OWASP Top 10: The Complete Security Guide Across the Modern Technology Stack
Web • API • Mobile • CI/CD • Kubernetes • LLM & GenAI • MCP • Agentic AI • Agentic Skills
S
I like breaking things that are supposed to be secure. When I’m not hunting vulnerabilities, I’m exploring systems, architectures, and the assumptions behind them.
Security risks evolve with technology.
The classic OWASP Top 10 for Web Applications remains one of the most recognized security-awareness frameworks, but modern applications now span APIs, cloud infrastructure, Kubernetes, CI/CD pipelines, LLMs, MCP servers, and autonomous AI agents.
This guide brings together the major OWASP Top 10 security frameworks relevant to the modern technology stack and turns them into practical, security-engineering-oriented reference tables.
Each section answers five questions:
What is the risk?
What commonly goes wrong?
How can it be exploited?
How should it be prevented?
What does it look like in a real system?
Important: OWASP Top 10 projects are awareness and prioritization frameworks, not complete security checklists. OWASP itself describes the Web Top 10 as a starting point rather than a complete application-security program.
OWASP Top 10 Landscape
Before diving into individual risks, it helps to understand which OWASP Top 10 applies to which part of the modern technology stack.
| OWASP Project | Current / Referenced Version | Primary Scope |
|---|---|---|
| OWASP Top 10 – Web Applications | 2025 | Web application security |
| OWASP API Security Top 10 | 2023 | API security |
| OWASP Mobile Top 10 | 2024 | Mobile application security |
| OWASP Kubernetes Top Ten | 2025 | Kubernetes and cloud-native security |
| OWASP Top 10 CI/CD Security Risks | 2022 | Software delivery pipelines |
| OWASP Top 10 for LLM Applications / GenAI | 2026 | LLM and GenAI application security |
| OWASP MCP Top 10 | 2025 beta / evolving | Model Context Protocol security |
| OWASP Top 10 for Agentic Applications | 2026 | Autonomous / agentic AI security |
| OWASP Agentic Skills Top 10 | 2026 public-review v1 | AI-agent skills and skill ecosystems |
The release dates are not synchronized. For example, the API Top 10's latest stable release is 2023, while the Web Top 10 is now 2025 and the LLM list is 2026.
1. OWASP Top 10 for Web Applications — 2025
The OWASP Top 10:2025 is the current OWASP awareness document for web application security.
The 2025 release made several important changes. Broken Access Control remains #1, Security Misconfiguration moved to #2, and Software Supply Chain Failures expanded the scope previously represented by Vulnerable and Outdated Components. OWASP also introduced Mishandling of Exceptional Conditions as a new category.
OWASP Web Top 10 — 2025
| # | OWASP Risk | Brief Explanation | Common Misconfiguration / Failure | Prevention / Solution | Example |
|---|---|---|---|---|---|
| A01 | Broken Access Control | Users can perform actions or access resources outside their authorized permissions. | Missing server-side authorization, IDOR/BOLA, trusting client roles, exposed admin APIs. | Enforce server-side authorization, deny by default, object/function-level checks, least privilege. | User changes /api/users/100 to /api/users/101 and accesses another user's data. |
| A02 | Security Misconfiguration | Security controls are incorrectly configured or unnecessary functionality is exposed. | Debug mode, default credentials, exposed ports, verbose errors, weak headers, insecure cloud settings. | Secure defaults, configuration baselines, hardening, automated configuration validation. | Production application exposes /actuator, stack traces, or an admin console. |
| A03 | Software Supply Chain Failures | Compromise or weaknesses in dependencies, build systems, repositories, or distribution mechanisms. | Unpinned dependencies, compromised packages, unsigned artifacts, insecure CI/CD, untrusted plugins. | SBOM, dependency pinning, provenance, signing, artifact verification, CI/CD security. | A compromised npm/PyPI dependency executes code during application startup. |
| A04 | Cryptographic Failures | Sensitive information is inadequately protected through encryption or key management. | Weak algorithms, plaintext secrets, improper TLS, hard-coded keys, poor key rotation. | Strong cryptography, TLS, centralized secrets/KMS, key rotation, data classification. | Password reset tokens are predictable or sensitive data is sent over HTTP. |
| A05 | Injection | Untrusted data is interpreted as commands or queries by an interpreter. | SQL concatenation, OS command construction, template injection, unsafe dynamic queries. | Parameterization, contextual encoding, allowlists, safe APIs, input validation. | admin' OR '1'='1 alters a SQL query. |
| A06 | Insecure Design | Security weaknesses are introduced at the architecture or design level rather than merely through implementation bugs. | No abuse cases, missing rate limits, insecure workflows, excessive trust, missing threat modeling. | Threat modeling, secure design patterns, abuse-case analysis, security requirements. | Password reset allows unlimited attempts because the workflow was never threat-modeled. |
