Each OWASP agentic threat maps to a control you can test
Security teams judge any agent platform against the threat lists they already use. For agents, the list is the OWASP Top 10 for Agentic Applications, published in December 2025, which names ten risks specific to AI agents.1 Every one of the ten maps to controls a team can put in place and test now.
Every risk on the list has a control
The table maps each risk to the controls that address it in an AI control plane.
| Agentic risk | What it looks like | Controls |
|---|---|---|
| ASI01 Agent Goal Hijack | Hidden instructions in content, documents or tool results redirect the agent’s goal | Input and tool-result screening at the gateway Allow-listed tools per agent Approvals bound to the exact action |
| ASI02 Tool Misuse | A legitimate tool is used in a harmful way | Per-agent tool allow-lists Schema validation Rate, spend and exposure limits |
| ASI03 Identity & Privilege Abuse | Leaked or inherited credentials let an agent act beyond its scope | One identity per agent Short-lived, task-scoped tokens Delegation that narrows Real-time revocation |
| ASI04 Agentic Supply Chain Vulnerabilities | Poisoned tools, MCP servers, plugins or models enter at runtime | Only registered, signed and version-pinned MCP servers are callable A private registry of trusted servers An agent bill of materials2 |
| ASI05 Unexpected Code Execution | Natural-language paths trigger code or commands | Sandboxed execution Code and shell tools only at an explicit tier Limits on outbound connections |
| ASI06 Memory & Context Poisoning | Poisoned memory or context shapes later decisions | Context only from governed sources (master data, catalog, lineage) Provenance checks Session integrity monitoring |
| ASI07 Insecure Inter-Agent Communication | Spoofed or altered messages between agents | Signed agent cards Mutual authentication A2A traffic through the gateway No privilege from self-asserted roles |
| ASI08 Cascading Failures | Errors spread through automated pipelines | Circuit breakers Cumulative exposure limits across agents and sessions Propose-only on stale data |
| ASI09 Human-Agent Trust Exploitation | Confident, polished output leads people to approve harmful actions | Approvals bound to the exact action and showing the facts behind it Approver drills Limits that guard against consent fatigue |
| ASI10 Rogue Agents | Agents act outside their mandate or hide what they do | Registry and scanners Honeytokens and decoy tools Behavioral monitoring The kill switch |
Several controls appear in more than one row, and they are the place to start. Approvals bound to the exact action defend against goal hijack and against people trusting a confident draft. One identity per agent, with delegation that narrows at each hop, closes off privilege abuse and limits what a spoofed message between agents can do. Exposure limits that add up across agents and sessions contain both tool misuse and cascading failures.
The threat lists keep growing. Microsoft’s AI Red Team added seven agentic failure modes to its taxonomy in June 2026, among them agentic supply chain compromise, inter-agent trust escalation, session context contamination and MCP and plugin abuse.3 MITRE ATLAS has added agent-specific techniques since December 2025, such as AI Agent Tool Credential Harvesting and Publish Poisoned AI Agent Tool.4 Tagging red-team scenarios with these names lets a team’s results map to the vocabulary other teams use.
What to do next
- Developer. Allow-list the tools each agent may call, validate every call against the tool’s schema, and accept only registered, signed and version-pinned MCP servers.
- AI Engineer. Bind each approval to the exact action and show the approver the facts behind it, so a polished draft can’t carry a harmful change through.
- CISO. Name an owner for what enters the agent registry and another for what approvers are shown, because no gateway closes either risk alone, and tag red-team scenarios with the risk names in the table.
Go deeper
Section 5 of The AI Control Plane Handbook covers identity for agents, runtime controls, cryptography and human takeover after the kill switch. Slide 17 of the executive deck puts the ten risks and their controls on one page.
Found this useful? Follow me on LinkedIn for the next one.
Working on this? Connect and tell me what you are seeing.
Read the full handbook and the executive deck online.