OWASP Formalises Agentic AI Threat Model as Real Incidents Stack Up
The Development
OWASP has released a dedicated Top 10 risk framework for agentic AI applications — a materially different document from its existing LLM Top 10. The framework is grounded in five specific incidents from 2025, each mapped to a distinct risk category, spanning prompt injection via tool outputs, unauthorised action escalation, and agent-to-agent trust exploitation. The distinction OWASP draws is architectural: chatbots receive instructions and return text; agents receive goals and take actions — accessing APIs, writing to databases, executing transactions, and spawning sub-agents. That action capability transforms the threat surface. Where a compromised chatbot leaks information, a compromised agent executes. The framework arrives as enterprise agentic deployments — including marketing automation, AI media buying, and personalisation pipelines — are moving from pilot to production.
Our Take
The OWASP framework matters commercially because it will rapidly become the baseline expectation for enterprise AI governance — the thing procurement, legal, and the board ask for by name. Marketing teams that built agentic pipelines fast and loose during the 2025-2026 pilot wave are now exposed in a documented, categorical way. More practically: agentic marketing systems — AI media buyers, autonomous CRM agents, content-publishing pipelines — hold credentials, trigger spend, and modify customer data. They are not chatbots. Running them without a threat model is not a security oversight, it is a brand risk and a financial control failure waiting to surface.
What Changed
Security teams and marketing operators now have a structured, incident-backed taxonomy for agentic AI risk. The capability shift is the ability to run a formal threat model against an agentic marketing stack — assessing action scope, tool permissions, inter-agent trust chains, and escalation paths — using an auditable industry standard.
Marketing Impact
Marketing operations and martech teams running agentic pipelines — AI media buying, CRM automation, personalisation agents — face an immediate governance gap. Without scoped tool permissions and action-level audit trails, these systems fail basic enterprise risk requirements and expose marketing to both budget and data incidents.
Competitive Implication
Organisations with mature security-marketing collaboration will fast-track compliance with the OWASP framework and use it as procurement leverage against agencies and vendors. Teams without security integration will face deployment freezes as legal and IT apply the framework retroactively to live agentic systems.
Strategic Outlook
Enterprise procurement and IT security functions will adopt the OWASP Agentic Top 10 as a vendor assessment checklist through Q4 2026. Marketing technology vendors — particularly AI media buying and automation platforms — will face RFP questions against it by Q1 2027, accelerating a compliance-led consolidation toward platforms that offer native audit and permission controls.
The Exploit
Action Item
Heads of marketing operations should run a permission-scope audit against every live agentic system before Q4 budget reviews — documenting what actions each agent can take, what credentials it holds, and what human approval gates exist, using the OWASP Agentic Top 10 as the audit template.