Key takeaways
- The OWASP GenAI Security Project published the OWASP Top 10 for Agentic Applications for 2026 on 9 December 2025, listing ten risks from ASI01 Agent Goal Hijack to ASI10 Rogue Agents.1
- The list exists because agents act: a fooled chatbot says something wrong, but a fooled agent sends the email, runs the code or moves the data.
- 76% of security professionals worry about the security of AI agents, yet only 37% of organisations have a formal AI deployment policy, per Darktrace's 2026 survey of 1,540 practitioners.6
- IBM's 2026 breach study puts the average loss from a prompt injection incident at USD 5.89 million, second only to model inversion among AI incident types.7
- Every one of the ten risks can be tested: plant hidden instructions, push tools past their scope, poison memory, spoof agent messages and check whether a human or a control stops the damage.
Your company probably has an AI agent already. It reads support tickets, drafts replies, looks up orders and maybe issues refunds. It is fast and helpful, and it will follow any instruction that sounds convincing, including one hidden in a customer's PDF. Traditional security tests were built for software that does the same thing every time. Agents do not. They decide what to do at run time, using tools and permissions you gave them. That is the gap the OWASP Top 10 for Agentic Applications was written to close.
Last reviewed on 22 October 2026 against the OWASP Top 10 for Agentic Applications for 2026, the OWASP Top 10 for LLM Applications (2025 and 2026 editions), IBM Cost of a Data Breach 2026 and Darktrace State of AI Cybersecurity 2026.
What is the OWASP Top 10 for Agentic Applications?
The OWASP Top 10 for Agentic Applications is a free, community-built list of the ten most critical security risks in AI agents: systems that plan, use tools and take actions on their own. The OWASP GenAI Security Project released it on 9 December 2025 with input from more than 100 experts.1
OWASP is the non-profit behind the well-known web application Top 10. Its GenAI Security Project already publishes a Top 10 for LLM applications. The agentic list is a separate document that focuses on what changes once the model is given hands. OWASP's own announcement puts it simply: "Once AI began taking actions, the nature of security changed forever."2
- AI agent (plain definition)
- Software built around a language model that is given a goal, breaks it into steps, and carries those steps out by calling tools such as email, databases, browsers, code runners or other agents, often with little or no human review of each step.
Each entry has an ID from ASI01 to ASI10, a description, common examples, attack scenarios and mitigations. The document also pushes a principle it calls least agency: give an agent only the freedom to act that its task needs, in the same way least privilege limits what an account can access.1 Keep that idea in mind. Most of the controls later in this guide are least agency in practice.
Why do AI agents need their own Top 10?
AI agents need their own Top 10 because they turn model mistakes into real actions. A chatbot that is tricked gives a bad answer. An agent that is tricked can send data out, change records or run code, using real credentials, at machine speed, often before any human sees what happened.
Three things make agents different from a normal app or a plain chatbot:
- They cannot reliably tell data from instructions. An agent reads emails, web pages and files to do its job. Any of that text can carry an instruction, and the model may follow it.
- They hold power. Tools, API keys and service accounts let an agent do what a user could do, and sometimes more.
- They chain. One agent's output becomes the next agent's input, and memory carries today's mistake into next week.
Adoption is moving faster than control. Gartner expects that by 2028, 33% of enterprise software applications will include agentic AI, up from less than 1% in 2024, and that at least 15% of day-to-day work decisions will be made autonomously. It also predicts that over 40% of agentic AI projects will be cancelled by the end of 2027, citing costs, unclear value and "inadequate risk controls".9
The stats above come from Darktrace's survey of 1,540 security professionals in 14 countries6 and from IBM's 2026 Cost of a Data Breach research, where the prompt injection and access control figures appear.7 IBM also found that more than 20% of organisations reported a breach targeting AI models or applications, and that AI-enabled breaches cost about USD 6 million on average, roughly USD 1 million above the overall average of USD 4.99 million.8
- 01 Agent Goal Hijack
- 02 Tool Misuse and Exploitation
- 03 Identity and Privilege Abuse
- 04 Agentic Supply Chain
- 05 Unexpected Code Execution
- 06 Memory and Context Poisoning
- 07 Insecure Inter-Agent Comms
- 08 Cascading Failures
- 09 Human-Agent Trust Exploitation
- 10 Rogue Agents
The OWASP agentic Top 10 at a glance
The OWASP agentic Top 10 covers ten risks: goal hijack, tool misuse, identity and privilege abuse, supply chain, unexpected code execution, memory poisoning, insecure agent messaging, cascading failures, human trust exploitation and rogue agents. The table below gives each one a plain meaning, an example, a test and the control that matters most.
