The OWASP Top 10 for Agentic Applications (2026), published in December 2025, is the field's first shared map of the agentic threat surface. Almost every attack scenario it describes assumes the agent interacts with the world through structured calls to APIs, function calls, MCP servers, RAG retrievers, and code interpreters. Indeed, the agent reasons, calls a tool, and receives a structured response.
A different class of agent is now in production. Vision-and-action agents (also called Computer-Using Agents) reach the world by looking at a rendered screen and operating the same interface a human would. Anthropic shipped Claude for Chrome and Claude Cowork to consumers between 2025 and early 2026. OpenAI's Atlas browser with Agent Mode shipped in late 2025, built on its Computer-Using Agent technology. The open-source browser-use project surpassed 50,000 GitHub stars in roughly a year. Those systems work through pixels, clicks, and keystrokes inside the user's authenticated browser session. They operate in the rendered browser and do not use any API. They intersect directly with classical web security concerns: Same-origin assumptions, session handling, and UI redress attacks like clickjacking, but with a new actor inside the trust boundary
The ten ASI categories remain valid descriptions of the agentic threat surface. The assumptions underlying their attack scenarios, however, do not extend cleanly to vision-and-action systems. Agent Goal Hijack (ASI01) extends beyond poisoned documents to any content rendered on the pages the agent visits, including elements not visible to the human user.
Tool Misuse and Exploitation (ASI02) shifts from unintended API calls to unintended clicks and form submissions inside the user's authenticated session, where no tool-permission layer exists to constrain them.
Identity and Privilege Abuse (ASI03) changes in character when the agent holds the human's active session and acts indistinguishably from the human to every downstream system.
Human-Agent Trust Exploitation (ASI09) introduces a new failure mode in the mid-session handoff between human and agent operating inside the same browser, where attribution of individual actions becomes ambiguous.
This talk presents an adaptation of the ASI Top 10 for this subclass. Each of the ten categories is mapped to its vision-and-action equivalent, with concrete failure modes drawn from publicly documented systems and the published research on indirect prompt injection against agentic browsers.
This talk introduces a threat-modeling worksheet that practitioners can apply at design time to any product team shipping or evaluating a browser-driving agent. The presentation will give the AppSec community a way to threat-model the subclass of agent that is now reaching the buyer, the user, and the support queue inside the products our organizations are already shipping.