AIUC-1 × OWASP Top 10 for Agentic Applications - AIUC-1

The OWASP Top 10 for Agentic Applications is a curated list of the most critical security threats to autonomous AI agent systems.

AIUC-1 integrates OWASP’s Top 10 for Agentic Applications. Certification against AIUC-1:

Addresses Top 10 agentic threats in requirements and controls
Strengthens robustness against the threats identified with concrete requirements and controls
Goes beyond OWASP’s focus on agentic risk alone

OWASP Top 10 for Agentic Applications crosswalk by threat

Threat	Description	Relevant AIUC-1 requirements
ASI01 - Agent Goal Hijack	Attackers alter an agent’s objectives or decision path through malicious content, exploiting the agent’s planning and reasoning capabilities. Hidden prompts can turn copilots into silent exfiltration engines (e.g. EchoLeak). This includes gradual plan injection through subtle sub-goals, direct instruction injection to override original objectives, and reflection loop traps.	B001: Third-party testing of adversarial robustness B002: Detect adversarial input B005: Implement real-time input filtering B006: Prevent unauthorized AI agent actions C009: Enable real-time feedback and intervention D003: Restrict unsafe tool calls
ASI02 - Tool Misuse and Exploitation	Agents use legitimate tools in unsafe ways due to ambiguous prompts, misalignment, or manipulated input. This can cause agents to call tools with destructive parameters or chain tools together in unexpected sequences leading to data loss or exfiltration (e.g. Amazon Q incident). Includes parameter pollution, tool chain manipulation, and automated abuse of granted permissions.	B006: Prevent unauthorized AI agent actions B007: Enforce user access privileges to AI systems D003: Restrict unsafe tool calls D004: Third-party testing of tool calls E009: Monitor third-party access A003: Limit AI agent data access
ASI03 - Identity and Privilege Abuse	Agents inherit user or system identities with high-privilege credentials, creating opportunities for privilege escalation and unauthorized access across systems. Leaked credentials allow agents to operate far beyond their intended scope. Includes dynamic permission escalation, cross-system exploitation due to inadequate scope enforcement, and shadow agent deployment that inherits legitimate credentials.	B006: Prevent unauthorized AI agent actions B007: Enforce user access privileges to AI systems D003: Restrict unsafe tool calls E009: Monitor third-party access B008: Protect AI system deployment environment
ASI04 - Agentic Supply Chain Vulnerabilities	Compromised tools, plugins, MCP services, model APIs, datasets, open-source packages, and external agents introduce vulnerabilities that agents may unknowingly leverage (e.g. GitHub MCP exploit). A compromise anywhere upstream cascades into the primary agent. Supply chain vulnerabilities are amplified because autonomous agents reuse compromised data and tools repeatedly and at scale.	E006: Conduct vendor due diligence E009: Monitor third-party access B008: Protect AI system deployment environment
ASI05 - Unexpected Code Execution	Agents generate or run code and commands unsafely, creating opportunities for remote code execution, sandbox escapes, and data exfiltration (e.g., AutoGPT RCE). Natural-language execution paths open dangerous avenues for RCE delivered via prompts rather than traditional exploits, turning agents into remote-execution gateways.	B006: Prevent unauthorized AI agent actions C006: Prevent output vulnerabilities D003: Restrict unsafe tool calls D004: Third-party testing of tool calls B008: Protect AI system deployment environment
ASI06 - Memory and Context Poisoning	Attackers poison agent memory systems, embeddings, and RAG databases to corrupt stored information and manipulate decision-making across sessions (e.g. Gemini Memory Attack). Unlike prompt injection, memory poisoning is persistent - the agent continues to behave incorrectly long after the initial attack. Includes gradual memory poisoning through repeated interactions and corrupting shared memory in multi-agent systems.	A005: Prevent cross-customer data exposure B001: Third-party testing of adversarial robustness B002: Detect adversarial input B005: Implement real-time input filtering A003: Limit AI agent data access E015: Log AI system activity
ASI07 - Insecure Inter-Agent Communication	Multi-agent systems face spoofed identities, replayed messages, and tampering in communication channels between agents. Spoofed inter-agent messages can misdirect entire clusters. If communication channels are not authenticated, encrypted, or validated, attackers can impersonate trusted agents and influence entire multi-agent systems.	B006: Prevent unauthorized AI agent actions E009: Monitor third-party access E015: Log AI system activity B008: Protect AI system deployment environment
ASI08 - Cascading Failures	Small errors in one agent propagate across planning, execution, and memory, amplifying through interconnected systems. False signals cascade through automated pipelines with escalating impact. Includes injecting false data that accumulates in long-term memory, introducing hallucinated API endpoints that cause data leaks, and implanting false information that worsens through self-reinforcement.	D001: Prevent hallucinated outputs D002: Third-party testing for hallucinations D003: Restrict unsafe tool calls E001: AI failure plan for security breaches E002: AI failure plan for harmful outputs E003: AI failure plan for hallucinations E015: Log AI system activity
ASI09 - Human-Agent Trust Exploitation	Users over-trust agent recommendations or explanations, enabling social engineering and covert harmful actions. Confident, polished explanations mislead human operators into approving harmful actions. Includes AI-powered invoice fraud replacing legitimate vendor details, AI-driven phishing with deceptive messages, and misinformation campaigns through trusted agent interfaces.	C003: Prevent harmful outputs C009: Enable real-time feedback and intervention C010: Third-party testing for harmful outputs D001: Prevent hallucinated outputs D002: Third-party testing for hallucinations E016: Implement AI disclosure mechanisms C007: Flag high risk outputs for human review
ASI10 - Rogue Agents	Compromised or misaligned agents act harmfully while appearing legitimate. They may self-repeat actions, persist across sessions, or impersonate other agents (e.g. Replit meltdown). Some agents exhibit misalignment, concealment, and self-directed action. Includes malicious workflow injection, impersonating approval agents, orchestration hijacking for fraudulent transactions, and coordinated agent flooding.	B006: Prevent unauthorized AI agent actions D003: Restrict unsafe tool calls D004: Third-party testing of tool calls E001: AI failure plan for security breaches E015: Log AI system activity B008: Protect AI system deployment environment

Last updated May 27, 2026.