| A07 | Authentication Failures | Authentication mechanisms incorrectly establish or maintain user identity. | Weak passwords, session fixation, token flaws, missing MFA, predictable recovery flows. | Strong authentication, secure sessions, MFA, credential protection, secure recovery. | Attacker resets another user's password through a weak recovery mechanism. |
| A08 | Software or Data Integrity Failures | Systems trust software, serialized data, or updates without adequately verifying integrity. | Unsigned updates, unsafe deserialization, untrusted plugins, unverified downloaded code. | Sign and verify artifacts, integrity checks, trusted sources, safe serialization. | Application deserializes attacker-controlled data into executable objects. |
| A09 | Security Logging & Alerting Failures | Security events are not adequately logged, monitored, correlated, or alerted on. | Missing audit logs, sensitive data in logs, no alerting, insufficient retention. | Centralized logging, security telemetry, immutable audit trails, detection rules. | Multiple failed admin logins occur but generate no security alert. |
| A10 | Mishandling of Exceptional Conditions | Applications fail unsafely when encountering unexpected conditions, errors, resource states, or abnormal inputs. | Fail-open behavior, inconsistent error handling, race conditions, unsafe exception paths. | Fail-safe design, consistent error handling, state validation, resilience testing. | Authorization fails due to an internal error and the application accidentally permits the request. |
OWASP's 2025 list and descriptions are the authoritative basis for these categories.
2. OWASP API Security Top 10 — 2023
APIs deserve their own Top 10 because APIs expose application functionality, data objects, business workflows, and integrations directly.
The 2023 API Security Top 10 is the current stable release. Authorization remains a dominant theme, with BOLA, property-level authorization, and function-level authorization all appearing prominently.
| # | OWASP Risk | Brief Explanation | Common Misconfiguration / Failure | Prevention / Solution | Example |
|---|---|---|---|---|---|
| API1 | Broken Object Level Authorization | API fails to verify whether the requester can access the specific object. | Trusting object IDs from requests without ownership checks. | Object-level authorization on every sensitive operation. | /api/accounts/123 accessed by a user who owns account 456. |
| API2 | Broken Authentication | API authentication can be bypassed or incorrectly implemented. | Weak tokens, missing expiration, predictable tokens, broken JWT validation. | Strong authentication, token validation, expiration, rotation, secure session handling. | API accepts an expired JWT. |
| API3 | Broken Object Property Level Authorization | Users can read or modify object properties they should not control. | Mass assignment, excessive data exposure, unrestricted fields. | Explicit property allowlists and response filtering. | User submits {"role":"admin"} to an update endpoint. |
| API4 | Unrestricted Resource Consumption | Attackers consume excessive compute, memory, storage, or API resources. | No rate limits, unlimited pagination, expensive queries. | Rate limits, quotas, pagination limits, request-size limits, resource controls. | ?limit=100000000 causes database exhaustion. |
| API5 | Broken Function Level Authorization | Users can invoke functions intended for higher-privileged users. | Hiding admin buttons instead of enforcing authorization server-side. | Function-level authorization and deny-by-default policies. | Normal user calls /admin/deleteUser. |
| API6 | Unrestricted Access to Sensitive Business Flows | Automated clients can abuse sensitive business processes. | No bot protection, workflow controls, rate limits, or transaction validation. | Business-flow threat modeling, rate limits, quotas, behavioral detection. | Bot creates thousands of accounts or purchases limited inventory. |
| API7 | Server-Side Request Forgery | API causes the server to make attacker-controlled requests. | User-controlled URLs, weak URL validation, unrestricted outbound access. | URL allowlists, egress filtering, network segmentation, metadata protection. | Webhook endpoint accesses cloud metadata service. |
| API8 | Security Misconfiguration | API infrastructure or security settings are improperly configured. | Debug endpoints, permissive CORS, exposed admin interfaces, weak TLS. | Secure configuration baselines and automated API gateway validation. | Production API exposes Swagger/admin endpoints without authentication. |
| API9 | Improper Inventory Management | Organizations don't know which APIs, versions, environments, or endpoints exist. | Forgotten APIs, old versions, undocumented endpoints. | API inventory, ownership, lifecycle management, continuous discovery. | /v1/admin remains exposed years after /v2 is released. |
| API10 | Unsafe Consumption of APIs | An application blindly trusts APIs or third-party services it consumes. | No response validation, excessive trust in upstream APIs, insecure integrations. | Validate external responses, authenticate upstreams, constrain trust boundaries. | Application trusts malicious data returned by a compromised partner API. |
The official API Security Top 10 lists these ten risks and explains the 2023 changes.
