---
title: "Containing the OWASP Agentic Threats"
date: "2026-07-22T07:30:00-07:00"
lastmod: "2026-07-22T07:30:00-07:00"
description: "OWASP's agentic threat work is where security reviews of agent systems start. This part runs mission-bound authorization against the fifteen-threat Agentic AI Threats and Mitigations taxonomy, the LLM Top 10, and the 2026 Top 10 for Agentic Applications, and gives each a verdict instead of a hand-wave: contained by machinery built for it, bounded at the action gate, or delegated to a named complement."
summary: "Security reviewers do not arrive with your framing. They arrive with OWASP\u0026rsquo;s: fifteen agentic threats from memory poisoning to human manipulation, plus the LLM Top 10. This part crosswalks both onto the handbook and refuses the move that makes crosswalks worthless, claiming everything. Each threat gets one of three verdicts. Contained means the threat lands on machinery built for it, with a draft behind it. Bounded means the cause is out of authorization\u0026rsquo;s reach but the blast radius is capped at the action gate. Delegated means it is not an authorization problem and a named complement owns it. Six of the fifteen are contained, nine are bounded, and half the LLM Top 10 is honestly someone else\u0026rsquo;s layer."
slug: "containing-the-owasp-agentic-threats"
tags:
  - "Agentic Identity"
  - "Authorization"
  - "Mission-Bound Authorization"
  - "Security Architecture"
  - "OWASP"
series:
  - "testing-mission-bound-authorization"
---


{{< tldr >}}

- **The framing.** The [OWASP Agentic AI Threats and Mitigations taxonomy](https://genai.owasp.org/resource/agentic-ai-threats-and-mitigations/), fifteen threats from memory poisoning to human manipulation, plus the [LLM Top 10](https://genai.owasp.org/llm-top-10/) and the 2026 [Agentic Top 10](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/) that distills the fifteen into the checklist reviews now open with.
- **The claim.** Every threat gets a verdict, not a hand-wave: **contained** (machinery built for it, draft behind it), **bounded** (cause untouched, blast radius capped at the action gate), or **delegated** (a named complement owns it). Six of fifteen contained, nine bounded, and half the LLM Top 10 delegated to the model and pipeline layers where it belongs.
- **What lives in this part.** [The fifteen agentic threats in one table](#the-agentic-threats-all-fifteen), [the LLM Top 10 split honestly](#the-llm-top-10-split-honestly), [three threats worth a closer look](#three-threats-worth-a-closer-look), and [what the crosswalk does not claim](#what-the-crosswalk-does-not-claim).
- **The laws.** [All five](/series/designing-mission-bound-authorization/#the-five-laws-of-delegated-authority), with Containment doing the heaviest lifting: manipulated agents, poisoned memory, and rogue delegates all fail at the same gate.
- **Specs (editor's copies).** [Runtime enforcement](https://mcguinness.github.io/mission-bound-authorization/#go.draft-mcguinness-mission-runtime.html), the [AuthZEN profile](https://mcguinness.github.io/mission-bound-authorization/#go.draft-mcguinness-mission-authzen.html), [agent harnesses](https://mcguinness.github.io/mission-bound-authorization/#go.draft-mcguinness-mission-harness.html), and [Audit Transparency](https://mcguinness.github.io/mission-bound-authorization/#go.draft-mcguinness-mission-audit.html).

**Reading path.** ~13 minutes in order, or jump to [the crosswalk table](#the-agentic-threats-all-fifteen) for every verdict at a glance.

{{< /tldr >}}

# Overview

The first two proofs in this chapter answered a threat model and a
requirements framework. This one answers the checklist. When a
security team reviews an agent deployment, the framing on the table is
usually OWASP's: the
[Agentic AI Threats and Mitigations taxonomy](https://genai.owasp.org/resource/agentic-ai-threats-and-mitigations/)
from the GenAI Security Project (the February 2025 fifteen-threat version, distilled in December 2025 into the [Top 10 for Agentic Applications for 2026](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/), mapped below), fifteen threats spanning single
agents, multi-agent systems, and the humans around them, alongside the
older [Top 10 for LLM Applications](https://genai.owasp.org/llm-top-10/).
If the handbook cannot state its position against that list, threat by
threat, the reviewer is right to treat it as unevaluated.

