> ## Documentation Index > Fetch the complete documentation index at: https://standard.aiuc-1.com/llms.txt > Use this file to discover all available pages before exploring further. # AIUC-1 × OWASP Top 10 for Agentic Applications export const InlineClock = ({city, timeZone}) => { const [time, setTime] = useState('--:--:--'); useEffect(() => { const update = () => setTime(new Intl.DateTimeFormat('en-US', { hour: '2-digit', minute: '2-digit', second: '2-digit', hour12: false, timeZone }).format(new Date())); update(); const id = setInterval(update, 1000); return () => clearInterval(id); }, [timeZone]); return
{city} {time}
; };

The OWASP Top 10 for Agentic Applications is a curated list of the most critical security threats to autonomous AI agent systems.

AIUC-1 integrates OWASP's Top 10 for Agentic Applications. Certification against AIUC-1:

## OWASP Top 10 for Agentic Applications crosswalk by threat
| Threat | Description | Relevant AIUC-1 requirements | | -------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | ASI01 - Agent Goal Hijack | Attackers alter an agent's objectives or decision path through malicious content, exploiting the agent's planning and reasoning capabilities. Hidden prompts can turn copilots into silent
exfiltration engines (e.g. EchoLeak). This includes gradual plan injection through subtle sub-goals, direct instruction injection to override original objectives, and reflection loop traps. |
B001: Third-party testing of adversarial robustnessB002: Detect adversarial inputB005: Implement real-time input filteringB006: Prevent unauthorized AI agent actionsC009: Enable real-time feedback and interventionD003: Restrict unsafe tool calls
| | ASI02 - Tool Misuse and Exploitation | Agents use legitimate tools in unsafe ways due to ambiguous prompts, misalignment, or manipulated input. This can cause agents to call tools with destructive parameters or chain tools together in unexpected sequences leading to data loss or exfiltration (e.g. Amazon Q incident). Includes parameter pollution, tool chain manipulation, and automated abuse of granted permissions. |
B006: Prevent unauthorized AI agent actionsB007: Enforce user access privileges to AI systemsD003: Restrict unsafe tool callsD004: Third-party testing of tool callsE009: Monitor third-party accessA003: Limit AI agent data access
| | ASI03 - Identity and Privilege Abuse | Agents inherit user or system identities with high-privilege credentials, creating opportunities for privilege escalation and unauthorized access across systems. Leaked credentials allow agents to operate far beyond their intended scope. Includes dynamic permission escalation, cross-system exploitation due to inadequate scope enforcement, and shadow agent deployment that inherits legitimate credentials. |
B006: Prevent unauthorized AI agent actionsB007: Enforce user access privileges to AI systemsD003: Restrict unsafe tool callsE009: Monitor third-party accessB008: Protect AI system deployment environment
| | ASI04 - Agentic Supply Chain Vulnerabilities | Compromised tools, plugins, MCP services, model APIs, datasets, open-source packages, and external agents introduce vulnerabilities that agents may unknowingly leverage (e.g. GitHub MCP exploit). A compromise anywhere upstream cascades into the primary agent. Supply chain vulnerabilities are amplified because autonomous agents reuse compromised data and tools repeatedly and at scale. |
E006: Conduct vendor due diligenceE009: Monitor third-party accessB008: Protect AI system deployment environment
| | ASI05 - Unexpected Code Execution | Agents generate or run code and commands unsafely, creating opportunities for remote code execution, sandbox escapes, and data exfiltration (e.g., AutoGPT RCE). Natural-language execution paths open dangerous avenues for RCE delivered via prompts rather than traditional exploits, turning agents into remote-execution gateways. |
B006: Prevent unauthorized AI agent actionsC006: Prevent output vulnerabilitiesD003: Restrict unsafe tool callsD004: Third-party testing of tool callsB008: Protect AI system deployment environment
| | ASI06 - Memory and Context Poisoning | Attackers poison agent memory systems, embeddings, and RAG databases to corrupt stored information and manipulate decision-making across sessions (e.g. Gemini Memory Attack). Unlike prompt injection, memory poisoning is persistent - the agent continues to behave incorrectly long after the initial attack. Includes gradual memory poisoning through repeated interactions and corrupting shared memory in multi-agent systems. |
A005: Prevent cross-customer data exposureB001: Third-party testing of adversarial robustnessB002: Detect adversarial inputB005: Implement real-time input filteringA003: Limit AI agent data accessE015: Log AI system activity
| | ASI07 - Insecure Inter-Agent Communication | Multi-agent systems face spoofed identities, replayed messages, and tampering in communication channels between agents. Spoofed inter-agent messages can misdirect entire clusters. If communication channels are not authenticated, encrypted, or validated, attackers can impersonate trusted agents and influence entire multi-agent systems. |
B006: Prevent unauthorized AI agent actionsE009: Monitor third-party accessE015: Log AI system activityB008: Protect AI system deployment environment
| | ASI08 - Cascading Failures | Small errors in one agent propagate across planning, execution, and memory, amplifying through interconnected systems. False signals cascade through automated pipelines with escalating impact. Includes injecting false data that accumulates in long-term memory, introducing hallucinated API endpoints that cause data leaks, and implanting false information that worsens through self-reinforcement. |
D001: Prevent hallucinated outputsD002: Third-party testing for hallucinationsD003: Restrict unsafe tool callsE001: AI failure plan for security breachesE002: AI failure plan for harmful outputsE003: AI failure plan for hallucinationsE015: Log AI system activity
| | ASI09 - Human-Agent Trust Exploitation | Users over-trust agent recommendations or explanations, enabling social engineering and covert harmful actions. Confident, polished explanations mislead human operators into approving harmful actions. Includes AI-powered invoice fraud replacing legitimate vendor details, AI-driven phishing with deceptive messages, and misinformation campaigns through trusted agent interfaces. |
C003: Prevent harmful outputsC009: Enable real-time feedback and interventionC010: Third-party testing for harmful outputsD001: Prevent hallucinated outputsD002: Third-party testing for hallucinationsE016: Implement AI disclosure mechanismsC007: Flag high risk outputs for human review
| | ASI10 - Rogue Agents | Compromised or misaligned agents act harmfully while appearing legitimate. They may self-repeat actions, persist across sessions, or impersonate other agents (e.g. Replit meltdown). Some agents exhibit misalignment, concealment, and self-directed action. Includes malicious workflow injection, impersonating approval agents, orchestration hijacking for fraudulent transactions, and coordinated agent flooding. |
B006: Prevent unauthorized AI agent actionsD003: Restrict unsafe tool callsD004: Third-party testing of tool callsE001: AI failure plan for security breachesE015: Log AI system activityB008: Protect AI system deployment environment
| Last updated May 27, 2026.
37.782274° N -122.392147° W FIG. A (SITE INDEX)
Artificial Intelligence Underwriting Company
Code Structural unit a. AIUC-1 requirements for agent data, privacy, security, safety, reliability, accountability, and societal risk. b. Evidence templates for technical implementation, legal policy, operational practice, and third-party evaluation. c. Crosswalks to AI regulations, standards, and security frameworks. d. Quarterly updates shaped by enterprise adoption, risk, regulation, and community input.
100 © AIUC — ALL RIGHTS RESERVED