3. OWASP Top 10 for LLM Applications / GenAI — 2026
The OWASP GenAI Security Project has evolved significantly since the original 2023 LLM Top 10.
The 2026 release is now the current OWASP Top 10 for LLM Applications. It reflects the shift from simple chatbot security toward production AI applications involving retrieval, tools, agents, embeddings, model supply chains, and autonomous behavior.
| # | OWASP Risk | Brief Explanation | Common Misconfiguration / Failure | Prevention / Solution | Example |
|---|---|---|---|---|---|
| LLM01 | Prompt Injection | Attacker-controlled instructions manipulate model behavior. | Treating user/retrieved content as trusted instructions. | Separate instructions from data, constrain tools, validate actions, use defense-in-depth. | Malicious webpage instructs an AI assistant to exfiltrate retrieved secrets. |
| LLM02 | Sensitive Information Disclosure | LLM applications reveal confidential data through prompts, context, memory, or responses. | Excessive context, poor authorization, secrets in prompts, unrestricted retrieval. | Data minimization, authorization-aware retrieval, DLP, secret filtering. | RAG assistant returns another customer's confidential document. |
| LLM03 | Excessive Agency | AI receives more autonomy, permissions, or tools than necessary. | Broad OAuth scopes, unrestricted tools, no approval gates. | Least privilege, tool allowlists, human approval for high-impact actions. | AI agent can delete production resources when it only needs read access. |
| LLM04 | Supply Chain | Models, datasets, packages, plugins, embeddings, and AI services can introduce compromise. | Untrusted models, unsigned artifacts, malicious dependencies, unverified datasets. | Provenance, signing, SBOM, dependency scanning, model verification. | Malicious model or package introduces a backdoor into an AI pipeline. |
| LLM05 | Data and Model Poisoning | Attackers manipulate training, fine-tuning, retrieval, or embedding data. | Untrusted datasets, insufficient validation, poisoned documents. | Dataset provenance, validation, anomaly detection, integrity controls. | Attacker inserts malicious documents into a RAG knowledge base. |
| LLM06 | Unbounded Consumption | Excessive AI resource consumption creates availability or financial impact. | Unlimited tokens, recursion, oversized inputs, uncontrolled agent loops. | Rate limits, token budgets, recursion limits, quotas, cost controls. | Attacker causes an agent to repeatedly invoke an expensive model/tool. |
| LLM07 | Misinformation | Models generate inaccurate or misleading information that causes security or business impact. | Treating model output as authoritative without verification. | Grounding, validation, confidence controls, human review for critical decisions. | AI generates a false security remediation that disables an important control. |
| LLM08 | Hidden Context Exposure | Sensitive system prompts, hidden instructions, internal context, or intermediate data become exposed. | Mixing system prompts, secrets, tools, and user context. | Context isolation, secret removal, minimal system prompts, output filtering. | User extracts internal tool instructions containing credentials or sensitive logic. |
| LLM09 | Vector and Embedding Weaknesses | Weaknesses in vector stores and embeddings can cause retrieval manipulation or unauthorized data access. | Shared vector indexes, missing tenant isolation, weak retrieval authorization. | Tenant isolation, authorization-aware retrieval, vector-store security, integrity controls. | User crafts queries that retrieve another tenant's embeddings. |
| LLM10 | Improper Output Handling | Application treats model output as trusted executable or structured input. | Rendering HTML, executing code, constructing SQL/commands from model output. | Output validation, encoding, sandboxing, parameterization, deterministic policy checks. | LLM output is inserted into a shell command and executed. |
The 2026 OWASP release identifies the ten categories above and credits project leadership to Steve Wilson and Rock Lambros, with individual entry leads for the categories.
4. OWASP MCP Top 10 — 2025
Model Context Protocol (MCP) introduces a new security boundary between AI clients, models, tools, data sources, and MCP servers.
