Agentic AI security currently means two entirely different things depending on who is using the term, and the gap between those definitions describes the central security challenge and the central security opportunity of the current moment.
The first definition, adopted by Palo Alto Networks, Microsoft, AWS, and the OWASP GenAI project: agentic AI security is the discipline of securing AI agents from attack. As organisations deploy autonomous AI systems that can browse the web, execute code, call APIs, manage files, and take actions in the world, those systems become attack surfaces. Prompt injection, data poisoning, memory manipulation, and tool misuse are the vulnerability classes of AI systems, and agentic AI security, in this definition, is how you protect against them.
The second definition, the one that describes 10x Pentest's product and a new category of security tooling: agentic AI security is the use of AI agents to perform security testing. Agentic AI systems that reason about application behavior, adapt their testing approach based on what they observe, and exploit vulnerabilities the way expert human testers do: continuously, at scale, and at the pace of modern software development.
Both definitions are real. Both matter. And understanding why they are converging on the same term, how each one addresses problems the other cannot, and what happens at the intersection of the two is the most important thing a security leader can understand about the next five years of application security.
This post covers both.
An agentic AI system is an AI model augmented with the ability to take actions in the world. A language model on its own generates text. An agentic AI system uses that language model as a reasoning core while also having access to tools: web search, code execution, file read/write, API calls, email, calendar, database queries. It can be given a goal and pursue it across multiple steps, deciding what actions to take and in what sequence, without human intervention at each step.
This architecture is a fundamental shift from AI as a content generator to AI as an autonomous actor. It is also why agentic AI security is a fundamentally different discipline from conventional application security: the threat model changes when the system being secured can take actions with real-world consequences.
When an AI agent can browse the web, read files, call APIs, and execute code, every surface it interacts with becomes a potential injection point. The attacker's goal is no longer to find a vulnerability in the application's code: it is to find a way to introduce malicious instructions into the agent's context that cause it to take actions the system designer did not intend.
Prompt injection is the primary attack class against agentic AI systems. An indirect prompt injection attack embeds malicious instructions in content the agent retrieves during its operation: a web page the agent browses, a document the agent reads, an API response the agent processes. The injected instruction attempts to override the agent's original goals and redirect its actions. If the agent has access to send emails, read sensitive files, or make API calls to external services, a successful injection can use those capabilities for malicious purposes.
Memory and context manipulation targets the agent's persistent memory systems. Agentic systems increasingly use vector databases and other persistent memory mechanisms to retain information across sessions. Poisoning the memory store with false information changes how the agent reasons about future tasks.
Tool misuse exploits the gap between what an agent's tools are intended to do and what they can be made to do. An agent with file system access intended for reading project files can potentially be manipulated into writing to system locations. An agent with API access intended for specific integrations can potentially be manipulated into calling arbitrary endpoints.
Supply chain attacks on AI components target the models, vector databases, retrieval systems, and external tools that compose an agentic AI system. A compromised embedding model used in a RAG system introduces subtle biases. A malicious tool returned by a tool registry poisons the agent's capability set.
OWASP has published both the OWASP Top 10 for Large Language Models and the OWASP AI Agent Security Framework, providing structured taxonomies of the vulnerability classes specific to AI systems.
The OWASP LLM Top 10 covers prompt injection (LLM01), insecure output handling (LLM02), training data poisoning (LLM03), model denial of service (LLM04), supply chain vulnerabilities (LLM05), sensitive information disclosure (LLM06), insecure plugin design (LLM07), excessive agency (LLM08), overreliance (LLM09), and model theft (LLM10).
For agentic systems specifically, LLM08 (excessive agency) is the most directly relevant: an AI agent with access to capabilities beyond what its task requires creates a larger blast radius from any successful attack. An agent that only needs to read from a specific database but has write access to all databases can cause far more damage when compromised than one with strictly minimal permissions.
Defending agentic AI systems requires applying these principles at the architecture level: minimal tool access, sandboxed execution environments, output validation before any action with real-world consequences, human oversight requirements for high-stakes actions, and robust logging of all agent actions and reasoning chains.