| ID and risk | Plain meaning | Example | How to test | Key control |
|---|---|---|---|---|
| ASI01 Agent Goal Hijack | Someone changes what the agent is trying to do | A crafted email makes an assistant leak files (EchoLeak) | Hide instructions in emails, pages, PDFs and tool output | Treat all content as untrusted; lock goals |
| ASI02 Tool Misuse and Exploitation | The agent uses a real tool in a harmful way | A PDF tells the agent to run a "cleanup" shell tool that leaks logs | Push each tool past its scope: bulk export, delete, send out | Per-tool least privilege; confirm risky calls |
| ASI03 Identity and Privilege Abuse | The agent acts with more rights than it should | A finance agent passes all its rights to a helper agent | Try to act beyond the calling user's own rights | Short-lived, task-scoped tokens |
| ASI04 Agentic Supply Chain | A third-party tool, model, prompt or agent is malicious | A poisoned prompt shipped inside a coding assistant extension | Inventory MCP servers; change a tool description after approval | Signed, pinned, allowlisted components |
| ASI05 Unexpected Code Execution | The agent writes and runs code it should not | Unreviewed shell commands delete production data | Make the agent run code, then try to reach files and network | Sandbox, no root, no eval |
| ASI06 Memory and Context Poisoning | False data in memory steers future decisions | A fake price is stored as fact and later approved | Plant a false fact; check a later session or user | Scan memory writes; isolate sessions |
| ASI07 Insecure Inter-Agent Communication | Messages between agents can be faked or changed | Injected instructions on an unencrypted agent channel | Spoof, replay and alter agent messages | Mutual authentication; signed messages |
| ASI08 Cascading Failures | One bad step spreads through a chain of agents | A poisoned analysis agent inflates limits; trading agents act on it | Inject one bad output upstream; trace how far it goes | Separate planning from execution; circuit breakers |
| ASI09 Human-Agent Trust Exploitation | People approve harmful actions because the agent sounds sure | A coding assistant suggests a "fix" that installs a backdoor | Make the agent argue for a bad action; watch reviewers | Clear risk cues; multi-step approval |
| ASI10 Rogue Agents | The agent drifts from its task and hides it | After a poisoned page, an agent keeps sending files out | Compare logged actions with the stated task; test the kill switch | Signed audit logs; behaviour monitoring |
Examples and controls are summarised from the scenarios and mitigations in the OWASP document.1 Note that the numbers are IDs, not a strict ranking of how common each risk is. Your own ranking depends on what your agent can do, which is what the profiler further down works out.
Goal and trust risks: ASI01, ASI09 and ASI10
Goal and trust risks are about who really controls the agent. Agent goal hijack (ASI01) lets an attacker rewrite the agent's objective, human-agent trust exploitation (ASI09) gets people to approve harmful steps, and rogue agents (ASI10) keep acting against their task while each single action looks normal.
ASI01 Agent Goal Hijack
This is the headline risk. Agents cannot reliably tell the difference between instructions from their owner and text they happen to read. An attacker plants an instruction in content the agent will process: an email, a web page, a support ticket, a calendar invite, even a tool's output. The agent then works toward the attacker's goal instead of yours.
OWASP cites EchoLeak as an example.1 Researchers at Aim Security found that a crafted email could make Microsoft 365 Copilot pull sensitive data from the user's context and send it out, with no click from the victim. The flaw, CVE-2025-32711, was rated 9.3 (critical) and fixed by Microsoft in June 2025, which said there was no evidence of use in the wild.12
A better system prompt will not fix this. Telling the model to "ignore instructions in documents" lowers the success rate but does not remove the risk. Design as if injection will sometimes succeed, and limit what a hijacked agent can reach.
ASI09 Human-Agent Trust Exploitation
Human approval is a strong control, until the human stops reading. Agents write fluent, confident explanations. An attacker who has influenced the agent can use that fluency to get a reviewer to click "approve". OWASP's example is a compromised coding assistant that suggests a slick one-line fix which actually runs a malicious script.1 The test is not only "is there an approval step" but "does the approval step still work when the agent argues for a bad action".
