Arthur and the OWASP Top 10 for Agentic Applications

The Agentic Security Initiative inside the OWASP GenAI Security Project published the Top 10 for Agentic Applications: ten risks that show up once software can reason, plan, and act on its own. Each category, ASI01 through ASI10, is anchored to a real incident. Security teams have started bringing the list into procurement and asking vendors which of the ten they actually cover.

Agents arrive in the enterprise from every direction, and an unmanaged agent with access to internal systems is a risk no matter how carefully it was built. The OWASP list gives everyone the same vocabulary for that risk. Arthur covers OWASP's Strong Observability and governance pillar end to end, and adds prevention at the LLM input and output boundary. Here's how that maps across the list, category by category.

The frame OWASP gives us

OWASP sets out two design principles before the list itself. Least Agency means autonomy has to be earned, the agentic version of least privilege. Strong Observability means you can see what an agent did, why it did it, and under whose identity.

Arthur owns the Observability and governance half: discovery, a live agent inventory, reasoning-chain tracing, continuous evaluation, synchronous pre- and post-LLM guardrails, and a kill switch for agents that go rogue. OWASP also maintains a larger taxonomy in its Agentic AI Threats and Mitigations list, now at v1.1, and the ASI Top 10 maps onto those threats by design.

How to read this mapping

Every category below carries one or more of three labels.

Prevent: Arthur stops the behavior before it reaches the model or the user.

Detect: Arthur sees it and alerts on it.

Govern: Arthur inventories it, assigns ownership, and produces the audit trail.

Where Arthur fits, category by category

ASI01 Agent Goal Hijack: prevent and detect

An attacker redirects the agent's goal, usually through indirect injection hidden in a document, a retrieved passage, a tool output, or a calendar invite. Simon Willison named this pattern the lethal trifecta, and it keeps working because agents can't reliably tell operator instructions from data. OWASP's anchor incident is EchoLeak (CVE-2025-32711) against M365 Copilot, rated 9.3 Critical and disclosed with no evidence of exploitation in the wild.

Arthur's pre-LLM prompt-injection guardrails block malicious input before it reaches the model, post-LLM validation checks what comes out, and full-trace visibility surfaces goal drift.

ASI02 Tool Misuse: detect and govern

Agents abuse tools they're legitimately authorized to use, through unsafe composition, recursive calls, or manipulated tool outputs, staying inside granted permissions the whole time. Arthur traces every tool call, evaluates invocation patterns, and alerts on anomalies.

ASI03 Identity and Privilege Abuse: govern

Agents misuse credentials, delegated authority, or inherited permissions through impersonation and confused-deputy patterns. Arthur flags agents that touch PII or lack an owner, assigns owner and risk class, and logs every action. OWASP covers the identity side of this ground in its Non-Human Identities Top 10, and Arthur's inventory gives identity teams the agent-level visibility that work depends on.

ASI04 Agentic Supply Chain: detect and govern

Compromise of the tools, plugins, prompts, models, and MCP servers an agent discovers and trusts at runtime. The MCP ecosystem produced its first malicious package, first critical-infrastructure RCE, and first coordinated campaign within ten months, including the Postmark MCP backdoor. Arthur's MCP server monitoring detects new and changed servers, and the inventory captures dependencies.

ASI06 Memory and Context Poisoning: prevent and detect

Corruption of memory, embeddings, or RAG stores that biases reasoning across future sessions. Planted information propagates silently. Arthur traces retrieval, applies guardrails to ingested content, and runs the continuous evaluation that catches regressions from poisoned context.

ASI08 Cascading Failures: detect and govern

A single fault propagates across agents and workflows into system-wide impact. Arthur's tracing, cross-agent visibility, and threshold alerting help detect and diagnose cascades, and the lineage metadata supports forensics and the digital-twin replay discipline OWASP prescribes.

ASI09 Human-Agent Trust Exploitation: prevent and detect

Exploiting human over-reliance through overconfidence and misleading explanations. The worst version is an agent that learns to suppress complaints because suppressing them optimizes its metric. Anthropic found that reasoning models don't always say what they think, so a stated rationale is not evidence of the computation behind it. Arthur keeps immutable logs of agent suggestions and rationale, detects hallucinations, surfaces overconfident outputs through evaluation, and supports human-in-the-loop review.

ASI10 Rogue Agents: prevent, detect, and govern

This is Arthur's best fit of the ten. Agents act beyond intended scope through goal drift, reward hacking, or compromise, which makes them autonomous insider threats. The anchor is the Replit production database deletion. Discovery finds shadow and unowned agents, continuous evaluation baselines behavior and detects drift, policy violations trigger alerts, and every action lands in a full audit trail. And when an agent crosses the line, Arthur's kill switch lets you shut it down, closing the loop from detection to response.

Rounding out the program

Arthur pairs naturally with the enforcement layers a defense-in-depth program already runs: non-human identity management for credential issuance and least privilege, supply-chain attestation for signing and provenance, and network segmentation and AI gateways for inline blocking. Arthur's inventory, traces, and audit trail give each of those layers the agent-level context they act on.

Attribution

We call this an "aligned with" mapping because OWASP runs no certification, validation, or endorsement program, and the OWASP GenAI Security Project says so directly. OWASP materials are licensed CC BY-SA 4.0. We reference the OWASP GenAI Security Project and its Agentic Security Initiative, and every cited asset links to its source.

If you're trying to see and govern the agents already running in your environment, that's where we start. Book time with an AI expert to see how Arthur discovers, inventories, and governs agents against these risks.

OWASP GenAI Security Project, Agentic Security Initiative. Referenced assets are licensed under CC BY-SA 4.0. OWASP does not endorse any product, service, or tool.

‍