Security Attestation
The OWASP Top 10 for Agentic Applications (2026) defines the most critical security risks for AI agent systems. Here’s how VeriSwarm maps to each one. For the top two risks in depth, see how VeriSwarm approaches prompt injection detection and MCP tool poisoning.
Untrusted ingested content (documents, web pages, email, tool responses) redirects the agent's objectives while it believes it still serves the user — agentic prompt injection at the planning layer.
Agents invoke legitimate tools harmfully — bad parameters, unsafe tool chaining, forwarding unvalidated output to a more powerful API — or are steered by poisoned tool metadata.
Excessive, shared, long-lived, or inherited credentials enable credential reuse, privilege escalation, and agent impersonation.
Compromise via frameworks, model providers, tool integrations, MCP servers, or registries — package poisoning, MCP CVEs — some only discovered at runtime.
Natural language turns into running code or shell commands outside intended boundaries — the wall between instruction and execution collapses, enabling sandbox escape or RCE on host or downstream systems.
VeriSwarm restricts code-execution tool access and scans for command injection but does not sandbox agent runtime execution; deploy isolated/ephemeral execution runtimes for full ASI05 coverage.
Adversaries plant false or malicious information into session context, retrieval indexes, or persistent memory, shaping agent behavior across future sessions and users.
VeriSwarm verifies critical decisions and logs provenance but does not manage the agent's memory store; validate memory writes and audit persistent memory in your agent runtime.
Agent-to-agent messaging lacks authentication, integrity, or origin verification, enabling spoofing, tampering, replay, or fake-peer registration — one compromised agent pivots across the network.
One bad decision, hallucination, or compromise propagates through connected agents and workflows faster than humans can detect — one agent's output becomes another's trusted input.
The human is in the loop and does approve, but the agent manipulates them into it — fluent, confident summaries that hide the real underlying operation, or persuasion to extract credentials or data. Logs show valid human approval while what was displayed does not match what executed.
VeriSwarm provides AI-status and principal disclosure (Article 50 readiness), trust attribution, and deceptive-persona scanning; it does not control the agent's UI to enforce raw-operation-vs-summary display integrity.
The agent itself becomes an insider threat — loss of policy containment by an actor already inside the trust boundary, via design flaw, drift over time, or compromise. It quietly pursues unauthorized goals and may persist across sessions while surface activity looks normal.
The /v1/compliance/owasp-attestation endpoint returns a per-tenant report with your specific coverage status, evidence counts, and upgrade recommendations.