Agentic Security — Operation Log

⭐ Star on GitHub

Append-only. Newest entries at the bottom.

---

2026-07-29 — Collection created; ASI v1.1 ingested

Request: confirm whether OWASP covers agentic security, then ingest the source into the wiki.

Source acquisition — two failed attempts before the working one:

1. Direct fetch from genai.owasp.org returned HTTP 429 on the download endpoint (/download/45674/), with and without browser headers. The resource pages are JS-rendered and expose no direct PDF link.
2. A markdown file, Agentic-AI-Threats-and-Mitigations-1.1.md, was added to raw/Agentic/ but proved to be a failed extraction — 7 KB / 576 words for a 50-page document, containing only garbled OCR alt-text from diagrams, ~250 lines of single-character icon noise, the acknowledgements page and the sponsor logos. Zero body text. The converter had captured the image layer and the final page only. Not ingested.
3. The PDF was then added (2.4 MB) and extracted with pdftotext -layout → 14,767 words. Complete and clean.

Source decision: the PDF in raw/Agentic/ is the immutable source of record. Extracted text was written to the session scratchpad, not to raw/, per the rule that raw/ is never modified. Anyone re-running this ingest should re-extract rather than expect a text file to be present.

Folder naming: raw/Agentic-security/ and raw/MCP-security/ were created empty, then renamed/removed by the curator before sources landed. The collection follows the surviving folder, raw/Agentic/ → wiki/agentic-wiki/. raw/MCP-security/ no longer exists; MCP coverage therefore lives in this collection at inter-agent-protocol-abuse.

Version correction: an earlier answer in this session described the taxonomy as T1–T15, February 2025. The ingested document is v1.1, December 2025, with 17 threats — T16 (Insecure Inter-Agent Protocol Abuse) and T17 (Supply Chain Compromise) are v1.1 additions. The 15-threat figure refers to the superseded v1.0.

Pages created (15):

Page	Type
index.md	Collection index
log.md	This log
agentic-ai-threats-and-mitigations.md	Source summary
agentic-threat-taxonomy.md	Concept — T1–T17 master table, decision path
agentic-reference-architecture.md	Concept — components, nine patterns
agentic-mitigation-playbooks.md	Concept — six playbooks, implementability sort
owasp-mapping.md	Crosswalk — LLM Top 10, both directions
memory-poisoning.md	Threat — T1
tool-misuse.md	Threat — T2, T11
identity-and-privilege-threats.md	Threat — T3, T9
cascading-hallucination.md	Threat — T5
intent-breaking-and-deception.md	Threat — T6, T7
human-in-the-loop-threats.md	Threat — T10, T15
multi-agent-threats.md	Threat — T12, T13, T14
inter-agent-protocol-abuse.md	Threat — T16
agentic-supply-chain.md	Threat — T17

T4 (Resource Overload) and T8 (Repudiation & Untraceability) were deliberately not given their own pages — both are adequately covered in the taxonomy table and their playbooks, and neither is agentically distinctive enough to sustain one.

Root index: entry added to wiki/index.md, plus a new cross-collection anchor and a row in the taxonomy-comparison table.

Contradictions and defects recorded in the source (all flagged on-page):

1. The introduction promises “threat models for four example scenarios” (p. 3); only three are delivered (pp. 43–49).
2. The playbook overview table (p. 34) assigns T16 to playbooks 3 and 4; neither playbook header lists it (pp. 37, 39).
3. Playbook 6 is labelled “Step 5: Multi-Agent System Threats” though the navigator places multi-agent threats at step 6.
4. A callout on p. 14 states supply chain is not a distinct agentic threat because LLM03 covers it — while T17 exists on p. 19. The callout survives from v1.0 and was not updated.
5. Playbook 2 lists the “continuously analyze memory access patterns” control twice (p. 36).
6. Threat name drift: “Supply Chain Compromise” in the T-table, “Supply Chain Attacks” in the navigator.
7. T7 Scenario 4 (the military drone simulation) is hedged as “reportedly” in the source; the underlying anecdote was publicly retracted. Flagged on intent-breaking-and-deception as not citable.