ASI10 Rogue Agents
A rogue agent is one that has drifted from its intended function, through compromise or misalignment, and keeps going. Each action may look legitimate on its own. Only the pattern shows the problem: an agent that should summarise files is quietly sending them to an outside server. OWASP recommends signed, tamper-proof logs of every action and tool call, plus behaviour monitoring, including watchdog agents that check peers.1
A chatbot that is fooled says something wrong. An agent that is fooled does something wrong.
Arxiis Research
Tool, identity and code risks: ASI02, ASI03 and ASI05
Tool, identity and code risks decide how much damage a fooled agent can do. Tool misuse (ASI02) turns legitimate tools into weapons, identity and privilege abuse (ASI03) lets an agent act beyond its rights, and unexpected code execution (ASI05) turns a text prompt into commands running on your systems.
ASI02 Tool Misuse and Exploitation
The tools are real and authorised. The problem is how they get used. A support agent with a "send email" tool can send your customer list to anyone. A database tool meant for single lookups can be asked for a full export. OWASP's guidance is to give each tool its own least-privilege profile (read-only database access, no send or delete for email where not needed) and to require confirmation for high-impact calls.1
ASI03 Identity and Privilege Abuse
Agents often run with a service account that can do far more than any single user. That creates a confused deputy: a low-privilege user asks the high-privilege agent to do something the user could never do directly. Delegation makes it worse. In the OWASP scenario, a finance agent hands a database agent all of its permissions, and an attacker steers it into pulling HR and legal data. The fix is short-lived tokens scoped to one task, and agents that act with the rights of the user they serve.1 This is the same lesson as credential-based attacks where intruders simply log in: whoever holds the token holds the power.
IBM's 2026 data shows how common this gap is: only 40% of organisations reported using access controls on AI models and data.7
ASI05 Unexpected Code Execution
Coding agents, data analysis agents and "computer use" agents write code and run it. If an attacker can influence the prompt, they can influence the code. OWASP describes an agent that generates and runs unreviewed shell commands during automated coding and deletes production data.1 The controls are old ones applied to a new source of code: run it in a sandbox, never as root, with file and network access limited to what the task needs, and no eval() on model output.
Memory, supply chain and multi-agent risks: ASI04, ASI06, ASI07 and ASI08
Memory, supply chain and multi-agent risks come from what an agent trusts without checking: third-party tools and MCP servers (ASI04), its own stored memory (ASI06), messages from other agents (ASI07), and chains of automated steps where one fault spreads before anyone notices (ASI08).
ASI04 Agentic Supply Chain Vulnerabilities
Agents load tools, prompts, models and plugins at run time, often from public registries. The Model Context Protocol (MCP), a common standard for connecting agents to tools, made this easy and also created a new attack path. In April 2025, Invariant Labs showed tool poisoning: hidden instructions in an MCP tool's description, which the model reads but the user rarely sees, made an agent in Cursor read SSH keys and MCP config files. They also showed a rug pull, where a server changes a tool description after the user has approved it.10 OWASP's separate MCP Top 10 lists tool poisoning as MCP03 and recommends signed schemas and tool manifests.11
Supply chain risk is not only theory. In July 2025, AWS reported that an inappropriately scoped GitHub token let an attacker commit malicious code to the Amazon Q Developer extension for VS Code, which shipped in version 1.84.0. AWS said the code failed to run because of a syntax error, so no customer environments were affected.13 OWASP uses this case as an ASI04 example.1
ASI06 Memory and Context Poisoning
Memory makes agents useful across sessions. It also means a lie told once can be believed forever. OWASP's scenario: an attacker keeps repeating a fake flight price until the assistant stores it as fact and later approves bookings at that price.1 The same applies to RAG stores, where one poisoned document can steer every answer that retrieves it. Scan memory writes before they are saved, keep users and tasks apart, and give memory an expiry.
ASI07 Insecure Inter-Agent Communication
Multi-agent systems pass messages that are often plain natural language with weak or no authentication. If an attacker can read, fake or replay those messages, they can steer the whole group. Treat agent-to-agent traffic like any service traffic: mutual authentication, encryption, signed messages and checks for hidden instructions inside the content.1
ASI08 Cascading Failures
In a chain, a small error does not stay small. OWASP describes a market analysis agent, poisoned by injection, that inflates risk limits; the downstream position and execution agents then trade larger positions with no check.1 For Indian banks, NBFCs and brokers exploring agentic workflows, this is the scenario to rehearse. The key control is to separate planning from execution with an external policy engine that can refuse an action, plus rate limits and circuit breakers.