The OWASP MCP Top 10 is currently an evolving/beta project, so it should not be treated as having the same maturity or stability as the long-established Web Top 10. Its current project page describes a 2025 list and indicates that the project is still progressing toward a final release.
| # | OWASP Risk | Brief Explanation | Common Misconfiguration / Failure | Prevention / Solution | Example |
|---|---|---|---|---|---|
| MCP01 | Token Mismanagement & Secret Exposure | Tokens and secrets used by MCP systems are exposed or poorly managed. | Hard-coded tokens, long-lived credentials, secrets in logs/context. | Short-lived scoped credentials, secret managers, masking, rotation. | OAuth token appears in MCP debug logs and is reused by an attacker. |
| MCP02 | Privilege Escalation via Scope Creep | MCP permissions expand beyond their original intended scope. | Broad scopes, permanent permissions, tool combinations creating excessive capability. | Least privilege, scope limits, expiry, approval for privilege changes. | Read-only tool gains ability to modify repositories. |
| MCP03 | Tool Poisoning | Malicious or modified tool descriptions/results influence model behavior. | Trusting tool metadata without verification or change detection. | Tool integrity verification, provenance, fingerprinting, risk gating. | Trusted tool description is modified to instruct the model to exfiltrate secrets. |
| MCP04 | Software Supply Chain Attacks & Dependency Tampering | MCP servers and dependencies can be compromised through their software supply chain. | Unpinned dependencies, unsigned packages, untrusted registries. | Dependency pinning, signing, SBOM, provenance, artifact scanning. | Compromised MCP dependency introduces malicious code. |
| MCP05 | Command Injection & Execution | Untrusted data reaches commands or executable actions through MCP tools. | Shell execution, unsafe parameter construction, insufficient validation. | Strict schemas, allowlists, sandboxing, command isolation. | Tool builds bash commands using user-controlled input. |
| MCP06 | Intent Flow Subversion | Malicious context changes the intended objective of an agent workflow. | Treating tool results or retrieved context as trusted instructions. | Context isolation, instruction/data separation, tool-result validation. | A tool result tells the agent to ignore the user's original task. |
| MCP07 | Insufficient Authentication & Authorization | MCP servers fail to correctly establish identity or enforce permissions. | Missing authentication, shared credentials, weak scopes. | Strong authentication, authorization, per-tool access policies. | Unauthenticated MCP endpoint exposes administrative tools. |
| MCP08 | Lack of Audit and Telemetry | Tool calls, context changes, and agent interactions cannot be investigated. | Missing logs or insufficient correlation between user, agent, and tool. | Immutable audit logs, structured telemetry, alerting. | Malicious tool invocation occurs with no record of who initiated it. |
| MCP09 | Shadow MCP Servers | Unapproved MCP servers operate outside security governance. | Developers deploy MCP servers with default credentials or public exposure. | MCP inventory, registration, network controls, security approval. | Developer deploys an internet-facing MCP server containing production credentials. |
| MCP10 | Context Injection & Over-Sharing | Context shared between users, tools, or agents exposes information outside its intended boundary. | Shared memory, broad context windows, missing tenant isolation. | Context segmentation, data minimization, authorization-aware retrieval. | One user's sensitive context becomes available to another agent session. |
These categories and the current MCP Top 10 descriptions come directly from the OWASP MCP project.
5. OWASP Kubernetes Top Ten — 2025
Kubernetes introduces a security model that spans workloads, RBAC, secrets, network policy, cluster components, cloud identities, and observability.
The current 2025 Kubernetes Top Ten reorganizes several risks compared with the older 2022 version.