Traditional application security assumes a defined request-response model: input comes in, code processes it, output goes out. The attacker's task is to craft input that causes the code to behave unexpectedly.
Agentic AI systems break this model. The "input" is not just the user's query: it is everything the agent perceives: the web pages it reads, the files it accesses, the API responses it receives, the memory it retrieves. Any of these can contain adversarial content. The "output" is not just a response: it is a sequence of actions that may include modifying files, sending messages, calling APIs, or spawning new agents.
The attack surface is dynamic and expansive in ways that traditional application security was not designed to handle. This is why agentic AI security, in its defensive definition, has emerged as a distinct discipline requiring new frameworks, new tools, and new expertise.
Traditional application security testing has an adversarial advantage problem: attackers have more time than defenders.
A penetration test runs for two weeks per quarter. The attacker has persistent access to public information about the application, can probe it at any time, and does not operate on a fixed engagement schedule. The vulnerability introduced by a deployment on week three of a twelve-week period between engagements is not tested until the next engagement begins.
SAST and DAST tools provide continuous coverage but cover fundamentally different vulnerability classes than human testers. SAST tools: what they catch and what they miss covers the structural boundary of static analysis. How DAST compares to agentic AI pentesting on real-world coverage covers the DAST boundary. The security gaps DAST and standard testing misses maps all ten categories: business logic, multi-role authorization, race conditions, chained attack paths: the vulnerability classes that require attacker reasoning, not signature matching.
The gap between what automated tools can find and what skilled human testers find has been a known problem in application security for decades. It had no good solution until agentic AI systems became capable enough to perform the reasoning that distinguishes a penetration tester from a scanner.
Previous generations of security automation (automated scanners, DAST tools, fuzzing engines: they operated through enumeration and signature matching. They fired known payloads at accessible inputs and matched responses against known vulnerability patterns. This approach finds what it knows to look for.
Agentic AI penetration testing operates through reasoning. The agent observes application behavior, forms hypotheses about how the application works, designs test cases based on those hypotheses, executes tests, interprets results, updates its understanding, and adapts its approach. This is the same cognitive loop that a skilled human penetration tester uses, and it is what allows agentic testing to find vulnerabilities that have no signatures.
Five properties distinguish agentic AI security testing from all previous automation:
Reasoning from observation. Rather than firing fixed payloads, agentic systems observe how the application responds and reason about what that implies about the underlying logic. An agentic tester that observes that a discount code is applied before the item count is validated reasons that applying the code multiple times in rapid succession may apply it multiple times. A scanner that does not have "discount race condition" in its signature library does not make this inference.
Multi-step attack planning. Human penetration testers find the most serious vulnerabilities through chains of individually minor findings. An information disclosure finding reveals an internal identifier. That identifier enables an IDOR attack. The IDOR attack reveals credentials. The credentials enable privilege escalation. Agentic AI can pursue these chains because each step informs the next: the agent maintains context across the entire attack path rather than treating each request independently.
Multi-session authorization testing. The most common critical finding class in modern web applications is broken access control: one user reaching another user's resources. Testing this requires operating simultaneously as multiple users with different privilege levels and systematically testing whether lower-privilege users can reach higher-privilege resources. DAST tools operate as single sessions. Agentic systems maintain multiple simultaneous sessions and test the boundaries between them.
Application-intent reasoning. Business logic vulnerabilities exist when what the code does differs from what the application is supposed to do. Finding them requires understanding application intent. An agentic system that understands that a transfer workflow should not allow negative amounts can test whether negative amounts reverse the direction of the transfer. No signature library contains "test this application's specific business rules."
Deployment-triggered continuous coverage. Agentic security testing runs on every significant deployment, covering the full defined scope each time. The window between the introduction of a vulnerability and its detection is compressed from months to hours. This is the cadence difference that addresses the adversarial time advantage problem: the attacker no longer has the window between quarterly engagements to exploit newly introduced vulnerabilities.