A crosswalk that claims everything has been fitted, not tested, so
this one grades itself with three verdicts and accepts the tally it
gets:

| Verdict | What it means |
| --- | --- |
| **Contained** | The threat lands on machinery built for it: a structural control with a draft behind it |
| **Bounded** | The cause is out of authorization's reach, but the blast radius is capped at the action gate |
| **Delegated** | Not an authorization problem: a named complement owns it, and the handbook composes with it |

The distinction that drives most rows is the one the
[trifecta post](/notes/splitting-the-lethal-trifecta/) established:
the authorization layer does not make the model resistant to anything.
It makes the model's compromise survivable, because authority was
fixed at approval and every consequential action is checked against it
fresh. Threats that attack authority are contained. Threats that
attack the model, its memory, or its inputs are bounded, because a
fully fooled agent still cannot out-argue a parameter check. Threats
that attack layers the handbook never claimed are delegated, by name.
And one definition keeps every verdict honest: contained means
contained at the authority boundary, never prevented at the cause. A
manipulated goal, a misused tool, or a rogue instance can still act
inside the committed authority, which is why scope stays tight and one line bounds the whole chapter: the gate checks a committed boundary, never an inferred intent.

# The agentic threats, all fifteen

| Threat | The attack | The handbook's answer | Verdict |
| --- | --- | --- | --- |
| T1 Memory Poisoning | Persistent memory is seeded with malicious data that steers future behavior | Poisoned memory can steer proposals, not authority: [shaping fails closed on ambiguity](/notes/from-a-request-to-an-approved-mission/), and every consequential action still needs a fresh parameter-bound permit against the approved Mission | Bounded |
| T2 Tool Misuse | The agent's own tools are driven to unauthorized or harmful invocations | [Per-action PEP/PDP enforcement](/notes/mission-bound-runtime-enforcement/) with parameters bound into the permit, applied at the tool boundary by the [MCP application post](/notes/least-privilege-mcp-tool-calls-need-a-mission/) | Contained |
| T3 Privilege Compromise | Permissions escalate beyond what the task requires | Narrowing: every derivation is a strict subset of the Mission's Authority Set, [Child Missions only narrow](/notes/mission-bound-authority/), and there is no ambient inheritance to escalate into | Contained |
| T4 Resource Overload | Unbounded agent activity exhausts compute, API, or financial budgets | `expires_at` on every Mission, fan-out bounded by count and depth, and [Consumption Metering](https://mcguinness.github.io/mission-bound-authorization/#go.draft-mcguinness-mission-metering.html) (experimental) for spend | Bounded |
| T5 Cascading Hallucination Attacks | False content propagates through memory, messages, and downstream systems | Authorization does not verify truth. It gates consequence: hallucinated content can only reach the world through consequential actions, each needing its own permit | Bounded |
| T6 Intent Breaking and Goal Manipulation | Injection or instruction manipulation redirects the agent's objectives | The enemy sentence, answered: the injected goal cannot widen the committed one, because the PDP checks actions against the approved Mission, not against the agent's current intent | Contained |
| T7 Misaligned and Deceptive Behaviors | The agent acts against its intended purpose or conceals what it does | Deception is not detected, it is out-evidenced: only approved action classes execute, and [Decision and Execution Evidence](/notes/the-agent-runtime-and-audit/) come from the gate, not from the agent's self-report | Bounded |
| T8 Repudiation and Untraceability | Actions cannot be reliably attributed or audited | Attribution end to end: the `act` chain on every hop, the evidence family joined on `mission_id`, and SCITT keeping the feed tamper-evident | Contained |
| T9 Identity Spoofing and Impersonation | Attackers assume an agent's identity or abuse non-human authentication | [Attested instance identity](/notes/mission-bound-authority/), sender-constrained tokens, and mediated custody keeping the credential out of the agent entirely for mediated classes | Contained |
| T10 Overwhelming the Human in the Loop | Approval volume is weaponized until humans rubber-stamp | Human decisions stay rare and consequential by design: machines approve actions, [authorized policy approves what it may](/notes/from-a-request-to-an-approved-mission/#who-may-approve), and humans keep the ceilings and the class-guard classes, with [deferred approval](/notes/from-a-request-to-an-approved-mission/) and the batched [discovery loop](/notes/adopting-mission-bound-authorization/#composing-with-the-ecosystem) absorbing the volume | Bounded |
| T11 Unexpected RCE and Code Attacks | Tool invocations achieve code execution | Sandboxing owns execution. The handbook gates what executed code can reach: consequential effects still need permits, and capabilities are bound to source digests with drift failing closed | Bounded |
| T12 Agent Communication Poisoning | Malicious instructions ride inter-agent messages | Messages can lie, authority cannot: influence carries no authority between agents, because delegation only narrows and every hop is enforced against its own Child Mission | Bounded |
| T13 Rogue Agents | A compromised agent inside the system acts maliciously | A rogue instance holds only mission-bound, instance-bound, revocable authority, and [Termination cascades](/notes/mission-lifecycle-and-change/) through the delegation tree to issuance, permits, and the harness | Contained |
| T14 Human Attacks on Multi-Agent Systems | Operators are manipulated into enabling harm | Social engineering is out of authorization's reach. What holds: a manipulated operator can still only approve [what shaping renders](/notes/you-approve-what-you-were-shown/), and the approval is attributed to them | Bounded |
| T15 Human Manipulation | The agent deceives its own human into approving or enabling harm | Consent Evidence commits the disclosure as rendered, so the record shows what the trusted approval surface committed, never what the human perceived or understood. An accurately disclosed bad idea remains the human's decision, and the record says so | Bounded |