Guidance, not law. The OWASP list is voluntary. But if an agent processes personal data, the Digital Personal Data Protection Act, 2023 still requires reasonable security safeguards (Section 8(5)); see our DPDP Rules security safeguards checklist. Sector rules from RBI or SEBI may also apply to the systems an agent touches. This is not legal advice; check the latest text.
How is it different from the OWASP LLM Top 10?
The OWASP LLM Top 10 covers risks in any application built on a large language model, such as prompt injection and data leaks. The agentic Top 10 covers what happens when that model plans and acts with tools, memory, credentials and other agents. Most teams building agents need both lists, not one.
The OWASP LLM Top 10 2025 was published in November 2024.3 It already had an entry called Excessive Agency (LLM06:2025), the seed of the agentic list. A newer 2026 edition of the LLM list followed in August 2026.4 In it, Excessive Agency moved up to LLM03:2026 and System Prompt Leakage became Hidden Context Exposure (LLM08:2026).5 The table maps the 2025 entries, which most existing controls and audits still reference, to the closest agentic risks.
| LLM Top 10 (2025) | Closest agentic risk | What changes with agents |
|---|---|---|
| LLM01 Prompt Injection | ASI01 Goal Hijack | Injection changes actions and plans, not only answers |
| LLM02 Sensitive Information Disclosure | ASI02, ASI03 | Agents can move data out with real tools and rights |
| LLM03 Supply Chain | ASI04 Agentic Supply Chain | Tools and MCP servers load at run time and can change |
| LLM04 Data and Model Poisoning | ASI06 Memory and Context Poisoning | Poison enters through memory during use, not only training |
| LLM05 Improper Output Handling | ASI05 Unexpected Code Execution | Output is run as code or commands directly |
| LLM06 Excessive Agency | ASI02, ASI03, ASI10 | Split into tool, identity and rogue behaviour risks |
| LLM07 System Prompt Leakage | ASI01, ASI03 | Leaked prompts reveal goals, tools and secrets to target |
| LLM08 Vector and Embedding Weaknesses | ASI06 | RAG stores become long-term agent memory |
| LLM09 Misinformation | ASI09 Human Trust Exploitation | Wrong but confident output gets approved and acted on |
| LLM10 Unbounded Consumption | ASI08 Cascading Failures | Loops between agents multiply cost and load |
| (no direct entry) | ASI07 Inter-Agent Communication | New: agents trust messages from other agents |
The mapping is our reading for orientation. OWASP publishes its own cross-references between the lists, and the 2026 LLM edition maps its entries to the agentic Top 10.4
How do you pentest an AI agent?
AI agent penetration testing means attacking the agent the way a real adversary would: feed it hidden instructions through every input, push each tool and permission past its limits, poison its memory and messages, and prove what damage results. The goal is evidence of impact, not a list of theoretical weaknesses.
A scan tells you a weakness might exist. A pentest shows what an attacker can actually do with it. If that difference is new to your team, our guide to vulnerability assessment vs penetration testing explains it. For agents, the difference matters even more, because the same weakness can be harmless in one agent and critical in another depending on its tools.
- Map the agent. Write down its goal, system prompt, every tool, every credential, memory stores, data it touches, other agents it talks to and MCP servers it loads. This is your attack surface.
- Plant indirect injections in every input channel. Emails, web pages, PDFs, tickets, calendar invites, file names, tool outputs. Check whether the plan or tool calls change (ASI01).
- Push every tool past its intended scope. Ask for bulk exports, deletes, sends to outside addresses and chained calls (ASI02).
- Test identity. Can a low-privilege user get the agent to do what they cannot? How long do tokens live? What do delegated agents inherit (ASI03)?
- Try to run code and escape. Get the agent to write and run code, then try to read files, reach the network or leave the sandbox (ASI05).
- Poison memory. Plant a false fact or instruction in one session and see whether it affects later sessions or other users (ASI06).
