OWASP (Open Web Application Security Project) published the Top 10 for Agentic Applications in 2026, extending their established LLM Top 10 to autonomous AI agents — systems that can take actions, execute multi-step workflows, use tools, and operate with reduced human oversight. OWASP Top 10 lists are already widely adopted as baseline security requirements in software development, DevSecOps, and vendor contracts. Banks that require OWASP LLM Top 10 compliance in AI vendor contracts today will require OWASP Agentic Top 10 compliance within 12–18 months.
Indian banks deploying autonomous AI agents face a specific challenge that US or EU banks do not. HDFC Bank has five agentic use cases live with 14 in development. Kotak Mahindra Bank has 20–25 standalone agents in deployment. SBI has formalized a Know Your Agent (KYA) framework. For all of these, OWASP Agentic risks must be mapped to five frameworks simultaneously: RBI MRMF, RBI FREE-AI, CERT-In Blueprint, DPDP Act, and OWASP itself. US banks mapping OWASP to SR 26-2 face one framework. Indian banks face five.
OWASP Agentic AI Top 10: The List and India BFSI Manifestation
A01 — Prompt Injection in Agentic Context
Agents can be redirected mid-task by malicious content in their environment — unlike direct prompt injection against a chatbot, agentic prompt injection exploits the agent's ability to read external content and act on it. In BFSI: a customer service agent reading a customer message that contains an embedded malicious instruction, redirecting the agent to perform unauthorized transactions. RBI MRMF explicitly names prompt injection. CERT-In Blueprint mandates adversarial input testing throughout the full AI lifecycle.
A02 — Insecure Agent Communication
Agents calling other agents or tools without adequate authentication or integrity verification. In BFSI: a KYC agent communicating with a credit bureau API without proper identity verification, or an agent relay that can be impersonated by a man-in-the-middle. MRMF addresses multi-agent trust boundaries. RBI FREE-AI Pillar 5 (Privacy) covers unauthorized data transmission between agent components.
A03 — Excessive Agent Permissions
Agents granted capabilities beyond their task scope create an attack surface where a compromised or misbehaving agent can cause disproportionate harm. In BFSI: a customer inquiry agent with read/write access to core banking systems when it only requires read access. MRMF mandates authorization scope validation. SBI's Know Your Agent (KYA) framework specifically addresses this. SEBI Regulation 16C kill switch provisions reinforce the principle of minimum necessary capability.
A04 — Agent Memory Exploitation
Manipulation of agent memory — in-context, external vector store, or procedural memory — to alter agent behavior over time. In BFSI: corrupting a fraud detection agent's long-term memory to reduce its sensitivity to specific fraud patterns, creating a persistent blind spot. MRMF model performance monitoring requirements address behavioral drift but do not specifically name memory poisoning. CERT-In Blueprint mandates data poisoning testing throughout the full AI lifecycle. This is one of the weakest coverage areas in current India regulations.
A05 — Agent Supply Chain Attacks
Compromising the tools, APIs, plugins, or sub-agents an agent relies on to inject malicious behavior or exfiltrate data. In BFSI: a malicious plugin for a financial agent that exfiltrates transaction data, or a compromised third-party API the agent calls as part of a workflow. RBI FREE-AI Pillar 4 (Accountability) addresses third-party accountability. CERT-In Blueprint's AIBOM (AI Bill of Materials) requirement directly addresses this — banks must maintain a bill of materials for all AI components including orchestration frameworks, tools, and APIs.
A06 — Insufficient Agent Logging and Auditability
Agents that cannot produce a complete audit trail of their actions, reasoning steps, and decision points. In BFSI: an agent that executed a series of loan processing decisions but cannot reconstruct the reasoning chain for an examination — a direct examination failure. MRMF mandates audit trail requirements. RBI FREE-AI Pillar 4 (Accountability) requires explainability and logging. RBI IT Governance Master Direction 2023 creates enforceable logging obligations for AI-driven processes.
A07 — Insecure Credential and Secret Handling
Agents that expose or mishandle credentials needed to access banking systems — particularly when credentials are stored in the agent's context window where prompt injection can exfiltrate them. In BFSI: an agent storing core banking API keys in its context window, accessible via prompt injection and leaked to external services. CERT-In Blueprint mandates zero trust architecture for AI systems. CERT-In 6-hour incident reporting applies when credential compromise is confirmed. DPDP Act data processing obligations apply when personal financial data is exposed.
