OWASP Agentic Top-10 Coverage

Adversarial manipulation of agent memory (long-term, short-term, episodic) to alter agent behavior across sessions. Includes injection via tool outputs that get persisted into agent memory stores.

Abuse of tools / function-calling surfaces by a compromised agent or via injected instructions — tool typosquats, hidden-instruction tool descriptions, unauthorized invocations of high-privilege tools.

Agent exceeds its intended privilege ring — privilege-escalation attacks, identity-spoofing of higher-trust agents, bypass of role-based access controls.

Resource-exhaustion attacks: token-budget burn, infinite loops in agent reasoning, fork-bomb tool invocations, memory exhaustion via context-stuffing.

A hallucinated output from one agent feeding into another agent's input, multiplying error rates downstream. Includes fabricated tool results poisoning downstream reasoning.

Prompt-injection attacks that redirect agent goals — direct overrides, indirect injection via tool results / RAG retrievals, canary-leak detection.

Agents pursuing goals misaligned with operator intent (alignment drift, deceptive intermediate outputs). Includes prompt-defense coverage gaps where defensive injection-vectors are not present in system prompts.

Forensic-completeness gaps: missing audit rows, log tampering, untraceable agent actions. The audit-trail integrity guarantee underlies post-incident accountability.

An agent claims an identity it does not possess — forged DIDs, replayed credentials, missing identity-verification on tool calls. Includes the absence of cryptographic identity binding.

Agent surfaces so many escalation requests that operators rubber-stamp them — defeating the human-oversight control. Rate-limiting and intelligent batching of HITL prompts.