- Attack the supply chain and messages. Check MCP servers and plugins for pinning and signing, simulate a rug pull, and spoof or replay agent messages (ASI04, ASI07, ASI08).
- Test the human step, then report and retest. See whether reviewers approve a persuasive bad action (ASI09), check logs catch drift (ASI10), map every finding to its ASI ID and retest after fixes.
Automation helps with volume. Injection payloads should be replayed on every release, because a new model version or prompt can reopen an old hole. Judgement is still needed to decide whether a tool call actually hurt the business. Our comparison of automated vs manual penetration testing covers how to split that work. Frameworks such as MITRE ATLAS, which catalogues attacks on AI systems, help structure the test plan.
Which OWASP agentic risks does your agent carry?
Tick what your agent can do. The profiler ranks the ASI risks that apply, scores your total exposure and lists the three tests to run first.
Tick at least one capability to see your ranked risks.
Indicative only. Weights reflect the OWASP descriptions and our testing judgement: untrusted input plus a powerful capability scores higher than either alone. A real assessment of your agent's tools and permissions will differ.
Talk to us about testing your agent →Which controls cut most of the agentic AI risk?
The controls that cut most agentic AI risk limit what a fooled agent can do: least-privilege tools, short-lived scoped credentials, human approval for high-impact actions, sandboxed code, clean and separated memory, signed and allowlisted tools and MCP servers, and complete logs. Together they apply OWASP's least agency principle.
- Least-privilege tools. One narrow tool per job. Read-only by default. No generic "run any SQL" or "send any email" tools. (ASI02)
- Scoped, short-lived identity. Each task gets its own token that expires. The agent acts with the user's rights, not a super account. (ASI03)
- Human approval gates that mean something. Require approval for payments, deletes, external sends and permission changes, and show the raw action, not just the agent's summary. (ASI09)
- Sandboxing. Generated code runs in an isolated container, not as root, with limited files and network. (ASI05)
- Memory hygiene. Scan what gets stored, separate users and tasks, and expire old memory. (ASI06)
- Signed tools and MCP allowlists. Only approved, pinned servers and plugins; alert when a tool description changes. (ASI04)
- Authenticated agent messaging and circuit breakers. Sign messages between agents and let a policy engine stop runaway chains. (ASI07, ASI08)
- Full, tamper-proof logging. Record every prompt, tool call and message, and alert on behaviour that drifts from the task. (ASI10)
Start with the blast radius. You cannot fully stop prompt injection today. You can decide what a hijacked agent is able to reach. Cutting tool scope and credentials is usually the fastest, cheapest risk reduction.
Controls also need to be checked again and again. Agents change every time someone edits a prompt, swaps a model or adds a tool. A test done once a year leaves most of that change untested, the same problem we describe in the 363-day blind spot of annual pentests. A continuous threat exposure management (CTEM) programme gives agents a regular place in the testing cycle.
Frequently asked questions
What are the ten risks in the OWASP Top 10 for Agentic Applications?
The ten risks are ASI01 Agent Goal Hijack, ASI02 Tool Misuse and Exploitation, ASI03 Identity and Privilege Abuse, ASI04 Agentic Supply Chain Vulnerabilities, ASI05 Unexpected Code Execution, ASI06 Memory and Context Poisoning, ASI07 Insecure Inter-Agent Communication, ASI08 Cascading Failures, ASI09 Human-Agent Trust Exploitation and ASI10 Rogue Agents. Each entry comes with examples, attack scenarios and mitigations.
When was the OWASP Top 10 for Agentic Applications released?
The OWASP GenAI Security Project published the OWASP Top 10 for Agentic Applications for 2026 on 9 December 2025. It was built with input from more than 100 industry experts. The list carries the 2026 label because it is meant to guide the year when many firms move agents from pilots into production.
Is agent goal hijack the same as prompt injection?
Not quite. Prompt injection is the technique: text that the model treats as an instruction. Agent goal hijack (ASI01) is the result for an agent: its objective or plan changes, so it takes actions the owner never wanted. Injection is the most common route to a hijack, but poisoned tool outputs and poisoned data can also redirect an agent's goal.
Does the OWASP LLM Top 10 still apply if we build AI agents?
Yes. Every agent still runs on a language model, so the OWASP Top 10 for LLM Applications covers the model layer: prompt injection, data leaks, supply chain, poisoning and output handling. The agentic list adds what happens when that model can plan and act through tools, memory, credentials and other agents. Use the two lists together, not one instead of the other.
