OWASP Agentic AI Top 10

Attackers manipulate agent behavior through crafted prompts that override system instructions.

• DeBERTa ML classifier for semantic injection detection
• Structural analysis (delimiter collisions, encoding smuggling)
• Guard Proxy runtime interception on all MCP tool calls
• SOUL security scanning on agent templates

Agents invoke tools in unintended ways or use tools with hidden malicious instructions.

• Guard Proxy transparent MCP interception
• Tool permission allowlists and denylists
• PII tokenization on every tool call (Presidio NER)
• Schema validation on tool inputs/outputs

Agents operate with more authority than required, enabling privilege escalation.

• 4-axis trust scoring (identity, risk, reliability, autonomy)
• Policy tier enforcement (tier_x through tier_3)
• Passport delegations with scoped permissions
• Kill switch for immediate agent disable

Compromised or malicious third-party components are introduced into agent workflows.

• SOUL security scanning (injection, bypass, content moderation)
• Agent template marketplace with tenant isolation
• Guard Proxy schema validation on tool definitions

Sensitive data (PII, credentials, system prompts) leaks through agent inputs or outputs.

• PII tokenization via Presidio NER (Guard)
• Field masking in transformation pipeline
• Credential pattern detection (API keys, bearer tokens)
• Prompt compression strips sensitive context

Adversaries corrupt agent memory or context to influence future decisions.

• Cross-model verification (route through multiple LLMs)
• Majority consensus voting with configurable threshold
• Vault-logged verification results for audit trail
• Per-request or per-tenant verification model configuration

Agent-to-agent messages are intercepted, spoofed, or tampered with.

• A2A trust-ranked agent catalog
• Agent cards with x-veriswarm-trust extension
• Portable ES256 JWT credentials with 1-hour TTL
• JWKS endpoint for public key verification

Errors in one agent propagate through multi-agent systems causing widespread failures.

• Kill switch for immediate agent disable
• LLM fallback chains with provider health tracking
• Cortex Workflows DAG execution with budget enforcement
• Circuit-based workflow error handling

Agents make high-stakes decisions without human review or escalation paths.

• human_review workflow step type
• Human escalation service with configurable triggers
• Approval gates in workflow DAGs
• Audit trail of all human decisions in Vault

Agent actions are not recorded, making incident response and forensics impossible.

• Hash-chained immutable audit ledger (Vault)
• Chain verification for tamper detection
• Audit exports (JSON, CSV)
• Guard scan finding records with severity tracking