testing against hidden instructions before go-live. OWASP's Top 10 for Agentic Applications 2026 is the best checklist for what can go wrong.

We design, build and support custom AI agents and MCP servers, so weigh this page with that in mind. The risk names come from OWASP and the MCP documentation, opened on 17 and 18 October 2026 and linked where they appear. The plain-English explanations and the controls for a mid-sized company are ours. This page is general guidance, not a security audit or a compliance claim.

Searches for "agentic ai security" and "ai agent security" run about 480 a month each in the US, "ai agent security risks" rose 600% in a year, and advertisers pay $58 to $70 a click across the topic (DataForSEO, 17 October 2026). Those buyers are mostly security vendors' targets. This guide is for the operations or IT lead at a mid-sized company who has to sign off a first agent and wants to know what can go wrong and what to insist on.

The one principle: limit what the agent can do

What is agentic AI security? It is the practice of keeping AI agents from taking harmful actions, whether they are tricked, misconfigured or simply wrong. It overlaps with, but is not the same as, agentic AI cybersecurity in the other sense: using agents to help a security team.

OWASP's guidance on Excessive Agency traces damaging agent actions to three root causes: excessive functionality, excessive permissions and excessive autonomy. Every control on this page shrinks one of those three. Instructions in a prompt can be talked around. A permission the ERP refuses cannot.

The OWASP Top 10 for Agentic Applications 2026, in plain English

The OWASP GenAI Security Projectpublished the list on 9 December 2025, developed with more than 100 industry experts, researchers and practitioners. The names below are OWASP's; the explanation and the control are how we apply them in a mid-sized company. It is the closest thing to a shared agentic AI security framework today, and the best checklist of agentic AI security risks.

OWASP riskWhat it looks like in a mid-sized companyThe control
ASI01 Agent Goal HijackA supplier PDF tells the invoice agent to update bank detailsTreat content as data; approval and target-system checks on payment data
ASI02 Tool Misuse and ExploitationA "run any query" tool pulls a whole customer tableNarrow, purpose-built tools with input validation and rate limits
ASI03 Identity and Privilege AbuseThe agent connects with an admin or a person's loginIts own service account, read-only by default
ASI04 Agentic Supply Chain VulnerabilitiesA third-party MCP server or plugin is not what it claimsVet publishers, pin versions, least access, prefer servers you control
ASI05 Unexpected Code ExecutionThe agent is allowed to write and run scripts on a serverNo code execution unless sandboxed and signed off
ASI06 Memory and Context PoisoningFalse content planted in the knowledge base it searchesControl who writes to sources; keep provenance; review retrieval for big decisions
ASI07 Insecure Inter-Agent CommunicationOne agent passes another an unchecked instructionAuthenticate and validate messages between agents
ASI08 Cascading FailuresOne bad extraction flows into pricing, order and invoiceValidation between steps, change limits per run, circuit breakers
ASI09 Human-Agent Trust ExploitationApprovers click approve without readingShow the source beside the draft; track approver edit rates
ASI10 Rogue AgentsAn agent keeps acting outside its purposeRegister every agent with an owner, alerts, and an off switch

Prompt injection: why it still works, and how to limit it

OWASP's LLM01:2025 Prompt Injectionentry defines it as user prompts altering an LLM's behavior or output in unintended ways, and separates two kinds. Direct injection comes from what someone types. Indirect injection comes from external content the model reads, such as websites or files. Agents read a lot of external content (emails, PDFs, web pages, tickets), so indirect injection is the one to plan for.

OWASP lists seven mitigations. Here is how each lands in practice:

OWASP mitigationIn a mid-sized company agent
Constrain model behaviorInstructions define one job and say content is data, never instructions
Define and validate expected output formatsThe agent returns structured fields that code checks before any action
Implement input and output filteringStrip or flag suspicious instructions; block sensitive data leaving
Enforce privilege control and least privilege accessOwn service account, narrow tools, target system enforces limits
Require human approval for high-risk actionsPayments, customer messages and master-data changes go to a person
Segregate and identify external contentDocuments and emails are labelled as untrusted input in the prompt
Conduct adversarial testing and attack simulationsHidden-instruction documents are part of the go-live test set
A woman with long braids in a lavender sweater draws a dashed orange line around three connected boxes on a whiteboard while a bearded man in a denim shirt holding a closed laptop watches.
Draw the trust boundary first: which systems the agent may reach, and where a person must approve.