What is MCP tool poisoning?
MCP tool poisoning is an attack where a Model Context Protocol server hides instructions inside a tool's description. The user rarely sees that text, but the model reads it. Invariant Labs showed in April 2025 that a poisoned tool could make an agent in Cursor read SSH keys and config files, and that a server could change a description after approval, a trick called a rug pull.
Can automated tools test AI agents for these risks?
Partly. Automated tools are good at sending many injection payloads, replaying attacks after every release and checking known weak settings. They are weaker at judging business impact, such as whether a tool call moved money or leaked a customer file. Most teams pair automated runs on every change with deeper red teaming of the riskiest workflows.
How often should AI agents be security tested?
Test an agent before launch and again whenever its prompt, model, tools, memory or permissions change, because each of those changes its attack surface. For agents that read outside content or act without approval, add automated injection tests on every release. A yearly test alone is too slow for systems that can change every week.
Is the OWASP agentic Top 10 mandatory in India?
No. The OWASP agentic Top 10 is voluntary community guidance, not a law or a regulator's rule, but it is useful evidence of good practice. If an agent processes personal data, the Digital Personal Data Protection Act, 2023 requires reasonable security safeguards, and sector rules from RBI, SEBI or CERT-In may also apply to the systems it touches.
Test the systems your agents can reach, every day
An agent is only as dangerous as what it can touch. When an agent is hijacked, the attacker inherits its reach: the Active Directory accounts, cloud consoles, web apps, containers and credentials behind its tools. That is where real damage happens.
Arxiis is an autonomous AI red teaming platform. Its multi-agent crew attacks your environment the way an adversary would, so you learn what a compromised identity or tool could really do before someone else finds out.
- 26 security modules across 6 attack vectors: ransomware, Active Directory, cloud, web applications, containers and credentials.
- Multi-agent AI crew for OSINT, exploitation, lateral movement and reporting.
- CVSS-scored, MITRE ATT&CK-mapped findings with overlays for 11 frameworks, including OWASP Top 10, DPDP 2023, RBI and SEBI CSCRF.
- Fully on-premise: your data never leaves your environment. MIT-licensed open-source core.
- A pentest report in hours instead of weeks, so testing can keep pace with agents that change every sprint.
Your company gets defended every day.
Sources
- OWASP GenAI Security Project, "OWASP Top 10 for Agentic Applications for 2026" (resource page and PDF), 9 December 2025. genai.owasp.org
- OWASP GenAI Security Project, "OWASP Top 10 for Agentic Applications: The Benchmark for Agentic Security in the Age of Autonomous AI", 9 December 2025. genai.owasp.org
- OWASP GenAI Security Project, "OWASP Top 10 for LLM Applications 2025", 17 November 2024. genai.owasp.org
- OWASP GenAI Security Project, "OWASP GenAI LLM Top 10 2026", 3 August 2026. genai.owasp.org
- OWASP GenAI Security Project, "GenAI-LLM-Top10" repository (2026 edition entry list), August 2026. github.com
- Darktrace, "Over Three-Quarters of Security Professionals Concerned About AI Agent Risk, New Darktrace Report Finds" (State of AI Cybersecurity 2026), 3 February 2026. darktrace.com
- IBM X-Force, "AI-powered adversaries and the enterprise risk challenge: Preparing for the new reality" (Cost of a Data Breach 2026), 29 July 2026. ibm.com
- IBM Newsroom, "IBM Study: One in Four Malicious Breaches are AI-Enabled, Costing Companies $6 Million on Average", 29 July 2026. newsroom.ibm.com
- Gartner, "Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027", 25 June 2025. gartner.com
- Invariant Labs, "MCP Security Notification: Tool Poisoning Attacks", 1 April 2025. invariantlabs.ai
- OWASP MCP Top 10 project, "MCP03:2025 Tool Poisoning", 2025. owasp.org
- The Hacker News, "Zero-Click AI Vulnerability Exposes Microsoft 365 Copilot Data Without User Interaction" (CVE-2025-32711, EchoLeak), June 2025. thehackernews.com
- Amazon Web Services, "Security Update for Amazon Q Developer Extension for Visual Studio Code (Version #1.84)", AWS-2025-015, 23 July 2025. aws.amazon.com
