ATR × OWASP Top 10 for Agentic Applications (2026)

Last updated: 2026-10-15 ATR version: v4.1.5 (844 rules with OWASP Agentic tags) OWASP framework: Agentic Top 10 v1.0 (December 2025)

Summary

• Categories covered: 10/10
• Total rule -> category mappings: 1098
• Tagged ATR rules: 833 of 833 total rules in repo
• ATR version: v4.1.5 -- OWASP Agentic Top 10: v1.0 (December 2025)

Strength tiers: STRONG >= 8 rules · MODERATE 4-7 rules · LIMITED 1-3 rules.

Coverage by ASI category

Per-category detail

ASI01: Agent Goal Hijack (490 rules) -- STRONG

OWASP description. Attackers manipulate the agent's decision pathways or objectives so it pursues an adversary-controlled goal instead of its assigned task. Canonical instance: EchoLeak.

ATR coverage shape. Direct + indirect prompt injection, persona hijack, encoding evasion, jailbreak chains, multi-turn assembly, multilingual paraphrase.

Reference attack (EchoLeak). Covered by the rules below; ATR's general-purpose detection layers match the technique signature without needing an attack-specific rule.

Top rules by severity:

Plus 485 additional rules tagged ASI01 -- see docs/owasp-agentic-mapping.json for the complete list.

ASI02: Tool Misuse and Exploitation (70 rules) -- STRONG

OWASP description. Legitimate tools are used unsafely because the agent acts on ambiguous instructions or has over-privileged access. Canonical instance: Amazon Q assistant tool-misuse incident.

ATR coverage shape. Unauthorized tool calls, SSRF via tool, MCP malicious response, schema-description contradiction, consent bypass.

Reference attack (Amazon Q). Covered by the rules below; ATR's general-purpose detection layers match the technique signature without needing an attack-specific rule.

Top rules by severity:

Plus 65 additional rules tagged ASI02 -- see docs/owasp-agentic-mapping.json for the complete list.

ASI03: Identity and Privilege Abuse (125 rules) -- STRONG

OWASP description. Agents operate in an attribution gap; leaked credentials or escalated privileges let them act beyond intended scope.

ATR coverage shape. API key exposure, OAuth token abuse, env var harvesting, scope creep, credential file theft, privilege escalation.

Top rules by severity:

Plus 120 additional rules tagged ASI03 -- see docs/owasp-agentic-mapping.json for the complete list.

ASI04: Agentic Supply Chain Vulnerabilities (98 rules) -- STRONG

OWASP description. Runtime composition of third-party capabilities (MCP servers, plugins, skills, A2A endpoints) lets adversaries poison the call graph after deployment. Canonical instance: GitHub MCP exploit.

ATR coverage shape. Skill impersonation, hidden capability, polymorphic skill, registry poisoning, malicious skill code, parameter injection.

Reference attack (GitHub MCP exploit). Covered by the rules below; ATR's general-purpose detection layers match the technique signature without needing an attack-specific rule.

Top rules by severity:

Plus 93 additional rules tagged ASI04 -- see docs/owasp-agentic-mapping.json for the complete list.

ASI05: Unexpected Code Execution (RCE) (106 rules) -- STRONG

OWASP description. Agents generate and execute code ("vibe coding"), opening RCE paths through natural-language instructions. Canonical instance: AutoGPT RCE.

ATR coverage shape. eval injection, shell metacharacter escape, dynamic import exploitation, indirect tool injection leading to code exec.

Reference attack (AutoGPT RCE). Covered by the rules below; ATR's general-purpose detection layers match the technique signature without needing an attack-specific rule.

Top rules by severity:

Plus 101 additional rules tagged ASI05 -- see docs/owasp-agentic-mapping.json for the complete list.

ASI06: Memory & Context Poisoning (105 rules) -- STRONG

OWASP description. Long-term memory, RAG stores, or shared context are corrupted so the agent's future behavior is shaped by attacker payloads. Canonical instance: Gemini Memory Attack.

ATR coverage shape. Agent memory manipulation, RAG poisoning, audit evasion, malicious finetuning data, consensus poisoning, persistent context drift.

Reference attack (Gemini Memory Attack). Covered by the rules below; ATR's general-purpose detection layers match the technique signature without needing an attack-specific rule.

Top rules by severity:

Plus 100 additional rules tagged ASI06 -- see docs/owasp-agentic-mapping.json for the complete list.

ASI07: Insecure Inter-Agent Communication (23 rules) -- STRONG

OWASP description. Multi-agent systems exchange messages without authentication or integrity guarantees, letting adversaries spoof or replay messages between agents.

