OWASP Top 10 for
Agentic Applications
OWASP published the Top 10 for Agentic Applications in December 2025 (ASI01–ASI10). MAREF is a governance-first runtime built to answer these risks with runtime-enforced controls, not policy documents.
Full engineering mapping with key-code and TLA+ correspondence: owasp-agentic-top10-mapping.md.
| Risk | MAREF control | Evidence location |
|---|---|---|
| ASI01 — Agent Goal Hijack | Subgoal interceptor + 4-level safety decision tree | src/maref/subgoal/ |
| ASI02 — Tool Misuse | Tool-Gateway chokepoint, per-tool least privilege | src/maref/tools/registry.py |
| ASI03 — Identity & Privilege Abuse | Zero-trust per-agent Ed25519 identity, time-scoped credentials | src/maref/identity/ |
| ASI04 — Agentic Supply Chain | Tool/plugin provenance checks; MCP & A2A transport hardening | src/maref/mcp/ |
| ASI05 — Unexpected Code Execution | Sandbox isolation + circuit breaker HALT | src/maref/governance/circuit_breaker.py |
| ASI06 — Memory & Context Poisoning | Trust Engine v2 drift detection (KL/JS/Hellinger) | src/maref/evaluation/ |
| ASI07 — Insecure Inter-Agent Comms | Signed inter-agent messages; per-agent identity isolation | src/maref/security/ |
| ASI08 — Cascading Failures | Gray Code FSM — Hamming distance = 1 on every transition; HALT absorbing state | src/formal/MarefJoint34.tla |
| ASI09 — Human-Agent Trust Exploitation | Mode/SafetyGate escalation for high-risk user-influenced actions | src/maref/governance/ |
| ASI10 — Rogue Agents | Autonomy tiering + behavioral drift → auto policy lockdown | src/maref/governance/policy.py |
Evidence, not slogans
Every row above links to source code or a test directory. Two headline measures of "does this actually run?":
the 10-risk mapping
is CI-verifiable, and the formal specs pass TLC model checking via pytest tests/formal/.
Related reading: MAREF's 10/10 coverage explained · NIST alignment · For AI Agents / LLMs