OWASP's 2025 Agentic AI Top 10 Highlights Safety Gaps Teams Keep Missing

·1 views

Unlike chatbots, AI agents can execute actions—sending emails, modifying files, or calling APIs—before any human reviews their output, making agent safety a distinct discipline from standard application security. OWASP recognized this in December 2025 by releasing a dedicated Top 10 list for agentic applications rather than appending risks to its existing LLM guidelines. A common failure pattern sees agents accumulate permissions incrementally across development sprints, with no formal re-review, until a document summarizer quietly holds filesystem and network write access that no one explicitly authorized. Prompt injection remains the top-ranked risk, and in agentic contexts it is especially dangerous when malicious instructions are embedded in content the agent is directed to read—such as web pages, PDFs, or database records—blurring the line between data and commands. Recommended mitigations include starting every agent at zero permissions, scoping tools narrowly, requiring human approval for high-impact actions, validating messages between agents in pipelines, and monitoring the distribution of agent decisions rather than just outright errors.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Lucide, Tabler, and Phosphor: A Data-Driven Comparison of Free Icon Libraries

Lucide, Tabler Icons, and Phosphor are three widely used open-source icon libraries, each with distinct design philosophies and coverage. Lucide and Tabler both use a 24x24 stroke-based grid with 1,778 and 6,143 icons respectively, while Phosphor uses filled paths on a 256x256 grid and offers 9,161 icons across six weight variants. When measured by unique icon concepts rather than total count, Tabler leads in distinct coverage, and Phosphor's tally is inflated by its six-weight system. All three libraries are permissively licensed — Tabler and Phosphor under MIT, Lucide under the functionally similar ISC — with no attribution required for commercial use. Designers are advised to audit coverage for niche-domain needs before committing to a library, as breadth varies significantly across specialized categories.

0 comments Read more at DEV Community

ProgrammingHacker News ·

Engineer Documents 14-Step Ordeal to Unlock Office Door After Phone Upgrade

A software professional has published a detailed account of the complex process required to regain access to their office door after switching to a new phone. The friction stems from the layered authentication and app-based access control systems now common in modern workplaces. The writer outlines 14 distinct steps needed to re-enroll the new device and restore door-opening functionality. The post highlights growing frustration with over-engineered smart access systems that complicate simple everyday tasks. It has sparked discussion online about the trade-offs between security convenience and usability in workplace technology.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

One Developer's Account of Being Stretched Across Three Roles as AI Replaced Teammates

A software developer recently shared how their employer consolidated frontend, backend, and QA responsibilities into a single role after AI tools were introduced to fill the gap left by departing teammates. The title and pay remained unchanged, while the scope expanded dramatically across disciplines the developer had little prior experience in. Although AI proved effective at handling syntax errors and generating boilerplate quickly, it failed to provide the contextual judgment needed to evaluate whether solutions were appropriate for a specific codebase. The developer shipped two tests in their first month that passed but tested nothing meaningful, only discovering the flaw after a colleague flagged it in code review. The key takeaway was that AI closes the syntax gap almost instantly but does nothing to replace the hard-won experience required to distinguish working code from genuinely correct code.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Three Ways to Use SVG Icons in React and Next.js With Tailwind CSS

Developers working with React, Next.js, and Tailwind CSS have three main options for integrating SVG icons: inline components, SVGR file imports, or sprite references, with inline being the most common choice. Converting an SVG to a React component requires adjusting attribute casing, such as changing stroke-width to strokeWidth and class to className. In Next.js App Router, inline icon components work as React Server Components by default, rendering static markup server-side and adding nothing to the client bundle. Tailwind CSS styling is straightforward since most icon sets use currentColor, allowing size and color to be controlled via utility classes like h-*, w-*, and text-*. Accessibility best practices recommend hiding decorative icons with aria-hidden, while standalone icon-only buttons require an accessible name on the interactive element itself.

0 comments Read more at DEV Community