| # | OWASP Risk | Brief Explanation | Common Misconfiguration / Failure | Prevention / Solution | Example |
|---|---|---|---|---|---|
| K01 | Insecure Workload Configurations | Pods and workloads run with unsafe privileges or configurations. | Privileged containers, hostPath, root containers, excessive capabilities. | Pod Security Standards, non-root containers, drop capabilities, securityContext. | Compromised web container can access host resources. |
| K02 | Overly Permissive Authorization Configurations | Kubernetes RBAC grants identities more access than required. | cluster-admin, wildcard permissions, broad service-account roles. |
Least privilege RBAC, role review, authorization testing. | Application service account can read secrets across namespaces. |
| K03 | Secrets Management Failures | Credentials are stored or exposed insecurely. | Secrets in Git, plaintext manifests, overly accessible Kubernetes Secrets. | External secret managers, encryption at rest, rotation, access controls. | Database password is committed to a Helm chart. |
| K04 | Lack of Cluster Level Policy Enforcement | Security policies exist but are not consistently enforced. | No admission controls, inconsistent security policies. | Admission controllers, policy-as-code, Kyverno/Gatekeeper-style controls. | Developer deploys privileged pods because no admission policy blocks them. |
| K05 | Missing Network Segmentation Controls | Pods and services can communicate more broadly than necessary. | No NetworkPolicies, unrestricted east-west traffic. | Default-deny NetworkPolicies, namespace isolation, egress controls. | Compromised frontend directly connects to the database namespace. |
| K06 | Overly Exposed Kubernetes Components | Kubernetes control-plane or management interfaces are unnecessarily exposed. | Public API server, kubelet, dashboard, metrics endpoints. | Private endpoints, firewalling, authentication, network restrictions. | Kubernetes dashboard is publicly reachable. |
| K07 | Misconfigured and Vulnerable Cluster Components | Cluster components contain vulnerabilities or insecure settings. | Outdated ingress/controller, weak configuration, vulnerable add-ons. | Patch management, configuration hardening, component inventory. | Vulnerable ingress controller allows cluster compromise. |
| K08 | Cluster to Cloud Lateral Movement | Compromised workloads pivot into cloud services through workload identity. | Overprivileged IAM roles, metadata access, weak workload identity. | Least-privilege cloud IAM, metadata restrictions, identity isolation. | Pod compromise leads to AWS role credentials and S3 access. |
| K09 | Broken Authentication Mechanisms | Kubernetes identities are incorrectly authenticated or trusted. | Weak certificates, shared credentials, poor service-account handling. | Strong identity, certificate lifecycle, workload identity, MFA where applicable. | Stolen service-account token grants cluster access. |
| K10 | Inadequate Logging and Monitoring | Security events are not visible or actionable. | No audit logging, missing runtime telemetry, insufficient retention. | Kubernetes audit logs, runtime detection, centralized monitoring. | Attacker creates a privileged pod but no alert is generated. |
The OWASP Kubernetes project currently lists these ten risks for 2025.
6. OWASP Top 10 for Agentic Applications — 2026
Agentic applications introduce an additional security dimension: the system does not merely generate an answer—it can plan, reason, call tools, maintain state, communicate with other agents, and execute actions.
OWASP's 2026 Agentic Applications Top 10 therefore focuses heavily on goal manipulation, identity, tools, memory, inter-agent communication, cascading failures, and human trust.
| # | OWASP Risk | Brief Explanation | Common Misconfiguration / Failure | Prevention / Solution | Example |
|---|---|---|---|---|---|
| ASI01 | Agent Goal Hijack | Attacker-controlled content changes the agent's objective or decision path. | Indirect prompt injection, malicious documents, poisoned tool results. | Separate instructions/data, validate external content, constrain agent goals. | Malicious webpage causes a research agent to upload confidential files. |
| ASI02 | Tool Misuse & Exploitation | Legitimate tools are abused to perform unintended actions. | Excessive tool permissions, unrestricted tool selection. | Tool allowlists, risk-based gating, least privilege, approval controls. | Agent uses a legitimate shell tool to delete files. |
| ASI03 | Identity & Privilege Abuse | Agent identities or inherited privileges are abused. | Shared service accounts, broad cloud roles, confused identity boundaries. | Unique identities, least privilege, short-lived credentials, authorization. | Agent's cloud role allows access to unrelated production resources. |
| ASI04 | Agentic Supply Chain Vulnerabilities | Agent frameworks, tools, skills, models, and dependencies can be compromised. | Untrusted plugins, packages, models, or tool registries. | Provenance, signing, SBOM, scanning, trusted registries. | Compromised agent dependency executes code on the host. |
| ASI05 | Unexpected Code Execution (RCE) | Agent workflows cause unintended code or commands to execute. | Shell tools, code interpreters, unsafe generated commands. | Sandboxing, command allowlists, isolated runtimes, deterministic validation. | Agent turns model output into a shell command and executes it. |
| ASI06 | Memory & Context Poisoning | Persistent memory or context is manipulated to influence future behavior. | Untrusted memory writes, shared memory, missing provenance. | Memory isolation, provenance, validation, expiration, user-scoped memory. | Attacker inserts a persistent instruction into agent memory. |
| ASI07 | Insecure Inter-Agent Communication | Agents communicate without sufficient authentication, integrity, or authorization. | Trusting agent messages, missing identity validation, replayable messages. | Strong agent identity, message integrity, authorization, replay protection. | Malicious agent impersonates a trusted internal agent. |
| ASI08 | Cascading Failures | One agent failure propagates through connected systems or agents. | No circuit breakers, unlimited retries, uncontrolled orchestration. | Blast-radius limits, circuit breakers, timeouts, isolation, fail-safe design. | One compromised agent causes multiple downstream agents to execute malicious actions. |
| ASI09 | Human-Agent Trust Exploitation | Humans over-trust agent recommendations or actions. | Excessive automation, weak approval UX, misleading confidence. | Human-in-the-loop for critical actions, explainability, independent validation. | Engineer applies a dangerous AI-generated infrastructure change without review. |
| ASI10 | Rogue Agents | An agent behaves outside intended constraints or becomes effectively uncontrolled. | Weak policy enforcement, unrestricted autonomy, inadequate monitoring. | Runtime policy enforcement, kill switches, bounded autonomy, continuous monitoring. | Agent continues destructive actions despite an attempted stop condition. |
The 2026 OWASP Agentic Applications document identifies these risks and lists John Sotiropoulos, Keren Katz, and Ron F. Del Rosario as project leads, with entry leads for the individual categories.