Six contained, nine bounded, none waved away. The tally is the honest
shape of an authorization layer: the threats that attack authority
(tools, privilege, goals, attribution, identity, rogue delegates) land
on machinery built for them, and the threats that attack the model or
the humans are capped rather than cured, because capping is what a
deterministic gate can truthfully offer.

# The 2026 Agentic Top 10, mapped

In December 2025 the same OWASP project distilled its agentic work
into the
[Top 10 for Agentic Applications for 2026](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/)
(ASI01 through ASI10), and that list is now the checklist most reviews
open with. It compresses cleanly onto the fifteen-threat crosswalk
above, so the verdicts carry over rather than multiply:

| Agentic Top 10 (2026) | Lands on | Verdict |
| --- | --- | --- |
| ASI01 Agent Goal Hijack | T6 intent breaking: the PDP checks actions against the approved Mission, not the agent's current goal | Contained |
| ASI02 Tool Misuse and Exploitation | T2: per-action PEP/PDP with parameter binding at the tool boundary | Contained |
| ASI03 Identity and Privilege Abuse | T3 and T9: strict-subset derivation, attested instances, sender constraint | Contained |
| ASI04 Agentic Supply Chain Vulnerabilities | The supply chain is another layer's job, and discovered tools still bind under [encounter adjudication](/notes/adopting-mission-bound-authorization/#composing-with-the-ecosystem) | Delegated |
| ASI05 Unexpected Code Execution | T11: sandboxing owns execution, and consequential effects still need permits | Bounded |
| ASI06 Memory and Context Poisoning | T1: poisoned context steers proposals, never authority, and [least exposure](/notes/least-exposure-is-broader-than-least-privilege/) shrinks what can poison | Bounded |
| ASI07 Insecure Inter-Agent Communication | T12: messages can lie, authority cannot, since delegation only narrows and every hop re-authenticates, with transport the delegated layer | Bounded |
| ASI08 Cascading Failures | T4 and T5: expiry, fan-out bounds, metering, and cascade revocation cap the blast radius | Bounded |
| ASI09 Human-Agent Trust Exploitation | T14 and T15: disclosure integrity and the fatigue budget raise the bar, and a deceived human is still the residual | Bounded |
| ASI10 Rogue Agents | T13: instance-bound, mission-bound, revocable authority with cascade termination | Contained |

The tally holds the same shape: the authority-shaped risks land on
machinery built for them, and the risks that live in the model, the
supply chain, or the human stay bounded or delegated, stated rather
than absorbed.

# The LLM Top 10, split honestly

The [Top 10 for LLM Applications](https://genai.owasp.org/llm-top-10/)
predates the agentic taxonomy and mixes layers, which makes it the
better test of the delegated verdict. Half of it is not an
authorization problem, and saying so is the point:

