Agentic Security Hub

Start here

• Learning path

  6 steps from the components of an agent to a working threat model, with a quiz per step.

• Threat Modeler

  Draw an agentic system in the browser and get its OWASP agentic threats, MAESTRO layers, attack paths and mitigations.

• OWASP AISVS

  All 213 AI Security Verification Standard requirements by chapter and level.

• Threat taxonomy

  The OWASP Top 10 for Agentic Applications, the Cisco AI security taxonomy, MITRE ATLAS, AIVSS and AIUC-1 side by side.

AI agent threats

The 17 threats of the OWASP Agentic AI Threats and Mitigations guide, each with attack vectors, affected components and the controls that mitigate it.

• T1 Memory Poisoning

  Attackers inject malicious data into the agent's memory to manipulate future decisions, affecting any memory type from in-agent session to cross-agent cross-user memory.

  Risk 9/10 · 6 attack vectors

• T2 Tool Misuse

  Manipulation of tools, APIs, or environment access to perform unintended actions or access unauthorized resources, including exploitation of access to external systems.

  Risk 8/10 · 6 attack vectors

• T3 Privilege Compromise

  Breaking information system boundaries through context collapse, causing unauthorized data access/leakage, or exploiting tool privileges to gain unauthorized access to systems.

  Risk 9/10 · 6 attack vectors

• T4 Resource Overload

  Overwhelming external services through excessive API calls or resource consumption, potentially causing denial of service or excessive costs.

  Risk 6/10 · 6 attack vectors

• T5 Cascading Hallucination Attacks

  Foundation models generate incorrect information that propagates through the system, affecting reasoning quality and being stored in memory across sessions or agents.

  Risk 7/10 · 6 attack vectors

• T6 Intent Breaking & Goal Manipulation

  Attacks that manipulate the agent's core decision-making to achieve unauthorized goals, breaking control flow, abusing shared context, or interfering with isolated data.

  Risk 8/10 · 6 attack vectors

• T7 Misaligned & Deceptive Behaviors

  Model alignment issues leading to unintended behaviors that impact users, organizations, or broader populations through subtle reasoning or tool usage misalignments.

  Risk 6/10 · 6 attack vectors

• T8 Repudiation & Untraceability

  Making agent actions difficult to trace through workflow manipulation, obscuring decision trails in reasoning chains, or tampering with evidence in memory.

  Risk 5/10 · 6 attack vectors

• T9 Identity Spoofing & Impersonation / Agent Identity Compromise

  Impersonating trusted agents, users or services, or taking over an agent's own persistent identity and credentials, to act under a trusted identity.

  Risk 8/10 · 7 attack vectors

• T10 Overwhelming Human in the Loop

  Bypassing human oversight in workflows by creating excessive activity requiring approval, leading to notification fatigue and reduced scrutiny.

  Risk 6/10 · 6 attack vectors

• T11 Unexpected RCE and Code Attacks

  Tools or environments enabling unexpected code execution, presenting direct risks to code execution environments.

  Risk 9/10 · 6 attack vectors

• T12 Agent Communication Poisoning

  Injection of malicious data into inter-agent communication channels or using external systems for side channel communications and memory persistence.

  Risk 6/10 · 6 attack vectors

• T13 Rogue Agents in Multi-Agent Systems

  Compromised AI agent activity outside monitoring limits or orchestration in multi-agent systems.

  Risk 9/10 · 6 attack vectors

• T14 Human Attacks on Multi-Agent Systems

  Exploits trust relationships between agents and workflows to manipulate human operators.

  Risk 6/10 · 6 attack vectors

• T15 Human Manipulation

  Models exploit human trust to manipulate users, leveraging reasoning capabilities or operational access to influence human decisions.

  Risk 8/10 · 6 attack vectors

• T16 Insecure Inter-Agent Protocol Abuse

  Attackers abuse the trust and control semantics of agent interoperability protocols such as MCP and A2A: manipulating server responses, injecting context, publishing misleading tool descriptions or exploiting ambiguous consent flows.

  Risk 8/10 · 6 attack vectors

• T17 Supply Chain Compromise

  Vulnerable, malicious or outdated components enter the agent through models, libraries, tools, plugins, prompt templates, build environments or framework updates.

  Risk 9/10 · 6 attack vectors

Security controls

20 controls mapped to the threats they mitigate and to OWASP AISVS requirements, with design, build and operations tasks.

• M1 Memory Validation & Sanitization

  Implement comprehensive validation and sanitization of AI memory systems, including vector databases, embeddings, and training data to prevent poisoning attacks and ensure data integrity throughout the AI lifecycle.

• M2 Tool Sandboxing & Isolation

  Implement defense-in-depth isolation for tool execution environments using containerization, virtualization, and strict resource controls to prevent tool misuse, contain breaches, and prevent unexpected code execution.

• M3 Secure Inter-Agent Communication

  Implement cryptographically secure communication channels between agents with authentication, integrity verification, replay protection, and support for decentralized identity to prevent spoofing, poisoning attacks, and rogue agent infiltration.

• M4 Prompt Hardening & Jailbreak Prevention

  Implement multiple layers of prompt security including structural defenses, behavioral constraints, runtime detection, and advanced techniques to prevent prompt injection, model manipulation, and jailbreaking attempts.