A08 — Lack of Human Oversight and Control
Insufficient mechanisms for humans to monitor, pause, or override agent actions — particularly for high-stakes decisions or when agents are operating in novel situations. In BFSI: a portfolio management agent executing trades without human review triggers, or a loan approval agent processing applications without escalation mechanisms for edge cases. SEBI's Regulation 16C kill switch requirement directly addresses this. MRMF's kill switch provision covers GenAI systems. RBI FREE-AI Pillar 3 (Human Oversight) mandates human control mechanisms. This is the strongest regulatory anchor in the India framework for OWASP A08.
A09 — Autonomous Agent Goal Misalignment
Agents optimizing for a proxy goal that diverges from intended behavior — particularly in agents with reinforcement learning components or reward shaping. In BFSI: a collections agent optimizing for contact rate rather than appropriate customer treatment, violating the RBI Fair Practices Code. A credit scoring agent optimizing for approval volume rather than credit quality. RBI FREE-AI Pillar 2 (Fairness) requires that AI must not produce discriminatory or harmful outcomes. This is another weak coverage area — India regulations address the outcome but not the mechanism of goal misalignment.
A10 — Cascading Failures in Multi-Agent Systems
Failures propagating through interconnected agent networks where one agent's error or compromise corrupts the inputs or state of downstream agents. In BFSI: a credit assessment agent failure cascading to downstream loan approval agents, creating systemic credit decision errors before human intervention. MRMF addresses multi-agent architecture governance. FSB 12 Sound Practices (2026) addresses AI concentration risk that creates cascading failure potential. This is the most architecturally complex risk and has the least detailed India regulatory coverage.
The India BFSI Five-Framework Crosswalk
The table below maps each OWASP Agentic risk to the specific India regulatory provision that addresses it. This is a first-principles crosswalk — where a risk has no direct regulatory anchor, that gap is noted explicitly.
| OWASP Risk | RBI MRMF | RBI FREE-AI | CERT-In Blueprint | DPDP Act | Other |
|---|---|---|---|---|---|
| A01 Prompt Injection | Named explicitly | Pillar 1 Safety | Adversarial testing mandate | — | — |
| A02 Insecure Communication | Multi-agent trust boundaries | Pillar 5 Privacy | Zero trust architecture | Data transfer provisions | — |
| A03 Excessive Permissions | Authorization scope validation | Pillar 4 Accountability | Zero trust architecture | Purpose limitation | SEBI Reg 16C; SBI KYA framework |
| A04 Memory Exploitation | Model performance monitoring | Pillar 1 Safety | Data poisoning testing | — | Gap: no explicit memory poisoning provision |
| A05 Supply Chain | Third-party AI scope | Pillar 4 Accountability | AIBOM requirement | — | IT Outsourcing Direction 2023 |
| A06 Insufficient Logging | Audit trail requirement | Pillar 4 Explainability | Forensic logging | — | RBI IT Governance Direction |
| A07 Credential Handling | — | Pillar 5 Privacy | Zero trust; 6h incident reporting | DPDP data processing | CERT-In breach reporting |
| A08 No Human Oversight | Kill switch provision | Pillar 3 Human Oversight | — | — | SEBI Reg 16C kill switch |
| A09 Goal Misalignment | Model performance monitoring | Pillar 2 Fairness | — | Non-discrimination | RBI Fair Practices Code |
| A10 Cascading Failures | Multi-agent architecture docs | Pillar 1 Safety | Isolation and containment | — | FSB concentration risk provisions |
OWASP Agentic risks A01 (prompt injection), A05 (supply chain), and A08 (human oversight) have the strongest India regulatory anchors — explicit MRMF provisions plus CERT-In Blueprint requirements. A04 (memory exploitation) and A09 (goal misalignment) are the weakest coverage areas. Indian banks must build governance beyond what current regulations require for these two risk categories.
The MRMF Agentic Gap — and How to Fill It
RBI MRMF (June 2026) is the most advanced banking AI governance framework globally. It explicitly covers hallucination, prompt injection, red-teaming, kill switch, foundation model documentation, and human escalation for generative AI. But agentic AI — autonomous agents, multi-agent orchestration, agent memory — is entirely absent from MRMF's explicit provisions.
The current coverage model for Indian banks is: OWASP Agentic Top 10 identifies the risks; MRMF GenAI provisions address A01 (prompt injection), A08 (kill switch and human oversight), and A06 (audit trail) partially; the remaining gaps — A02 through A05, A09, and A10 — must be filled by bank-developed agentic governance policies that extend MRMF's principles to the agentic context.
