OWASP Top 10 for Agentic Applications (Agentic AI Threats & Mitigations)

OWASP Top 10 for Agentic Applications (Agentic AI Threats & Mitigations) — 41% of in-scope requirements covered.

8 requirements · 8 in scope (5 designed · 3 advisory). The 41% is weighted over the in-scope base.

OWASP Top 10 for Agentic Applications (Agentic AI Threats & Mitigations): requirement → the KYE™ artefact that enforces it

Demo data

You learn: Which requirements KYE™ enforces at runtime and with which artefact. You can: Walk the requirements.

  1. t3-privilege-compromise · designed

    T3 Privilege Compromise — agent escalates or inherits excess authority

    Constitution: 12 purpose permission

  2. t9-identity-spoofing · designed

    T9 Identity Spoofing & Impersonation — agent identity is not first-class

    Constitution: 52 delegated agent binding

  3. t7-misaligned-deceptive · designed

    T7 Misaligned & Deceptive Behaviours — contestable, reviewable outcomes

    Constitution: 21 delegated auditability

  4. t1-memory-poisoning · designed

    T1 Memory Poisoning — agent memory used as authority-bearing state

    Constitution: 63 memory authority rail

  5. t10-hitl-overwhelm · designed

    T10 Overwhelming Human-in-the-Loop — approval fatigue defeats oversight

    Constitution: 36 governedui

  6. t2-tool-misuse · advisory

    T2 Tool Misuse — agent invokes a tool outside its authorised scope

    Constitution: 12 purpose permission, 52 delegated agent binding · Audit events: kye.evidence.decision_map.v1

How this widget is built
Demonstrates
KYE™ Compliance Mapping Rail™
Components
  • Framework requirement (clause)
  • Coverage status
  • KYE™ enforcement artefact (event, decision-record field, Evidence Pack™ entry)
Flow
Clause → status → the KYE™ artefact that enforces it, enforced requirements first. Architecture diagram
Used on

Source: OWASP Gen-AI Security Project — Agentic AI Threats & Mitigations / Top 10 for Agentic Applications (2025), as crosswalked by AIUC-1. The threat classes are agent-action attack surfaces (memory poisoning, tool misuse, privilege compromise, intent/goal manipulation, deceptive behaviour, repudiation, identity spoofing, human-in-the-loop overwhelm). KYE Protocol™ governs the AUTHORITY, EVIDENCE and FINALITY of the agent action each threat targets — it is the runtime enforcement + replay-evidence substrate, not an agent scanner or red-team tool. Starter requirement set; deepen by graft through the §70 rail. · License: OWASP materials are published under Creative Commons; KYE™ registry paraphrases each threat's intent and cites the threat identifier for mapping purposes only.

By category

CategoryReqsEnforcedDesignedAdvisoryDeferredCoverage
Action authority3012033%
Identity & accountability3021042%
Memory & oversight2020050%

Every requirement → the KYE™ artefact that enforces it

IDTitleStatusKYE™ enforcement
owasp-agentic.t2-tool-misuseT2 Tool Misuse — agent invokes a tool outside its authorised scopeadvisoryconstitution_refs: constitution/12-PURPOSE-PERMISSION.md, constitution/52-DELEGATED-AGENT-BINDING.md
audit_events: kye.evidence.decision_map.v1
owasp-agentic.t3-privilege-compromiseT3 Privilege Compromise — agent escalates or inherits excess authoritydesignedconstitution_refs: constitution/12-PURPOSE-PERMISSION.md
owasp-agentic.t6-intent-goal-manipulationT6 Intent Breaking & Goal Manipulation — action diverges from granted purposeadvisoryconstitution_refs: constitution/12-PURPOSE-PERMISSION.md
audit_events: kye.evidence.decision_map.v1
owasp-agentic.t8-repudiation-untraceabilityT8 Repudiation & Untraceability — no provable record of who/what actedadvisoryconstitution_refs: constitution/13-RESILIENCE-LOOP.md
audit_events: kye.evidence.pack.v1, kye.replay.proof.v1, kye.evidence.decision_map.v1
owasp-agentic.t9-identity-spoofingT9 Identity Spoofing & Impersonation — agent identity is not first-classdesignedconstitution_refs: constitution/52-DELEGATED-AGENT-BINDING.md
owasp-agentic.t7-misaligned-deceptiveT7 Misaligned & Deceptive Behaviours — contestable, reviewable outcomesdesignedconstitution_refs: constitution/21-DELEGATED-AUDITABILITY.md
owasp-agentic.t1-memory-poisoningT1 Memory Poisoning — agent memory used as authority-bearing statedesignedconstitution_refs: constitution/63-MEMORY-AUTHORITY-RAIL.md
owasp-agentic.t10-hitl-overwhelmT10 Overwhelming Human-in-the-Loop — approval fatigue defeats oversightdesignedconstitution_refs: constitution/36-GOVERNEDUI.md

Canonical KYE™ surfaces referenced on this page: KYE Protocol™.