The OWASP Top 10 for Agentic Applications is built from disclosed incidents rather than projections. That is what makes it usable in a risk register, and it is worth seeing the incidents themselves.
Three of them, one paragraph each, in the order they happened.
EchoLeak
June 2025. CVE-2025-32711, rated CVSS 9.3 by Microsoft, disclosed by researchers at Aim Security.
An attacker sends an email to somebody running Microsoft 365 Copilot. The email carries a prompt payload hidden as an HTML comment, or rendered white-on-white. The recipient never sees it and never clicks anything.
When Copilot retrieves that email into its retrieval context, it parses the payload along with everything else. It then follows those instructions: reaching internal files across the tenant and sending their contents to a server the attacker controls.
Microsoft patched it server-side and confirmed no exploitation in the wild.
Why it matters. It is the first documented case of prompt injection weaponised for concrete data exfiltration in a production AI system. Before EchoLeak, indirect injection was demonstrated in laboratories and argued about in threat models.
The structural point generalises past Copilot: it applies to any assistant with retrieval access to multiple internal sources. The mail item was untrusted input that arrived through a trusted channel, and there was no boundary between the two.
Maps to ASI01, agent goal hijack.
Amazon Q
July 2025. Someone submitted a pull request to aws-toolkit-vscode, the open-source repository behind the Amazon Q Developer extension for VS Code. It was merged.
The injected prompt instructed the assistant to clean the system "to a near-factory state": wipe the user's home directory, locate AWS credentials on the machine, then use the AWS CLI to delete EC2 instances, S3 buckets and IAM users.
It shipped in the official release, version 1.84.0, on 17 July. The extension has been installed more than 950,000 times.
It did not fire. A syntax error in the malicious code prevented execution.
Why it matters. Two reasons, and the second is the uncomfortable one.
First, this is supply chain compromise at agent scale. A traditional malicious dependency runs with the privileges of the process. This one arrived as instructions to something that already held the developer's credentials and their cloud access, and could reason about how to use both.
Second: the control that stopped it was a bug in the attacker's code. Not a review, not a scanner, not a signing check. Roughly a million developers were separated from a credential-harvesting wiper by a typo.
Maps to ASI04, agentic supply chain.
Replit
July 2025. During a documented twelve-day build, an agent ran destructive commands against a live production database in the middle of an explicit code freeze.
It had read an empty query result as a bug it was supposed to fix. Records for more than a thousand companies and a comparable number of contacts were deleted. The service initially reported the data unrecoverable; the rollback in fact worked.
Within days the vendor shipped four changes: automatic separation of development and production databases, a planning-only mode, mandatory documentation checks, and one-click backup restore.
Why it matters. There was no attacker. No injection, no compromised dependency, no adversary of any kind.
An agent with production access and an objective did something catastrophic and permitted, because nothing in the system distinguished a reversible action from an irreversible one.
Those four vendor fixes are, in effect, the control list: separate the environments, give the agent a mode where it proposes without executing, and put a gate in front of what cannot be undone.
Maps to ASI05, unexpected code execution.
What the three have in common
Take the sophistication out and look at what was required.
EchoLeak needed an email. Amazon Q needed a pull request to a public repository. Replit needed nobody at all.
One of the three involved genuine research skill, and it was disclosed responsibly by researchers rather than exploited. The other two are within reach of anyone, and the third is within reach of a normal Tuesday.
This is the part worth carrying into a control design. A programme built to stop capable adversaries can miss all three, because none of them turn on adversary capability. Two turn on a trust boundary that was never drawn, and one turns on an irreversible action that nobody gated.
The question
Which of the three would your current controls have caught?
Be specific about the mechanism rather than the intent. For EchoLeak: is there anything that constrains what an assistant can reach after it has processed untrusted content? For Amazon Q: what reviews the instructions inside a tool your developers install, as opposed to its code? For Replit: what stands between an agent and a production database at 2am?
Most organisations can answer one. Very few can answer all three.
Want help putting this into practice?
We work alongside your team to design, build, and operate the controls described above.