Unofficial OWASP Agentic Top 10 Checklist

Unofficial OWASP Agentic Top 10 Checklist is a free, interactive self-assessment tool from Decision Terrain. It helps teams review the security of a single agentic AI application against practical controls drawn from the OWASP Top 10 for Agentic Applications 2026. It is meant for systems that plan, use tools, retain memory, communicate with other agents or take consequential actions. Its aim is to turn OWASP’s risk guidance into a structured review that records evidence, gaps and next actions.

The checklist adapts selected OWASP mitigation guidance into 30 checks, three for each of the ten agentic risks. The risks are:

• agent goal hijack
• tool misuse
• identity and privilege abuse
• supply chain vulnerabilities
• unexpected code execution
• memory and context poisoning
• insecure inter-agent communication
• cascading failures
• human-agent trust exploitation
• rogue agents

Each check states a completion criterion and lists examples of the evidence to look for. Examples include tool inventories, sandbox profiles, signed agent cards, approval logs and red-team results.

Users first record basic facts about the system, then mark each check as in place, not in place or not applicable. “In place” is reserved for controls backed by implementation evidence. Every gap needs a next action, and every “not applicable” answer needs an explanation. Answers stay in the browser’s local storage and are never uploaded, and they can be exported as a JSON backup or printed. Each check links to the matching OWASP risk ID for the full guidance. The checklist is not created or endorsed by OWASP, and completing it does not establish conformance, certification or readiness to deploy.