7. OWASP Agentic Skills Top 10 — 2026 Public-Review v1
Agentic skills are reusable instruction/code packages that give AI agents additional capabilities.
This creates a new supply-chain layer: the skill may contain natural-language instructions, scripts, permissions, metadata, dependencies, and external references.
The OWASP Agentic Skills Top 10 is currently a 2026 public-review v1 / active-development project, so this section should be treated as evolving rather than a final immutable standard.
| # | OWASP Risk | Brief Explanation | Common Misconfiguration / Failure | Prevention / Solution | Example |
|---|---|---|---|---|---|
| AST01 | Malicious Skills | A skill appears legitimate but contains malicious instructions or code. | Installing untrusted skills, hidden shell commands, credential theft. | Trusted registries, signatures, behavioral scanning, review. | Skill secretly reads SSH keys and sends them externally. |
| AST02 | Supply Chain Compromise | Skills or their dependencies are compromised during distribution or updates. | Compromised registry, dependency, maintainer account, or update. | Provenance, signing, dependency pinning, registry security. | Trusted skill update introduces a malicious dependency. |
| AST03 | Over-Privileged Skills | A skill has more permissions than required for its intended purpose. | Broad filesystem, shell, network, or credential access. | Least privilege, explicit permissions, sandboxing. | Markdown-formatting skill can execute arbitrary shell commands. |
| AST04 | Insecure Metadata | Skill metadata is misleading, unsigned, incomplete, or manipulated. | False permissions, impersonated publisher, missing risk information. | Signed metadata, schema validation, publisher verification. | Skill claims read-only behavior but declares unrestricted filesystem access. |
| AST05 | Untrusted External Instructions | Skills retrieve instructions from mutable external resources. | Remote documents, URLs, repositories, or instructions are trusted automatically. | Pin external content, verify provenance, treat external content as untrusted. | Skill fetches a remote document that later changes to contain malicious instructions. |
| AST06 | Weak Isolation | Skills execute with insufficient sandboxing or containment. | Full host access, unrestricted filesystem/network access. | Containers, sandboxing, seccomp, filesystem/network restrictions. | Compromised skill escapes its intended task and accesses host files. |
| AST07 | Update Drift | A previously reviewed skill changes after approval. | Unpinned versions, automatic updates, no integrity verification. | Immutable versions, hash verification, signed updates, re-review. | Approved skill silently changes behavior after an automatic update. |
| AST08 | Poor Scanning | Security scanners fail to detect malicious behavior in skills. | Regex-only scanning, no behavioral analysis, no semantic analysis. | Multi-layer static + semantic + behavioral scanning. | Malicious natural-language instructions bypass traditional malware signatures. |
| AST09 | No Governance | Organizations cannot inventory, approve, monitor, or revoke skills. | Shadow skills, no ownership, no approval process. | Skill inventory, approval workflow, audit logging, revocation. | Employees install unapproved skills that access company repositories. |
| AST10 | Cross-Platform Reuse | Skills are moved between agent platforms while losing security metadata or controls. | Permission metadata is dropped during conversion. | Normalize security metadata, revalidate permissions after migration. | A skill with restricted permissions on one platform becomes unrestricted on another. |
OWASP's current Agentic Skills project lists these ten risks and describes the project as an active 2026 initiative covering ecosystems including OpenClaw, Claude Code, Cursor/Codex, and VS Code.
8. OWASP Top 10 Mobile — 2024
Mobile applications have security characteristics that differ from server-side web applications, particularly around local storage, binary protection, device communication, and platform APIs.