Not ingested / open gaps:

• Securing Agentic Applications Guide 1.0 (July 2025) and the Agentic AI Red Teaming Guide (with CSA) — the other two ASI documents, still absent from raw/Agentic/.
• MAESTRO (CSA) — named and characterised in this source, but no primary source held.
• ATLAS-side cross-links are one-directional: this collection links out to mitre-atlas-wiki, but the ATLAS pages do not yet link back, despite holding substantial agentic material (AML.T0080, AML.T0110, AML.T0083, AML.M0028, AML.M0032, AML.M0033, AML.CS0045, AML.CS0054).

---

2026-07-30 — Three sources ingested: MAESTRO, MCP logging, context failure modes

Request: “i had added some new sources to the raw folder add and ingest.”

Sources found by mtime against the previous session’s cutoff (no git history exists in this repo yet — it has no commits — so file mtime was the only available signal):

File	Added	Words	Ingested
Agentic AI Threat Modeling Framework_ MAESTRO.md	11:33	5,218	Yes — 4 pages
Mastering Multi-Agent Systems eBook.pdf	11:42	26,521	Partially — ch. 4 only, by curator decision
Security Monitoring for AI Agents and MCP.md	11:44	2,900	Yes — 1 page
../Laws/Legal AI Audit Trails_ Designing for Traceability.md	11:52	46	No — defective source, see below

Two curator decisions taken before writing (per the ingest workflow’s discuss-first step):

1. The Galileo ebook is ~90% reliability engineering. Chose security slice only — source summary plus one concept page — over full ingest. Chapters 1–3 and 5 (coordination costs, four architectures, the LangGraph/ConnectTel walkthrough, Galileo-platform observability) are deliberately not paged. They remain in raw/ if a future question needs them.
2. MAESTRO’s seven layers and the ASI component model are competing decompositions. Chose a dedicated crosswalk page over folding the divergence into existing pages, following the atlas-and-pitax / owasp-mapping precedent.

PDF extraction: pdftotext -layout on the 30 MB ebook → 26,521 words, clean. Written to the session scratchpad, not to raw/. Figures 4.2–4.5 (the failure-mode cascade diagrams) are lost in extraction; the prose is self-contained without them.

Base64 image in the MAESTRO clipping: line 137 is a single 126,964-character base64 data URI — Figure 1, the seven-layer mindmap. It made the 5,218-word file read as ~133,000 tokens. Stripped to a placeholder in a scratchpad copy before reading (awk 'length($0)>2000'). The layer names and descriptions are recoverable from body text; the mindmap’s internal structure is not. Anyone re-ingesting a web clipping should check for long lines first — word count is not a reliable proxy for read cost.

Pages created (7):

Page	Type
maestro-framework.md	Source summary — MAESTRO
maestro-seven-layers.md	Concept — the 7 layers, ~60 threats, mitigations
threat-modeling-frameworks.md	Concept — STRIDE/PASTA/LINDDUN/OCTAVE/Trike/VAST vs agentic AI
maestro-asi-crosswalk.md	Crosswalk — MAESTRO ↔ ASI, both directions, patterns table
agent-observability-and-logging.md	Source summary + concept — the T8 implementation
mastering-multi-agent-systems.md	Source summary — Galileo ebook
context-failure-modes.md	Concept — poisoning, distraction, confusion, clash

Pages updated (7): index.md (restructured into three page groups; three new findings; gaps rewritten), agentic-reference-architecture.md (MAESTRO as competing decomposition; patterns comparison), agentic-threat-taxonomy.md (T8 now links to its implementation page; STRIDE-R note), memory-poisoning.md (the accidental twin, with the provenance-not-falsity consequence), tool-misuse.md (tool-count degradation), inter-agent-protocol-abuse.md (MCP logging), plus the root wiki/index.md.