Agentic pentesting and continuous security validation covers the architecture of agentic penetration testing in depth. How autonomous pentesting works in a DevSecOps pipeline covers the operational integration model. AI in penetration testing: how automation is changing security testing covers the broader automation landscape and where agentic systems sit within it.
The traditional AppSec stack (SAST, DAST, IAST) is designed for the vulnerabilities it can find, not for the vulnerabilities that matter most to attackers. What is application security testing: SAST, DAST, IAST, and autonomous pentesting covers where each tool sits in the stack. The summary:
SAST finds code pattern vulnerabilities before execution. It does not find runtime vulnerabilities, business logic flaws, or authorization gaps.
DAST finds externally observable vulnerabilities in the running application. It does not see inside the code, cannot test multi-session authorization boundaries, and cannot find business logic flaws with no observable HTTP signature.
IAST finds confirmed runtime vulnerabilities during test execution. It sees only code paths that test cases exercise, cannot test external attacker perspective, and cannot find vulnerabilities that require multi-step attacker reasoning.
Agentic penetration testing finds what all three miss: business logic, multi-role authorization gaps, race conditions, chained attack paths, and vulnerabilities that only appear when an attacker reasons about application intent. It does not replace SAST, DAST, or IAST: it covers the vulnerability classes outside their structural reach.
The distinction matters for security programmes because misunderstanding what each tool covers leads to security programmes that have comprehensive tooling for the categories those tools address and zero coverage for the categories they do not.
The two definitions of agentic AI security are not coincidentally using the same term. They are describing aspects of the same underlying phenomenon: AI systems that reason and act autonomously are simultaneously the most powerful security testing tool ever deployed and a new class of attack surface requiring its own security discipline.
An agentic AI penetration testing system exercises exactly the capabilities that make agentic AI systems security risks: reasoning about application intent, maintaining context across multi-step interactions, adapting approach based on observation, and chaining individually minor findings into serious attack paths. The same cognitive architecture that an attacker exploits through prompt injection is the architecture that an agentic penetration tester uses to find vulnerabilities.
This convergence has two implications.
First: security teams evaluating agentic AI security tooling need to understand both definitions. An organisation deploying AI agents for code review, ticket triage, or customer support needs to secure those agents against attack (Definition A) while also testing their applications more thoroughly using the same AI capabilities (Definition B). These are different tools and different disciplines, but they are both agentic AI security.
Second: agentic AI testing systems must themselves be secured. A penetration testing agent with access to authenticate as users across multiple sessions, submit payloads to application endpoints, and extract proof-of-exploitation evidence has significant access to the systems it tests. The security of the testing infrastructure (how credentials are handled, how test evidence is stored, how the agent's own attack surface is managed) is itself an agentic AI security question.
| Dimension | SAST | DAST | Manual Pentest | Agentic AI Testing |
|---|---|---|---|---|
| When it runs | Pre-execution | Against live app | Periodic engagement | Continuous / per deploy |
| What it finds | Code patterns | External signatures | All vulnerability classes | All vulnerability classes |
| Business logic coverage | No | No | Yes | Yes |
| Multi-role authorization | No | No | Yes | Yes |
| Chained attack paths | No | No | Yes | Yes |
| False positive rate | High | Moderate | Low (confirmed findings) | Low (confirmed findings) |
| Cadence match to dev velocity | Yes | Yes | No | Yes |
| Scales with application count | Yes | Yes | No (cost scales linearly) | Yes |
Attack surface management: what it is and why it matters covers how continuous asset discovery complements agentic testing: ASM discovers what is exposed, agentic testing confirms what is exploitable. Continuous penetration testing and how it differs from annual pentests covers the cadence model that makes agentic testing operationally practical.
For organisations ready to evaluate what agentic AI security testing covers and how it fits alongside their existing AppSec stack, the 10x Pentest platform covers the model in detail. For agentic penetration testing as the continuous security validation layer and penetration testing services in the US for engagements requiring human expertise alongside continuous agentic coverage, see pricing or get in touch to discuss how agentic testing fits your security programme. For PTaaS that combines the continuous coverage of agentic testing with periodic human-led deep dives, that page covers the delivery model.