The BCBS AI work programme (September 2026) will likely address agentic AI governance explicitly. A future MRMF revision will incorporate it — probably in a 2027–2028 update cycle. Banks that build OWASP-aligned agentic governance now will face minimal gap when the formal framework arrives. Banks that wait for the formal framework to define requirements will be starting from zero when the examination bar is already set.
SR 26-2 (US Federal Reserve, April 2026) explicitly defers agentic AI governance to future guidance — it is not a useful reference for Indian banks on this topic. FSB 12 Sound Practices (2026) does address agentic safeguards and is more useful than SR 26-2 for building an agentic governance framework today.
What to Build: India BFSI Agentic AI Control Framework
Based on OWASP Agentic Top 10 crosswalked to India regulations, five priority controls are the foundation of an India BFSI agentic governance program:
1. Know Your Agent (KYA) — Identity, Scope, and Authorization
Addresses A02, A03, and A08. Implement a Know Your Agent registry — document every deployed agent's identity, permitted tools, authorization limits, escalation triggers, and human oversight requirements. SBI's KYA framework is the most advanced public example in India banking. MRMF's model documentation requirements extend naturally to agent documentation. Every agent in production should have a KYA record before going live.
2. AIBOM for All Agent Deployments
Addresses A05. Maintain an AI Bill of Materials for every agentic deployment covering: foundation model (provider, version, license), orchestration framework (LangChain, AutoGen, CrewAI version), tools and plugins (name, version, publisher, purpose), external APIs called (endpoint, authentication method, data shared), and sub-agents (identity, scope, trust level). CERT-In Blueprint makes AIBOM a compliance requirement. Extending AIBOM to cover the full agentic supply chain is the most critical gap Indian banks must close in 2026.
3. Multi-Step Audit Trail
Addresses A06. Every agent action must produce a log entry sufficient for reconstruction — not just input and output, but reasoning steps, tool calls made, decision branch points, and escalation events. Standard API call logs are insufficient for agentic audit trails. Required for MRMF audit trail compliance, CERT-In Blueprint forensic logging, and RBI IT Governance Direction. The standard for a regulatorily adequate agentic audit trail: any supervisory data request about an agent's decision must be answerable from the log without requiring access to the agent itself.
4. Prompt Injection and Memory Isolation Testing
Addresses A01 and A04. Include agentic adversarial testing in MRMF red-teaming programs — specifically: prompt injection testing at every agent entry point (tool outputs, API responses, user inputs), memory poisoning testing for long-running agents with external memory, and cross-agent injection testing in multi-agent workflows. These are directly required by MRMF red-teaming provisions and CERT-In Blueprint's adversarial testing mandate. OWASP A04 (memory exploitation) has the weakest regulatory coverage in India; bank-developed testing programs must fill this gap.
5. Cascading Failure Circuit Breakers
Addresses A10. Implement inter-agent isolation in multi-agent workflows: if one agent in a pipeline fails, produces an anomalous output, or enters an error state, subsequent agents must be paused pending human review rather than proceeding on potentially corrupted state. Automated circuit breakers that halt multi-agent workflows on anomaly detection align with MRMF's kill switch provisions, FREE-AI Pillar 1 (Safety), and FSB concentration risk guidance. This is architecturally the most complex control to implement but the most consequential for systemic risk in India's large-scale banking AI deployments.
Frequently Asked Questions
More agentic AI governance guides
RBI MRMF: GenAI Provisions and the Agentic Gap
Six GenAI provisions in MRMF, what they require, and why agentic AI governance must be built beyond the current framework.
Read →CERT-In AI Cybersecurity Blueprint for Banks
AIBOM requirements, adversarial testing mandate, zero trust for AI systems, and 6-hour incident reporting for Indian banks.
Read →Agentic AI Governance for India BFSI
Multi-agent architecture governance, KYA frameworks, and the five controls India banks must build for autonomous AI deployments.
Read →OWASP LLM Top 10 for Banking
How the OWASP LLM Top 10 maps to India banking regulations and what secure LLM deployment requires in BFSI.
Read →Ready to assess your agentic AI security posture against OWASP and India regulations?
Zytra's India compliance team will map your agentic deployments to OWASP Agentic Top 10, MRMF, FREE-AI, and CERT-In Blueprint — and identify your highest-priority gaps before the examination bar rises.