Signing off a first AI agent and want a second opinion on its access?

Bring the job, the systems it touches and the account it will use. In a 30-minute call with founder Bhavesh Barot we will walk the OWASP list against your design and point out where permissions, tools or approvals should be tighter. FactoryJet quotes a fixed price in writing for any build or fix after that call.

Talk to the Founder

MCP server security: the access layer most companies forget

An MCP (Model Context Protocol) server is how an agent reaches a system such as your ERP or CRM, so it is where access is granted or refused. The MCP security best practices name several attacks. The ones that matter most for a company building its own servers:

Risk (MCP documentation)What it meansWhat to require
Token passthroughThe server accepts a token issued for another service and forwards itExplicitly forbidden: servers must not accept tokens not issued to them
Confused deputyA proxy server with a static client ID is tricked into authorizing an attackerPer-client consent before third-party authorization; exact redirect checks
Server-side request forgeryA malicious server makes a client fetch internal addressesHTTPS only, block private IP ranges, validate redirects
State handle hijackingSomeone guesses a workflow or cart ID and uses another user's stateRandom handles bound to the authenticated user; verify every request
Local server compromiseA downloaded local server runs commands with the client's privilegesConsent before install, sandboxing, minimal privileges
Over-broad scopesOne token can reach every toolMinimal starting scopes, step up only when needed, log elevation

We build custom MCP servers and API integrations with these requirements in mind. See AI integration services, and our agentic AI architecture guide for where the tool layer sits.

AI agent security best practices: seven controls before go-live

  1. Own identity. A dedicated service account per agent, never a person's login or a shared admin account.
  2. Least privilege. Read-only by default; each write action granted and listed.
  3. Narrow tools. Purpose-built actions only; no open-ended query, shell or web tools without sign-off.
  4. Enforcement where data lives. The ERP, CRM or bank portal refuses what the agent's account cannot do.
  5. Approval for high impact. Money, customer messages, deletions and master data go to a named person.
  6. Secrets in a vault. Keys never in prompts, code repositories or logs.
  7. Logs and tests. Every tool call and approval logged; injection, permission and switch-off tests run before go-live and after every change.

These map directly onto sections of our free AI agent governance policy template, so security and governance sign-off can happen in one document.

Eight security questions to ask any AI agent vendor

  1. Where are permissions enforced: in the prompt or in the target system?
  2. Does each agent have its own service account?
  3. Which tools can it call, and can any run arbitrary code or queries?
  4. How are API keys and passwords stored?
  5. What is logged, for how long, and can we search it?
  6. How is the agent tested against prompt injection before release?
  7. How are third-party tools and MCP servers vetted and versioned?
  8. Who responds to a security incident, and how fast?

So, how secure are AI agents?

About as secure as a new employee with the same access. Nobody gives a new hire the admin password on day one, lets them pay suppliers unchecked, or skips the audit trail. Apply the same rules to an agent and most of the OWASP list becomes manageable. Skip them, and no model is good enough to make up for it. If you are weighing whether to rent or build, our guide to enterprise AI agents for mid-sized companies covers how security questions differ between platform agents and custom ones.

What else ranks for "agentic ai security", and how this guide differs

These are the business sites on Google's first page for "agentic ai security" in the US when we checked on 17 October 2026 (DataForSEO), with the title Google showed for each. We list them so you can compare; we have not reviewed their services, and the list leaves out forums and video sites.

SitePage title shown in Google
cloudsecurityalliance.orgAgentic AI Identity & Access Management
keyfactor.comWhat Is Agentic AI Security?
checkpoint.comAgentic AI Common Security Risks
zenity.ioAgentic AI Security for Enterprise AI Governance
airia.comAgentic AI Security: The Risk Nobody is Talking About
nhimg.orgAgentic AI in cyber security: what it means for security teams

Many of these are written by security software vendors. This guide maps every OWASP agentic risk to a control a mid-sized company can put in place without buying a platform, and adds the MCP server rules most guides skip.

