The OWASP Top 10 for LLM Applications was written for a world where a user sends a prompt and reads the response. When the model starts taking actions — reading your filesystem, writing Python, calling external APIs without a human in the loop — those same risks don't disappear. They compound. Each autonomous action is a new attack surface, and the code the agent produces is a persistent artifact that outlives the session.
There is no published separate OWASP "Agentic AI Top 10" yet. What exists is the standard LLM Top 10 applied with discipline to agentic systems. Python developers building with Claude Code, Cursor, or autonomous coding pipelines need to know which of those ten risks land hardest when the AI writes their code, not just responds to their questions.
What Agentic Risks Add to the Standard LLM Top 10
The OWASP LLM Top 10 covers risks in applications that call AI models — but agentic systems, where the AI takes autonomous actions (running code, calling tools, modifying files), introduce a second category: the risk of the agent itself being weaponized or exceeding its intended scope. BrassCoders addresses the code-layer manifestations: the unsafe subprocess calls, SQL injection, and credential leaks in the Python files an agent produces.
The OWASP Top 10 for LLM Applications lists "Excessive Agency" as LLM08 — the risk that an AI model holds more permissions than the task requires and takes actions the operator didn't anticipate. In an agentic coding context, this surfaces as generated code that assumes elevated access, writes to system directories, or spawns child processes with shell=True. Bandit flags those subprocess patterns as B602 and B603. The risk isn't exotic; it's a direct consequence of agents reaching for the most permissive tool when the task is underspecified.
The second amplification is scope. A chatbot's failure mode is a bad answer. An autonomous agent's failure mode is a committed diff with a backdoor, a hardcoded API key passing through CI, or a phantom import that doesn't exist in any real package. The failure mode persists in version control.
The Five Agentic Risks Most Relevant to Python Developers
BrassCoders addresses the code-layer manifestations of agentic risk: insecure tool invocations (shell=True subprocess calls the agent triggers), credential exposure in agent-generated code, and prompt injection artifacts in the Python files an autonomous agent produces.
The first is prompt injection in source. The agent reads a comment, docstring, or user-supplied string that redirects its next action. Python developers building pipelines or chatbots are particularly exposed because user text flows directly into function calls — and the agent executes the result.
The second shows up in generated subprocess calls. Claude Code and Cursor both write subprocess.run(). When the task is ambiguous, agents reach for shell=True. Bandit flags this as B602 and B603; BrassCoders surfaces both in the YAML output your AI assistant reads in the next review cycle.
Third: credential exposure. Agents generate configuration files and initialization code. They hallucinate environment variable names, then substitute string literals as fallbacks. The result is a live secret committed as a default value. BrassCoders scans for 20+ secret formats — AWS access keys, GitHub PATs, OpenAI keys, Stripe live keys — using Yelp's detect-secrets as the upstream library plus custom patterns added at the scanner layer.
Fourth is phantom imports and supply chain exposure. AI models confidently import libraries that don't exist, or that share names with known packages under different namespaces. A phantom import is a vector for dependency confusion attacks. BrassCoders's AI-pattern scanner specifically targets phantom-API usage in generated Python code.
Fifth: SQL injection in generated queries. Agents write database interaction code by pattern-matching on context. They produce f-strings directly in query positions. Pysa, the Meta-built taint analysis engine BrassCoders runs, traces data flow from user input through to the query call.
Building a Checklist Your Python Team Can Actually Follow
A practical agentic security checklist for Python shops has three tiers: scan the code the agent produces (BrassCoders covers this tier), audit the tools the agent has access to (principle of least privilege), and log every autonomous action the agent takes in CI.
Tier one is a single CI step: add brasscoders scan . to your workflow. That runs all 12 scanners — Bandit, Pylint, Pyre/Pysa, Semgrep, ast-grep, detect-secrets, and the six custom detectors — and emits findings as YAML. No extra configuration. Five minutes to wire up.
Tier two is access control. The NIST AI Risk Management Framework calls this "govern" — defining which data and actions an AI system can touch. For a Python agent, that means tool definitions with explicit scope, no filesystem write access outside the project directory, and no outbound HTTP from agent-generated code in test environments.
Tier three is logging. When the agent runs autonomously in CI — not interactively in your editor — every tool invocation should write to a structured log. This isn't exotic security engineering; it's the same audit trail you'd add to any automated process with external side effects.
None of these tiers replaces the others. Security at the code layer doesn't catch a misconfigured tool permission. Least-privilege access control doesn't catch a committed secret. Logging doesn't catch SQL injection. All three run in parallel.
What BrassCoders Covers in the Agentic Risk Surface
BrassCoders runs after the agent produces code — it catches the security artifacts an AI coding agent leaves behind: hardcoded credentials, SQL injection in generated queries, unsafe subprocess calls, and phantom imports in agent-generated Python.
The benchmark tells the story directly. In a published test of 12 AI-generated security bugs across representative Python code, Bandit alone caught 6 of 12. BrassCoders caught 11 of 12. The delta comes from the custom scanners — the AI-pattern detector, the privacy/PII scanner, and taint analysis from Pyre/Pysa — layers Bandit doesn't have. For agentic code specifically, the AI-pattern scanner and the secret-pattern scanner carry the most weight, because agents produce hallucinated API calls and fallback credentials at rates human developers don't.
The OSS core is free. Apache 2.0-licensed, no account required, zero outbound network calls. Install it with pip install brasscoders and run brasscoders scan . against any Python project. BrassCoders Paid adds an embedding-based enrichment pass through a hosted gateway that ranks and deduplicates raw findings. The Paid plan runs $12/dev/month; the gateway sends already-redacted findings and a project signature of at most 7,500 characters — never raw source code.
Agentic AI didn't change what good code looks like. It changed how fast bad code accumulates.
Top comments (0)