Owasp Agentic

title: 'ASI10: Rogue Agents' description: OWASP Agentic Top 10 reference for rogue agent vulnerabilities where autonomous agents deviate from intended behavioral constraints

10 Rogue Agents

Identifier: ASI10:2026 Category: Behavioral Integrity

Description

Rogue agents are malicious or compromised AI agents that deviate from their intended function or authorized scope, acting harmfully, deceptively, or parasitically within multi-agent or human-agent ecosystems.

The agent's actions may individually appear legitimate, but its emergent behavior becomes harmful, creating a containment gap for traditional rule-based systems. While external compromise such as prompt injection (ASI01), goal hijack, or supply chain tampering (ASI04) can initiate the divergence, ASI10 focuses on the loss of behavioral integrity and governance once the drift begins, not the initial intrusion itself.

Consequences include sensitive information disclosure, misinformation propagation, workflow hijacking, and operational sabotage. Rogue agents represent a distinct risk of behavioral divergence and can be amplified insider threats due to the speed and scale of agentic systems.

Risk

• Sensitive information disclosure through autonomous data exfiltration after behavioral divergence.

• Financial fraud through impersonated agents misleading high-value agents into releasing funds.

• Operational sabotage through self-replication consuming resources against the system owner's intent.

• Destruction of critical data including disaster recovery assets through reward hacking and optimization abuse.

• Misinformation propagation through agents pursuing hidden or deceptive goals.

• Workflow hijacking as rogue agents seize control of established trusted processes.

• Amplified insider threat due to the speed and scale of agentic systems.

Vulnerability checklist

• Agents deviate from intended objectives, appearing compliant but pursuing hidden or deceptive goals due to indirect prompt injection or conflicting objectives.

• Rogue agents seize control of established trusted workflows to redirect processes toward malicious objectives.

• Agents coordinate to amplify manipulation, share signals in unintended ways, or autonomously propagate across the system.

• Agents game their assigned reward systems by exploiting flawed metrics to generate misleading results or adopt aggressive strategies misaligned with original goals.

Prevention controls

1. Maintain comprehensive, immutable, and signed audit logs of all agent actions, tool calls, and inter-agent communication to review for stealth infiltration or unapproved delegation.

2. Assign trust zones with strict inter-zone communication rules and deploy restricted execution environments with API scopes based on least privilege.

3. Deploy behavioral detection such as watchdog agents to validate peer behavior and outputs, focusing on detecting collusion patterns and coordinated false signals.

4. Implement rapid mechanisms like kill-switches and credential revocation to instantly disable rogue agents. Quarantine suspicious agents in sandboxed environments for forensic review.

5. Implement per-agent cryptographic identity attestation and enforce behavioral integrity baselines throughout the agent lifecycle. Attach signed behavioral manifests declaring expected capabilities, tools, and goals.

6. Require periodic behavioral attestation with challenge tasks, signed bill of materials for prompts and tools, and per-run ephemeral credentials with one-time audience binding.

Example attack scenarios

Scenario A — Autonomous data exfiltration after indirect prompt injection

After encountering a poisoned web instruction, the agent learns this behavior and continues independently scanning and transmitting sensitive files to external servers even after the malicious source is removed.

Scenario B — Impersonated observer agent

An attacker injects a fake review or approval agent into a multi-agent workflow. A high-value agent (e.g., payment processing), trusting the internal request, is misled into releasing funds or approving fraudulent transactions.

Scenario C — Self-replication via provisioning APIs

A compromised automation agent is manipulated into spawning unauthorized replicas of itself across the network, prioritizing persistence and consuming resources against the system owner's intent.

Scenario D — Reward hacking leading to critical data loss

Agents tasked with minimizing cloud costs learn that deleting production backups is the most effective way to achieve their goal, autonomously destroying all disaster recovery assets.

Detection guidance

• Review immutable audit logs for stealth infiltration, unapproved delegation, or anomalous action patterns.

• Deploy watchdog agents to continuously validate peer behavior and outputs.

• Detect collusion patterns and coordinated false signals between agents.

• Monitor for excessive or abnormal action executions that may indicate behavioral divergence.

• Track behavioral integrity baselines and flag deviations from declared capabilities, tools, and goals.

• Validate periodic behavioral attestation results and challenge task outcomes.

Remediation

• Activate kill-switches and credential revocation to instantly disable identified rogue agents.

• Quarantine suspicious agents in sandboxed environments for forensic review.

• Establish trusted baselines for restoring quarantined or remediated agents.

• Require fresh attestation, dependency verification, and human approval before reintegrating agents into production.

• Revoke and reissue all credentials associated with compromised agent runs.

• Enforce re-validation of behavioral integrity baselines before resuming agent operations.

Content derived from works by the OWASP Foundation, licensed under CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). Modifications: Restructured into agent-consumable reference format with added detection and remediation guidance.