How FactoryJet builds agents with these controls

We design, build, implement and support custom AI agents and the MCP servers and integrations they use, and you own what we build: the code and repository from day one. AI and hosting accounts can run in your name, at cost. We show working software on your own data before you sign. FactoryJet quotes the build, and any support you choose, as fixed prices in writing after a short scoping call.

See AI agent development, AI agent monitoring and support and AI consulting.

Sources

Pages opened and read on 17 and 18 October 2026.

AI agent design review for mid-sized US companies

Get your first agent's access, tools and approvals right before it goes live

Tell us the job, the systems and the account it will use. We will check the design against the OWASP list and show the agent working on your own data before you sign. FactoryJet quotes a fixed price in writing after a short scoping call.

Talk to the FounderSee AI agent development

Frequently Asked Questions

What are the biggest security risks of AI agents?
For a mid-sized company: an agent tricked by hidden instructions in an email or document, an agent with more permissions or tools than its job needs, credentials stored where the agent or its logs can leak them, a third-party tool or MCP server that is not what it claims, and people trusting the agent's output without checking. OWASP's Top 10 for Agentic Applications 2026 lists these and more.
What are the top 10 agentic AI vulnerabilities according to OWASP?
The OWASP Top 10 for Agentic Applications 2026, published 9 December 2025, lists: ASI01 Agent Goal Hijack, ASI02 Tool Misuse and Exploitation, ASI03 Identity and Privilege Abuse, ASI04 Agentic Supply Chain Vulnerabilities, ASI05 Unexpected Code Execution, ASI06 Memory and Context Poisoning, ASI07 Insecure Inter-Agent Communication, ASI08 Cascading Failures, ASI09 Human-Agent Trust Exploitation, and ASI10 Rogue Agents.
What is an AI prompt injection?
OWASP defines a prompt injection vulnerability as user prompts altering an LLM's behavior or output in unintended ways. Direct injection comes from what a user types. Indirect injection comes from external content the model reads, such as websites or files. For agents, indirect injection is the bigger worry: a supplier PDF or customer email containing instructions the agent might follow.
Is prompt injection still possible?
Yes. No model is immune, so the defence is to limit what a successful injection can do. OWASP's mitigations include constraining model behavior, validating output formats, filtering inputs and outputs, least-privilege access, human approval for high-risk actions, separating and labelling external content, and adversarial testing. If the agent cannot take a damaging action, an injection cannot make it.
How secure are AI agents?
As secure as the permissions, tools and checks around them. An agent connected with an admin account and open-ended tools is risky however good the model is. An agent with its own narrow service account, purpose-built tools, approval for high-impact actions, logging of every action and permissions enforced in the target system is a manageable risk, similar to a new employee with limited access.
How do you secure agentic AI?
Limit what the agent can do rather than relying on what it is told. Give each agent its own service account, read-only by default. Offer only narrow tools. Keep secrets in a vault. Require a person to approve money, customer messages and master-data changes. Enforce permissions in the systems the agent calls. Log every tool call. Test with hidden-instruction documents before go-live.
What is agent goal hijack?
It is OWASP's first agentic risk, ASI01: an attacker changes what the agent is trying to achieve, usually by planting instructions in content the agent reads. An agent processing supplier invoices could be steered to change bank details or approve a payment. The defence is to treat content as data, never as instructions, and to put high-impact actions behind approval and target-system checks.
What is tool misuse in AI agents?
OWASP's ASI02 covers agents using their tools in harmful ways, whether tricked or by mistake: running a broad database query, sending data to the wrong place, or calling an action repeatedly. The fix is narrow tools ("create a draft sales order") instead of general ones ("run any query"), input validation on every tool, rate limits, and logging.
What is MCP server security?
MCP (Model Context Protocol) servers expose company systems to AI agents, so they are an access-control layer. The MCP security best practices cover the confused deputy problem, token passthrough (explicitly forbidden: servers must not accept tokens not issued for them), server-side request forgery, state handle hijacking, local server compromise and scope minimization. Build MCP servers with narrow scopes and validate every request.
What is token passthrough in MCP and why is it forbidden?
Token passthrough is when an MCP server accepts an access token that was issued for some other service and forwards it to a downstream API. The MCP security guidance says this is explicitly forbidden by the authorization specification, because it bypasses rate limits and validation, breaks the audit trail and lets a stolen token be used through the server. MCP servers must only accept tokens issued for them.