• M5 Multi-Stage Reasoning Validation

  Implement comprehensive validation of agent reasoning processes using multiple checkpoints, external validators, consistency checks, and fact verification to ensure goal alignment, prevent manipulation, and detect hallucinations.

• M6 Comprehensive Security Monitoring & Auditing

  Implement end-to-end observability with security-focused monitoring, anomaly detection, tamper-evident logging, and advanced threat hunting to ensure accountability, enable incident response, and detect rogue agents.

• M7 Zero Trust & Least Privilege Access

  Implement fine-grained access controls with continuous verification, temporary credentials, minimal permission sets, and dynamic privilege management following zero trust principles to prevent tool misuse, privilege compromise, and unauthorized code execution.

• M8 Adaptive Human-in-the-Loop Controls

  Implement intelligent human oversight with risk-based approval workflows, clear decision interfaces, anti-fatigue mechanisms, and adaptive trust systems to prevent approval overwhelm, human attacks, and manipulation while maintaining effective oversight.

• M9 Distributed Resource Management & Rate Limiting

  Implement multi-layer resource controls with intelligent quotas, circuit breakers, cost management, and distributed rate limiting to prevent resource exhaustion, financial damage, and denial of service attacks while maintaining system performance.

• M10 Defense-in-Depth Architecture & Trust Boundaries

  Implement multiple security layers with clear trust boundaries, network segmentation, cryptographic verification, and zero-trust networking to contain breaches, prevent lateral movement, and protect against privilege compromise, identity spoofing, and rogue agents.

• M11 Content Security & Output Filtering

  Implement comprehensive filtering and validation of agent outputs to prevent harmful content generation, data leakage, manipulation attempts, and ensure compliance with security policies and regulatory requirements.

• M12 Secure Model Training & Validation

  Comprehensive security practices for model training pipelines including data integrity verification, training environment hardening, model validation against adversarial inputs, and ensuring reproducibility of training processes.

• M13 Secure Development Lifecycle Integration

  Embed security practices throughout the AI and agent lifecycle with security design reviews, automated testing gates, dependency scanning, and continuous compliance checks.

• M14 Runtime Security Controls & Sandboxing

  Implement comprehensive runtime security controls including advanced sandboxing, execution monitoring, and dynamic security policy enforcement to prevent unexpected code execution and contain security breaches in real-time.

• M15 Agent Identity & Authentication Framework

  Implement comprehensive agent identity management with decentralized identifiers, verifiable credentials, and strong authentication to prevent identity spoofing, enable secure agent discovery, and support agent reputation systems.

• M16 Behavioral Monitoring & Ethics Framework

  Implement comprehensive behavioral analysis, ethics enforcement, and bias detection to identify misaligned behaviors, prevent human manipulation, and ensure ethical agent operations while maintaining transparency and accountability.

• M17 Supply Chain Security & Provenance

  Implement comprehensive supply chain security including model provenance verification, dependency management, secure development environments, and third-party component validation to prevent supply chain attacks and ensure component integrity.

• M18 Incident Response & Recovery Framework

  Implement comprehensive incident response capabilities specifically designed for agentic AI systems, including automated containment, forensic analysis, recovery procedures, and lessons learned integration to rapidly respond to security incidents and minimize impact.

• M19 MCP Server Hardening & Tool Provenance

  Treat every MCP server, A2A peer and tool definition as an untrusted, versioned dependency: admit only allow-listed and verified servers, authenticate and authorize every protocol request, validate and screen tool metadata and results before they reach the model, and require re-approval when a tool definition changes.

• M20 Agent Supply-Chain Integrity

  Extend software supply-chain controls to everything an agent loads at build or run time: models and adapters, prompt templates, agent cards, tool and MCP server definitions, plugins and framework updates.

Key components of an agentic system

• KC1 Language Models (LLMs)

  The core cognitive engine or "brain" of the agent (e.g., GPT-4, Claude), responsible for understanding, reasoning, planning, and generating responses.

• KC2 Orchestration (Control Flow)

  Mechanisms that dictate the agent's overall behavior, information flow, and decision-making processes.

• KC3 Reasoning / Planning Paradigm

  How agents utilize LLMs to solve complex tasks requiring multiple steps and strategic thinking by breaking down high-level tasks into smaller sub-tasks.

• KC4 Memory Modules

  Enable the agent to retain short-term (immediate context) and long-term information (past interactions, knowledge) for coherent and personalized interactions.

• KC5 Tool Integration Frameworks

  Allow agents to extend capabilities by using external tools (APIs, functions, data stores) to interact with the real world or other systems.

• KC6 Operational Environment (Agencies)

  Manages the integration layer between AI agents and external tools, APIs, code execution environments, and database systems.

Architecture patterns

• Sequential Agent Architecture

  A straightforward linear workflow where a single agent processes tasks through a linear workflow.

• Hierarchical Agent Architecture

  This architecture introduces a KC2.2 (Hierarchical planning) model where a central orchestrator agent decomposes complex tasks and delegates them to specialized sub-agents.

• Collaborative Agent Swarm

  A collaborative swarm is a decentralized system where multiple peer agents operate without a strict hierarchy, using KC2.3 (Multi-agent collaboration).

• Reactive Agent Architecture

  Agents designed for responsive workflows, often event-driven, where actions are taken based on immediate inputs or changes in the environment.

• Knowledge-Intensive Agent Architecture

  Agents focused on leveraging and processing large volumes of external data, typically using sophisticated RAG approaches.