Q1. What is agentic AI security?
"Agentic AI security" covers two related disciplines. The first, adopted by Palo Alto Networks, Microsoft, and OWASP, refers to securing autonomous AI systems from attack: defending against prompt injection, data poisoning, memory manipulation, and tool misuse attacks against AI agents. The second refers to using agentic AI systems to perform security testing: deploying AI agents that reason about application behaviour, plan and execute multi-step attacks, and find vulnerabilities that traditional tools cannot detect. Both definitions are current and important. The distinction matters because they address different problems with different tools and different expertise.
Q2. How is agentic AI security testing different from DAST?
DAST fires predefined payloads at accessible input points and matches responses against vulnerability signatures. It finds what it knows to look for through a single automated session. Agentic AI security testing observes application behaviour, reasons about what it implies, designs test cases based on that reasoning, and adapts its approach based on results, across multiple simultaneous sessions and over multi-step attack chains. DAST cannot find business logic vulnerabilities (which have no signatures), multi-role authorization gaps (which require simultaneous sessions), or chained attack paths (which require maintaining context across multiple findings). Agentic AI testing can find all three.
Q3. What are the main security risks of agentic AI systems?
The primary security risk classes for agentic AI systems are: prompt injection (malicious instructions embedded in content the agent retrieves, redirecting its actions); memory and context manipulation (poisoning the agent's persistent memory store with false information); tool misuse (exploiting the gap between intended and possible tool usage to cause the agent to take harmful actions); supply chain vulnerabilities in AI components including models, vector databases, and retrieval systems; and excessive agency (agents with access to capabilities far beyond their task requirements, creating large blast radius when compromised). The OWASP LLM Top 10 provides the most comprehensive taxonomy of these vulnerability classes.
Q4. Why can't traditional AppSec tools find business logic vulnerabilities?
Business logic vulnerabilities exist when what the code does differs from what the application is intended to do. Finding them requires understanding application intent: what the workflow is supposed to enforce, what constraints are supposed to apply, what state transitions are supposed to be valid. Static analysis examines code patterns, not application intent. DAST matches HTTP responses against signatures, but business logic flaws typically produce normal HTTP responses. Only a testing approach that can reason about application intent from observation: exactly what skilled human penetration testers and agentic AI testing systems do: this is what can reliably find this class of vulnerability.
Q5. What is the OWASP LLM Top 10 and does it apply to agentic AI?
The OWASP Top 10 for Large Language Models is a taxonomy of the most critical vulnerability classes specific to AI language model applications. It covers prompt injection (LLM01), insecure output handling (LLM02), training data poisoning (LLM03), model denial of service (LLM04), supply chain vulnerabilities (LLM05), sensitive information disclosure (LLM06), insecure plugin design (LLM07), excessive agency (LLM08), overreliance (LLM09), and model theft (LLM10). It applies directly to agentic AI systems, which are AI language models augmented with tools and autonomous action capabilities. LLM08 (excessive agency) is particularly relevant to agentic systems: an agent with access to more capabilities than its task requires creates disproportionate risk when any other vulnerability in the list is exploited.
Cyber insurers now require penetration testing as a condition of coverage but not every pentest satisfies underwriting requirements. This guide maps what underwriters actually review and why it matters.
Tejas Dhokane Sep 9, 2026 
An AI agent conducting penetration testing has credentials, tool access, and exploit capabilities. These raise legitimate security questions. This guide maps five risk categories and the design controls that address each.
Tejas Dhokane Sep 8, 2026 
Most "automated penetration testing" is scripted scanning with a different label. This guide maps the full automation spectrum scanners, DAST, BAS, and agentic testing and what each actually does.
Tejas Dhokane Sep 8, 2026 Schedule a free consultation and see how teams like yours are strengthening their security posture — continuously.