T8 now effectively has a page. It was deliberately left without one on 2026-07-29 because the ASI source described repudiation too abstractly. agent-observability-and-logging.md closes that: a 14-field schema, correlation IDs spanning agent and tool actions, and a code path. T4 remains the only threat with no page.

MAESTRO gap closed. The 2026-07-29 entry listed MAESTRO as “named and characterised in this source, but no primary source held.” The primary is now held.

Findings worth carrying forward:

1. MAESTRO is not an independent confirmation of the ASI taxonomy. Ken Huang authored MAESTRO and is a core contributor to the OWASP Top 10. The root index counts independent confirmations of the agentic gap; MAESTRO does not add one. Recorded on maestro-asi-crosswalk.md and caveated in finding 1 of the collection index.
2. MAESTRO Layer 6 is the corpus’s only treatment of AI security tooling as attack surface. It inverts control-catalogue recommendations that propose AI-based detection without noting the control inherits its target’s threat model.
3. MAESTRO Layer 7 is the corpus’s only treatment of the agent marketplace — registry compromise, malicious discovery, ratings and pricing manipulation. Distinct from artefact/model-hub distribution, which the supply-chain collection covers.
4. Context poisoning occurs without an adversary, and the agent defends the corruption. “The agent trusts its own context more than external corrections.” Consequence for detection: key on provenance, not falsity.
5. Context length degrades instruction adherence (>100k tokens; at threshold, models “ignore instructions entirely” — Databricks). The vault framed context inflation as cost/availability throughout; it is an integrity problem first.
6. Tool sprawl is quantified: 46 tools fail where 19 succeed, independent of window space. Least privilege on toolsets now has a reliability argument behind it.

Defects recorded in the new sources (all flagged on-page):

1. MAESTRO’s method references “the risk measurement and risk matrix” at step 4; no risk matrix appears anywhere in the document. The step that makes ~60 threats actionable is missing.
2. MAESTRO principle 1 says “For example:” and supplies no example. The promised extension of STRIDE/PASTA/LINDDUN categories is never delivered.
3. MAESTRO’s acronym is expanded two ways in one document (“Threat Risk” vs “Threat, Risk”).
4. MAESTRO’s per-layer threat lists have inconsistent indentation in all seven layers — a converter artefact that makes the first threat read as parent of the rest. It is not.
5. MAESTRO assigns no mitigation to any individual threat; ~14 controls are stated at framework level for ~60 threats.
6. MAESTRO’s “formal verification of goal alignment” is stated in one clause with no method or tractability caveat. Not a citable control.
7. The Realm post calls its audit trail “immutable”; nothing in the code signs, chains or write-protects the logs. The schema also omits tool arguments, prompts and model reasoning — the fields an injection payload would appear in.
8. The Realm code requires FastMCP ≥ 2.11.0 (the author’s own PR #1326). On 2.10.6, server-side client logs are message-only and the schema cannot be populated from the server.
9. Every quantitative result in the Galileo ebook is secondary; none of the primaries are in raw/.
10. The MAESTRO clipping’s published frontmatter is empty — the date (2025-02-06) comes from the body line and the source URL.

Defective source, not ingested: raw/Laws/Legal AI Audit Trails_ Designing for Traceability.md (law.co, Samuel Edwards, published 2026-05-18) is a failed clipping: 46 words total, of which the body is two words — AI law. The frontmatter description promises coverage of designing AI audit trails for legal traceability, which would have paired directly with agent-observability-and-logging.md and with the AI Act’s logging duties. Worth re-clipping — this is the one genuine content loss of the session. Recorded in the root index’s “Not ingested” section. Same failure class as the ASI markdown extraction on 2026-07-29 and the Clippings/ IBM stub.

Open gaps after this ingest: see the collection index. The sharpest are MAESTRO’s absent risk matrix, the untraced primaries behind the ebook’s numbers, and the absence of any detection content (SIEM rules) to sit on top of the log schema.