# Applying the OWASP Top 10 for Agentic Applications to Your AI Agents - Will Velida - NDC Oslo 2026

## Executive summary

This talk addresses the critical security risks of autonomous AI agents using the OWASP Top 10 for Agentic Applications (2026). The presentation moves beyond theoretical risks to provide practical, layered security models. Key focus areas include mitigating goal hijacking, preventing tool misuse, and securing inter-agent communication by implementing controls like intent gates, least-privilege identities (e.g., Entra Agent ID), and robust runtime validation to treat all LLM output as untrusted input.

## Key takeaways

- Goal Hijacking Mitigation: To prevent agents from being manipulated by hidden instructions in external documents (e.g., invoices), the core objective must be protected by goal immutability. This requires storing the agent's core objective in a locked system prompt or configuration (e.g., Azure Key Vault) and implementing controls like Prompt Shields to block malicious content.
- Securing Tool Usage (Tool Misuse): Agents must not be granted over-scoped tools. Security controls must shift from simple access control to execution control. Implementing middleware (an 'intent gate') is crucial to validate that every tool invocation matches the agent's intended purpose and adheres to defined policies, preventing destructive or unauthorized data leakage.
- Identity and Privilege Management: Agents require a distinct, governable identity (e.g., Entra Agent ID) separate from the host application. To prevent privilege escalation and cross-agent trust exploitation, systems must enforce per-action policies, segregate memory across sessions, and ensure tokens lack intent binding.
- Supply Chain and Code Execution Risks: Since agents assemble capabilities at runtime, the supply chain is live during execution. Attackers can inject malicious instructions via tool descriptors or compromised registries. Mitigation requires provenance and attestation for all artifacts (tool definitions, prompts) and treating all generated code as untrusted input, requiring a two-step pipeline (generation -> validation -> execution).

## Technical details

- OWASP Agentic Risks: The OWASP Top 10 for Agentic Applications covers risks across agent inputs, processing, memory, tools, outputs, and human oversight. Specific vulnerabilities demonstrated include: Git Spawn (running commands with user privileges via AI assistants) and Dead Bugs (tools that appear benign but secretly change instructions to exfiltrate credentials).
- Agent Governance Toolkit: The Microsoft Agent Governance Toolkit is an open-source runtime governance toolkit that enforces policies, agent identity isolation, and tamper-evident auditing for autonomous AI agents. It helps control what agents can do by allowing blocking, transforming, or escalating actions for human approval.
- Memory and Context Poisoning: Malicious or misleading data can be written into long-term memory (e.g., through repeated, subtle prompts) and treated as trusted knowledge later. Solutions require implementing trust-weighted memories, combining semantic similarity with trust signals (verified sources, human approvals, freshness).
- Insecure Inter-Agent Communication: When agents communicate via APIs or message buses (e.g., Protobuf), lack of controls like trusted messaging, timestamp validation, or rolling nonces allows attackers to intercept, spoof, or replay messages, requiring verification across every single boundary.

## Practical implications

- Always treat LLM output and external data as untrusted input, regardless of the source or how it is processed.
- Implement explicit policy enforcement (intent gates) between agents and tools to validate the purpose of every action, not just the access rights.
- Adopt a layered security model that includes identity isolation, runtime policy checks, and continuous monitoring of tool descriptors and registry changes.
- For code generation, enforce a two-step pipeline: separate code generation from code execution, and validate the generated code before it runs in the host environment.

## Topics

AI Security, Agentic Systems, LLM Security, Software Architecture, Identity and Access Management (IAM), Build Automation, OWASP Top 10 for Agentic Applications (2026), Microsoft Agent Governance Toolkit, Entra Agent ID, Azure App Configuration, Microsoft Agent Framework, APIM Azure API Management

Source: https://www.youtube.com/watch?v=mUHG5mA9Z7I