Agentic Security — Index

⭐ Star on GitHub

Summary: Wiki pages for raw/Agentic/ — the OWASP Agentic Security Initiative’s threat taxonomy (T1–T17), CSA’s MAESTRO layered framework, agent audit-trail implementation, and the measured context failure modes behind memory poisoning.

Sources: raw/Agentic/ (4 files, ~48,000 words)

Last updated: 2026-07-30

Pages

OWASP ASI

MAESTRO (CSA)

Operational and engineering

Threat pages

T4 (Resource Overload) has no dedicated page — it is covered in agentic-threat-taxonomy and Playbook 3. T8 (Repudiation & Untraceability) now has one in all but name: agent-observability-and-logging, which supplies the audit-trail implementation the ASI source only gestured at.

Version matters here

The ingested ASI source is v1.1, December 2025, with 17 threats. The widely-cited v1.0 (February 2025) had 15 — T16 Insecure Inter-Agent Protocol Abuse and T17 Supply Chain Compromise are v1.1 additions. Any external reference to “the OWASP agentic 15” predates this.

Five findings

1. Seven of seventeen agentic threats map to no OWASP Top 10 entry — T7, T8, T9, T10, T14, T15, T16. They are the accountability, human-boundary and inter-agent threats. This is the vault’s fifth independent confirmation of the agentic gap, and the first from OWASP’s own agentic work. See owasp-mapping. MAESTRO is not a sixth — Ken Huang authored it and contributes to the OWASP Top 10, so agreement between the two is not corroboration (maestro-asi-crosswalk).
2. LLM06 Excessive Agency splits into three separate agentic threats — T2, T3 and T13. One Top 10 entry is carrying the load of three, which is the sharpest available evidence that the Top 10’s granularity does not survive contact with agents.
3. Memory and tools are named as the two key attack vectors (p. 13), and the taxonomy bears it out — T1 and T2 appear as delivery mechanisms inside other threats’ scenarios more than any others.
4. Protocol-layer invocation bypasses the guardrails. MCP and A2A tool calls “may bypass user interfaces, consent flows, or direct human oversight” (p. 38), and a stolen persistent agent identity “bypasses the agent’s conversational interface and its guardrails” (p. 18). Every “require human approval” control in the document sits on the conversational path — see inter-agent-protocol-abuse and identity-and-privilege-threats.
5. Human oversight does not scale, and the document knows it. T10 is the threat, but the constraint recurs as the limiting factor for T5’s mitigations too. Risk-tiered triage moves the exposure rather than removing it — see human-in-the-loop-threats.

Three more findings from the 2026-07-30 sources

6. Nobody else in the corpus treats the defence as a target. MAESTRO’s Layer 6 assumes agents are used as security tooling and models attacks on them — evasion, poisoning their operational data, extracting the detection model to learn how to bypass it. This inverts a recommendation that recurs throughout the control catalogue: an AI-based control inherits the full threat model of the thing it protects.
7. Context poisoning happens with no attacker, and the agent defends it. DeepMind’s Gemini agent poisoned its own goals field with one misidentification and could not recover, because “the agent trusts its own context more than external corrections” (context-failure-modes). The baseline rate of T1-shaped incidents is not zero, so detection must key on provenance rather than on falsity — which is what agent-observability-and-logging is for, and why its omission of tool arguments matters.
8. Guardrail adherence degrades with context length. Past ~100k tokens, models pattern-match instead of reasoning and, at threshold, “ignore instructions entirely.” Context inflation is framed everywhere in this vault as a cost and availability problem (T4, LLM10); the measured effect is an integrity problem first. An attacker who can pad an agent’s history weakens its system prompt without touching it.

Where this collection is the best source

• MCP and A2A as attack surface — inter-agent-protocol-abuse is currently the vault’s only coverage, since raw/MCP-security/ was never populated. agent-observability-and-logging adds the implementation-level view.
• The confused deputy in agentic systems — identity-and-privilege-threats carries the corpus’s clearest statement.
• Multi-agent threat structure — multi-agent-threats, including infectious backdoors and orchestration hijacking, has no counterpart elsewhere in the vault.
• Agentic scoping — the six-step decision path in agentic-threat-taxonomy is the only tool here that prunes a threat list against a specific architecture.
• AI security tooling as attack surface — MAESTRO Layer 6, the vault’s only coverage.
• The agent marketplace — registry compromise, malicious agent discovery, marketplace and pricing manipulation (Layer 7). Nothing else in the vault covers agent distribution as distinct from artefact distribution.
• Conventional threat modelling against AI — threat-modeling-frameworks is the vault’s only systematic assessment of STRIDE, PASTA, LINDDUN, OCTAVE, Trike and VAST for agentic systems.
• Agent audit trails, concretely — agent-observability-and-logging is the vault’s only implementation-level detection source in any collection.
• Measured failure rates — context-failure-modes carries the only effect sizes in the corpus for context-based failure: 39% multi-turn degradation, 46→19 tool-count recovery, 100k-token distraction threshold.

Known gaps

• Two of the three ASI documents are still absent. Securing Agentic Applications Guide 1.0 and the Agentic AI Red Teaming Guide (with CSA) are not in raw/Agentic/; the second is the natural next ingest.
• MAESTRO has no risk matrix. Its own six-step method depends on one at step 4 and the source never supplies it, so its ~60 threats arrive unprioritised. The seven-layer architecture also has an external elaboration (Ken Huang, Medium) that is not held in raw/.
• MAESTRO predates the MCP/A2A threat framing (February 2025) and does not address the protocols at all.
• Every measurement in context-failure-modes is secondary. The Breunig taxonomy and the DeepMind, Databricks, Microsoft/Salesforce and Berkeley Function-Calling results are reported, not conducted; none of the primaries are in raw/. The 39% figure in particular should be traced before external citation.
• T4 lacks a dedicated page.
• ATLAS holds substantial agentic technique-level material (AML.T0080, AML.T0110, AML.T0083, AML.M0028, AML.M0032, AML.M0033, and the MCP exfiltration case studies) that is not yet cross-linked from the ATLAS side. AML.T0080 AI Agent Context Poisoning and AML.T0080.000 Memory are now doubly relevant given context-failure-modes.
• No detection content. agent-observability-and-logging builds the telemetry and stops; the alert logic on that page is this wiki’s inference, not sourced. A SIEM rule set for agent logs is the clearest missing artefact in this collection.

Related collections

• OWASP Top 10 for LLM Applications — the parent project and vocabulary
• MITRE ATLAS — technique-level agentic coverage and real case studies
• AI Attack Techniques — PITAX, including agentic and tool attacks
• Supply Chain Attacks — the fuller treatment T17 defers to
• Data Poisoning — the training-time cousin of T1