ATR coverage shape. A2A message spoofing, agent identity spoofing, consensus sybil attack, cross-agent attack vectors.

Top rules by severity:

Plus 18 additional rules tagged ASI07 -- see docs/owasp-agentic-mapping.json for the complete list.

ASI08: Cascading Failures (52 rules) -- STRONG

OWASP description. A single fault in one agent, tool, or signal propagates system-wide because automated downstream consumers act on it without independent validation.

ATR coverage shape. Runaway agent loop, resource exhaustion, cascading failure detection, model behavior extraction triggering downstream cascade.

Top rules by severity:

Plus 47 additional rules tagged ASI08 -- see docs/owasp-agentic-mapping.json for the complete list.

ASI09: Human-Agent Trust Exploitation (21 rules) -- STRONG

OWASP description. Adversaries exploit anthropomorphism and authority bias so humans approve harmful agent actions they would otherwise reject.

ATR coverage shape. Human trust exploitation, approval fatigue, social engineering via agent, unauthorized financial action, high-risk tool gate bypass.

Top rules by severity:

Plus 16 additional rules tagged ASI09 -- see docs/owasp-agentic-mapping.json for the complete list.

ASI10: Rogue Agents (8 rules) -- STRONG

OWASP description. Agents deviate from their intended function, optionally collude with other agents, and operate as autonomous threats. Canonical instance: Replit meltdown.

ATR coverage shape. Goal hijacking, cross-agent privilege escalation, runaway loop, scope creep, delayed execution bypass, polymorphic behavior.

Reference attack (Replit meltdown). Covered by the rules below; ATR's general-purpose detection layers match the technique signature without needing an attack-specific rule.

Top rules by severity:

Plus 3 additional rules tagged ASI10 -- see docs/owasp-agentic-mapping.json for the complete list.

Methodology

Each YAML file under rules/ is scanned for OWASP Agentic Top 10 tags in two locations:

1. references.owasp_agentic -- string list of bare ids (e.g. "ASI01:2026")
2. compliance.owasp_agentic[].id -- structured form (e.g. id: ASI01:2026)

Bucketing is done on the ASI[0-9]{2} prefix to absorb legacy taxonomy suffixes. A rule mapping to multiple ASI categories counts in each. Strength tiers: STRONG >= 8 · MODERATE 4-7 · LIMITED 1-3.

Regenerate with:

npx tsx scripts/generate-owasp-mapping.ts

Outputs docs/OWASP-AGENTIC-MAPPING.md (this file) and docs/owasp-agentic-mapping.json (programmatic consumption).

Reciprocal mappings

• MITRE ATLAS -- see per-rule mitre_atlas field plus aggregate coverage in COVERAGE.md
• NIST AI RMF -- see per-rule compliance.nist_ai_rmf[] plus the AI RMF OSCAL catalog
• EU AI Act -- per-rule compliance.eu_ai_act[] (Article 9, Article 15)
• ISO/IEC 42001 -- per-rule compliance.iso_42001[]
• OWASP LLM Top 10 (2025) -- per-rule compliance.owasp_llm[]
• SAF-MCP -- see SAFE-MCP-MAPPING.md (reviewed candidate mappings against SAF Framework Model v2)
• OWASP Agentic Skills Top 10 (AST) -- see OWASP-AST10-MAPPING.md (skill supply chain framework)
• OWASP Agentic AI Maturity Model -- see OWASP-AGENTIC-MATURITY-MAPPING.md (which ASI detections substantiate governance maturity)

Contributing

To propose a new mapping or correct an existing one:

1. Open a PR editing the relevant rule under rules/<category>/ATR-2026-NNNNN-*.yaml
2. Add or update the references.owasp_agentic and/or compliance.owasp_agentic block
3. Run npx tsx scripts/generate-owasp-mapping.ts to regenerate this file
4. Include the regenerated docs/OWASP-AGENTIC-MAPPING.md and docs/owasp-agentic-mapping.json in the PR

See CONTRIBUTING.md for the full contribution flow.

References

• OWASP Agentic Top 10 (2026) -- https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/
• OWASP GenAI Security Project -- https://genai.owasp.org/
• Project Chair: John Sotiropoulos -- ASI Co-lead
• Agentic Top 10 Co-leads: Keren Katz, Ron F. Del Rosario
• Project contact: https://genai.owasp.org/contact/
• ATR repository: https://github.com/Agent-Threat-Rule/agent-threat-rules
• ATR npm package: https://www.npmjs.com/package/agent-threat-rules