What is the confused deputy problem in AI agents?
A confused deputy is a component with legitimate access that is tricked into using it for someone else. The MCP security guidance describes it for MCP proxy servers that connect to third-party APIs with a static client ID: an attacker can obtain authorization without the user's consent. The required mitigation is per-client consent before the third-party authorization flow, plus strict redirect validation.
What is memory poisoning in AI agents?
OWASP's ASI06, Memory and Context Poisoning, covers corrupting what an agent remembers or retrieves, such as planting false information in a knowledge base, past-conversation memory or document store, so later decisions go wrong. Control who and what can write to the agent's memory and sources, keep provenance on stored content, and review what the agent retrieves for high-impact decisions.
What are cascading failures in agentic AI?
OWASP's ASI08 covers a fault in one agent or tool spreading through connected agents and systems: one bad extraction feeds a pricing step, which feeds an order, which feeds an invoice. Contain it with validation between steps, limits on how much one run can change, circuit breakers that stop a run when errors pile up, and an off switch with a named owner.
What is human-agent trust exploitation?
OWASP's ASI09 covers people trusting an agent too much: approving its drafts without reading them, or acting on a confident but wrong answer. An approval queue only works if approvers see what changed and why. Show the source document beside the draft, highlight anything unusual, and track how often approvers change the agent's work.
What is a rogue AI agent?
OWASP's ASI10 covers agents acting outside their intended purpose or control. In a company setting the practical controls are the same as for any risky automation: every agent registered with an owner, permissions limited to its job, every action logged, alerts on unusual activity, and an off switch someone can use straight away.
Are third-party MCP servers and agent plugins safe?
Treat them like any third-party software. OWASP lists agentic supply chain vulnerabilities as ASI04. Check who publishes the tool, pin versions, review what permissions it asks for, run it with the least access it needs, and prefer servers you or a trusted vendor built. The MCP guidance warns that local servers run with the same privileges as the client unless sandboxed.
Should AI agents have their own user accounts?
Yes. Each agent should have its own service account, never a person's login or a shared admin account. That lets you grant only the permissions its job needs, see its actions separately in logs, and switch it off without affecting staff. OWASP lists identity and privilege abuse as ASI03.
How do you test an AI agent for security before go-live?
Run it against your own past cases plus attack cases: documents and emails with hidden instructions, requests just outside its permissions, attempts to reach data it should not, and repeated or malformed inputs. Confirm the target systems refuse what the agent's account cannot do, and that the switch-off works. OWASP lists adversarial testing among its prompt injection mitigations.
What security questions should we ask an AI agent vendor?
Where are permissions enforced: in the prompt or in the target system? Does the agent have its own service account? Which tools can it call, and can any run arbitrary code or queries? How are secrets stored? What is logged and for how long? How is it tested against prompt injection? How are third-party tools vetted? Who responds to an incident, and how fast?
Do we need a security platform for AI agents?
Not to start. The controls that matter most for a first agent are design decisions: narrow permissions, narrow tools, approvals, logging and testing. Specialist AI security tools help with monitoring and testing as you run more agents. Write the controls into your AI agent governance policy first, then choose tools that check them.
What is agentic cybersecurity?
The phrase is used two ways. It can mean securing AI agents themselves, which is what this guide covers, or using AI agents inside a security team to triage alerts and investigate incidents. For a company deploying its first business agent, the first meaning is the one that matters: limiting what the agent can do and logging every action.
Do we need AI agent security tools?
Not to start. AI agent security tools and agentic AI security solutions help with monitoring, testing and policy enforcement as you run more agents. The controls that matter most for a first agent are design decisions: its own narrow account, narrow tools, approvals for high-impact actions, logging and testing. Put those in place first, then choose tools that check them.
Bhavesh Barot - Founder & CEO
Written by

Bhavesh Barot

Founder & CEO

Founder & CEO of FactoryJet, an ecommerce and AI services company that has served 500+ businesses since 2014. Writes about ecommerce builds, AI agents, and AI search.

View Profile LinkedIn 10+ yrs exp.
Free quote
Founder replies in 24h