| Entry | The handbook's answer | Verdict |
| --- | --- | --- |
| LLM01 Prompt Injection | [The trifecta post](/notes/splitting-the-lethal-trifecta/) carries this end to end: the injected instruction cannot widen committed authority, and the external leg needs a fresh parameter-bound permit | Bounded |
| LLM02 Sensitive Information Disclosure | [Exposure discipline](/notes/least-exposure-is-broader-than-least-privilege/): bound what the agent may see as deliberately as what it may do, and mediated custody keeps credentials out of the leakable set | Bounded |
| LLM03 Supply Chain | Model and dependency provenance, owned by the software supply chain. One authorization-shaped edge: capabilities bound to source digests fail closed on drift | Delegated |
| LLM04 Data and Model Poisoning | Training and embedding pipeline security, upstream of any authorization decision | Delegated |
| LLM05 Improper Output Handling | Output is only dangerous when it acts. The consequential boundary is where the handbook stands, and nothing crosses it without a permit | Bounded |
| LLM06 Excessive Agency | The direct hit: the entire handbook is the treatment for this entry | Contained |
| LLM07 System Prompt Leakage | Moot by design: authority lives in the Mission and its tokens, not in the prompt, so a leaked prompt discloses instructions, not power | Delegated |
| LLM08 Vector and Embedding Weaknesses | Retrieval pipeline security. What retrieval returns is untrusted content, and the taint response treats it that way | Delegated |
| LLM09 Misinformation | Content truth is semantic, and the gate is structural | Delegated |
| LLM10 Unbounded Consumption | Expiry on every Mission and metering (experimental) on spend | Bounded |

LLM06 deserves the sentence. OWASP's mitigations for Excessive Agency
read like this handbook's table of contents: minimize the extensions
and their permissions, avoid open-ended functions, require human
approval for high-impact actions, enforce authorization in downstream
systems rather than trusting the model, and log everything. The
handbook is what happens when that advice stops being a bullet list
and becomes one architecture with wire drafts behind it.

# Three threats worth a closer look

**Intent breaking is the taxonomy's center, and the handbook's
enemy.** T6 is prompt injection grown up: the attacker does not need
to breach anything, only to change what the agent is trying to do.
Every mitigation that asks the model to notice the manipulation is
probabilistic. The handbook's answer is the same one it gives the
trifecta: the injection changed the agent's mind, and the agent's mind
was never the source of authority. The Mission was committed at
approval, the permit is checked at execution, and between those two
points there is nothing the injected goal can rewrite. Approval is a
moment, work is a span, and the span is policed against the moment.

**Overwhelming the human in the loop is an argument about grain.** T10
is the taxonomy's sharpest design question, because both naive answers
lose: approve every action and fatigue turns humans into rubber
stamps, approve nothing and governance is gone. The handbook's grain
is the Mission. A human approves the envelope once, against a
[committed disclosure](/notes/you-approve-what-you-were-shown/), and
the per-action volume goes to the PDP, which does not tire. When the
work outgrows the envelope, the
[discovery loop](/notes/adopting-mission-bound-authorization/#composing-with-the-ecosystem)
batches the overflow into a governed expansion request instead of a
stream of interrupts. The residual is real and stated: at Mission
grain, approval fatigue becomes a governance discipline rather than a
solved problem, disclosure quality is what stands between an approver
and a reflex, and the
[fatigue budget](/notes/from-a-request-to-an-approved-mission/#the-fatigue-budget)
collects the controls that spend against it.

**A rogue agent is an insider, and every agent here is treated as
one.** T13 assumes the attacker is already inside the system, wearing
a legitimate agent. The handbook never trusted that agent more than
its paperwork: its authority is a strict subset of its parent's, its
tokens are bound to its attested instance so they do not travel, its
consequential actions need permits like everyone else's, and when it
is caught, [revocation cascades](/notes/mission-lifecycle-and-change/)
through the delegation tree it belongs to. The multi-agent threats
(T12 through T14) all get the same structural reply: cooperation
happens in messages, but authority never does.

# What the crosswalk does not claim

Three of this crosswalk's ceilings are [the trifecta post's honest residuals](/notes/splitting-the-lethal-trifecta/#the-honest-residuals), inherited unchanged. The verdicts are only as strong as PEP coverage, and an unmediated path is a threat with no verdict at all. The enforcement is structural, not semantic. And inside the approved scope, a turned agent is still turned. Two ceilings are this crosswalk's own.

- **Bounded is not prevented.** For every bounded row the cause is
  untouched: the memory is still poisoned, the model is still fooled,
  the human is still tired. The gate caps what the compromise can
  reach, and that is the whole claim.
- **The delegated rows are real dependencies.** Supply chain,
  poisoning, retrieval security, and sandboxing are layers the
  handbook composes with and cannot replace. A deployment that skips
  them has a contained authorization layer inside an uncontained
  system.

The taxonomy's own mitigation columns keep converging on the same
words: least privilege, human approval, complete mediation, audit
trails. Those are adjectives until something turns them into
verifiable artifacts. The crosswalk above is what that looks like, and
the tally, six contained and nine bounded, is the score against a framing this model's authors did not choose. The [vendor test](/notes/mission-based-authorization-vendor-test/) carries its six questions from here.