The current OWASP Mobile Top 10 release is 2024.
| # | OWASP Risk | Brief Explanation | Common Misconfiguration / Failure | Prevention / Solution | Example |
|---|---|---|---|---|---|
| M1 | Improper Credential Usage | Credentials are handled insecurely in mobile applications. | Hard-coded keys, insecure credential storage, reusable tokens. | Secure storage, token rotation, no embedded secrets. | API key is extracted directly from the APK. |
| M2 | Inadequate Supply Chain Security | Third-party SDKs and dependencies introduce risk. | Unverified SDKs, vulnerable libraries, malicious dependencies. | Dependency inventory, SBOM, scanning, trusted sources. | Compromised analytics SDK collects sensitive data. |
| M3 | Insecure Authentication/Authorization | Mobile applications incorrectly establish identity or permissions. | Client-side authorization, weak token validation. | Server-side authorization, strong authentication, secure tokens. | Modified mobile request accesses another user's account. |
| M4 | Insufficient Input/Output Validation | Application fails to safely process external input or generated output. | Unsafe deep links, IPC, WebViews, unvalidated data. | Validate input/output, contextual encoding, secure IPC. | Malicious deep link triggers unintended application behavior. |
| M5 | Insecure Communication | Network communication can be intercepted or manipulated. | Weak TLS, certificate-validation bypass, plaintext traffic. | TLS, certificate validation, secure transport configuration. | Application accepts a forged server certificate. |
| M6 | Inadequate Privacy Controls | Personal or sensitive data is unnecessarily collected or exposed. | Excessive permissions, telemetry, insecure analytics. | Data minimization, privacy-by-design, permission controls. | Location data is collected when it isn't required. |
| M7 | Insufficient Binary Protections | Attackers can easily reverse engineer or tamper with the application. | No obfuscation, integrity checks, anti-tampering. | Obfuscation, integrity verification, runtime protections. | Attacker modifies the APK to bypass a security check. |
| M8 | Security Misconfiguration | Mobile platform or application security settings are incorrectly configured. | Debuggable builds, exported components, insecure WebView settings. | Secure release configuration, hardening, automated checks. | Production Android application exposes an exported activity. |
| M9 | Insecure Data Storage | Sensitive data is stored insecurely on the device. | Plaintext database, logs, preferences, cached secrets. | Platform secure storage, encryption, data minimization. | Authentication token remains in plaintext application storage. |
| M10 | Insufficient Cryptography | Cryptographic mechanisms are weak or incorrectly implemented. | Hard-coded keys, weak algorithms, predictable randomness. | Modern cryptography, secure key storage, proper key lifecycle. | App encrypts sensitive data with a hard-coded AES key. |
9. OWASP Top 10 CI/CD Security Risks
Modern application security extends into the software delivery pipeline.
The OWASP CI/CD Top 10 focuses on the pipeline itself: identities, dependencies, artifacts, credentials, third-party services, and visibility. The project was established as an OWASP project in 2022.
| # | OWASP Risk | Brief Explanation | Common Misconfiguration / Failure | Prevention / Solution | Example |
|---|---|---|---|---|---|
| CICD-SEC-1 | Insufficient Flow Control Mechanisms | Pipeline execution can be manipulated or bypassed. | Unprotected branches, uncontrolled triggers, weak approvals. | Branch protection, approval gates, trusted triggers. | Attacker modifies workflow configuration and executes malicious code. |
| CICD-SEC-2 | Inadequate Identity & Access Management | Pipeline identities have excessive privileges. | Shared service accounts, permanent admin tokens. | Least privilege, MFA, short-lived credentials. | CI runner can modify production infrastructure. |
| CICD-SEC-3 | Dependency Chain Abuse | Attackers compromise dependencies used by the pipeline. | Unpinned packages, malicious packages. | Pinning, provenance, SBOM, dependency verification. | Build downloads a malicious dependency. |
| CICD-SEC-4 | Poisoned Pipeline Execution | Attacker-controlled changes execute inside trusted pipeline infrastructure. | Untrusted PRs, unsafe workflow triggers. | Isolated runners, permissions restrictions, trusted workflows. | Pull request executes commands with repository secrets. |
| CICD-SEC-5 | Insufficient PBAC | Pipeline permissions don't match the specific workflow. | Broad pipeline privileges. | Pipeline-based least privilege and policy controls. | Test job can deploy to production. |
| CICD-SEC-6 | Insufficient Credential Hygiene | Pipeline credentials are exposed or poorly managed. | Secrets in logs, static tokens, excessive lifetime. | Secret managers, masking, rotation, short-lived tokens. | Cloud credential appears in CI logs. |
| CICD-SEC-7 | Insecure System Configuration | CI/CD systems themselves are insecurely configured. | Exposed runners, weak isolation, default credentials. | Harden runners, isolate environments, secure configuration. | Self-hosted runner is reachable from untrusted networks. |
| CICD-SEC-8 | Ungoverned Usage of Third-Party Services | External services introduce unmanaged security risk. | Unapproved SaaS integrations, excessive permissions. | Vendor review, allowlists, OAuth scope control. | CI integrates with an unreviewed external service that can access source code. |
| CICD-SEC-9 | Improper Artifact Integrity Validation | Build artifacts are trusted without verifying integrity or provenance. | No signing, unsigned containers, mutable tags. | Signing, provenance, digest pinning, verification. | Deployment pulls a modified latest container. |
| CICD-SEC-10 | Insufficient Logging & Visibility | Pipeline attacks cannot be detected or investigated. | Missing audit logs and pipeline telemetry. | Centralized logs, audit trails, alerts, monitoring. | Attacker changes build configuration with no audit trail. |
How These Top 10s Connect
The most important lesson is that these frameworks should not be treated as isolated checklists.
A modern application might look like this:
INTERNET
│
▼
┌─────────────┐
│ WEB │
│ OWASP T10 │
└──────┬──────┘
│
▼
┌─────────────┐
│ APIs │
│ API T10 │
└──────┬──────┘
│
┌─────────────┴─────────────┐
▼ ▼
┌─────────────┐ ┌─────────────┐
│ Kubernetes │ │ Cloud │
│ K8s T10 │ │ IAM / Data │
└──────┬──────┘ └─────────────┘
│
▼
┌─────────────┐
│ AI / LLM │
│ LLM T10 │
└──────┬──────┘
│
┌──────┴───────────┐
▼ ▼
┌─────────────┐ ┌─────────────┐
│ MCP │ │ AI Agents │
│ MCP T10 │ │ Agentic T10 │
└──────┬──────┘ └──────┬──────┘
│ │
└─────────┬─────────┘
▼
┌───────────────┐
│ Agent Skills │
│ AST10 │
└───────────────┘
▲
│
┌──────┴──────┐
│ CI/CD │
│ T10 │
└─────────────┘
The security boundary is therefore no longer just:
Browser → Web Application
It is increasingly:
User → Web → API → Cloud → Kubernetes → CI/CD → AI → MCP → Tools → Agents → Skills → Data
That is why modern product-security programs need to combine multiple OWASP frameworks rather than relying on the Web Top 10 alone.
A Practical Security Engineer's Mapping
| If you are securing... | Start with... | Then add... |
|---|---|---|
| Traditional Web Application | OWASP Web Top 10 | API Top 10 |
| REST/GraphQL APIs | API Security Top 10 | Web Top 10 |
| Kubernetes Platform | Kubernetes Top Ten | API + CI/CD |
| Cloud-Native Product | Web + API | Kubernetes + CI/CD |
| LLM Application | LLM Top 10 | Web + API + Cloud |
| RAG Application | LLM Top 10 | API + Data + Vector security |
| MCP Application | MCP Top 10 | LLM + API + Agentic |
| AI Agent | Agentic Applications Top 10 | LLM + MCP |
| AI Agent Skills | Agentic Skills Top 10 | Agentic + MCP + Supply Chain |
| Mobile Application | Mobile Top 10 | API + Web |
| Software Supply Chain | CI/CD Top 10 | Web + API + Kubernetes |
The Big Picture
The OWASP Top 10 has evolved from a web application awareness list into a much broader ecosystem of security guidance.
The interesting trend is the movement of the security boundary:
Web → API → Cloud → Kubernetes → CI/CD → LLM → MCP → Agents → Skills
Each new layer introduces new trust boundaries, identities, permissions, data flows, and execution capabilities.
For security engineers, the challenge is no longer simply:
"Is the application vulnerable?"
The better question is:
"Where can untrusted input cross a trust boundary and gain unintended capability?"
That question works across web applications, APIs, Kubernetes, cloud platforms, LLMs, MCP servers, agents, and agentic skills.
And that is ultimately what the OWASP Top 10 frameworks help us reason about: where modern systems can fail, what attackers can reach, and which security controls should exist before those failures become incidents.
Official OWASP References
Security Node Security Engineering for the Modern Stack
8 views