OWASP Agentic Top 10 · ASI01-ASI10
Ten agentic risks.
We measure seven, and name the three we cannot.
Most vendors answer a security framework with ten green ticks. That answer is not credible, and a security reviewer knows it. Here is where Govern360 has real coverage against the OWASP Top 10 for Agentic Applications, where coverage is partial, and where the signal does not exist for anyone reading a management API - including us.
The OWASP Top 10 for Agentic Applications is the first widely-reviewed risk framework aimed at autonomous AI rather than chatbots. It matters because agentic risk is not prompt risk: an agent holds credentials, calls tools, and acts.
Coverage matrix
Status reflects what Govern360 can observe from the platforms it connects to. Where a risk needs a signal that a management API does not expose, it is marked Not observed with the reason - rather than being quietly claimed.
| Code | Risk | Govern360 coverage |
|---|---|---|
| ASI01 | Agent Goal Hijack An agent is steered away from the objective it was approved for. | PartialDetected by comparing an agent against its signed purpose. Undetectable where no purpose has been declared. |
| ASI02 | Tool Misuse and Exploitation An agent's tools are used to reach data or systems beyond intent. | CoveredEvery MCP tool inventoried, pinned by hash, with live vs configured state and consent requirement. Individual tool calls are not observed. |
| ASI03 | Identity and Privilege Abuse An agent acts with more privilege, or less accountability, than intended. | CoveredEach agent tracked as a non-human identity with directory identity and accountable ownership. Delegation chains between agents are not reconstructed. |
| ASI04 | Agentic Supply ChainA tool or component an agent depends on changes underneath it. | CoveredTool definitions pinned by hash at discovery; later changes surface as drift. Pinning proves a definition changed - not that the original was safe. |
| ASI05 | Unexpected Code Execution An agent executes code it was not intended to run. | Not observedRequires runtime instrumentation of the execution environment. Govern360 reads a management API and does not sit in the execution path. |
| ASI06 | Memory and Context Poisoning An agent's memory or retrieved context is corrupted to change behaviour. | Not observedMemory and embedding stores are internal to the agent platform. Knowledge sources are counted; their contents are not inspected. |
| ASI07 | Insecure Inter-Agent Communication One agent calls another over a path nobody reviewed. | PartialAgents configured to call other agents are identified, so the existence of a path is known. The configured link is visible; the traffic is not. |
| ASI08 | Cascading Failures One agent's failure propagates through others. | Not observedEstablishing that one agent failure caused another needs correlated execution traces across platforms. |
| ASI09 | Human-Agent Trust Exploitation Human oversight becomes a rubber stamp. | PartialOversight is measured rather than assumed: approval latency, its trend, and whether denials change policy. Measures the process, not whether a specific human was deceived. |
| ASI10 | Rogue Agents An autonomous agent operates outside anyone's control. | PartialAgents ranked by observed exposure - autonomy tier, live tool reach, absent ownership - and can be demoted or stopped. Detecting one that has already gone rogue needs behavioural telemetry. |
Why we publish the gaps
Three reasons, and none of them are modesty.
A control that reports healthy without a signal behind it is not a control. It is an assurance your risk register will act on and your auditor will eventually test. We show Verified only where a platform read-back confirms live state; otherwise the state is Compiled or Marked applied, and says so.
ASI05, ASI06 and ASI08 need runtime instrumentation, memory-store access, and correlated execution traces. No management-API product can see them - so a competitor claiming full coverage is telling you something about their marketing, not their telemetry.
ASI01 is partial because goal hijack can only be detected against a recorded goal. In a live design-partner estate of 625 agents, zero had a declared purpose - which makes the entire risk undetectable until somebody writes one down. That is a more useful thing to know than a tick. See the Purpose Register.
What "covered" looks like in practice
ASI02 - Tool Misuse
Every MCP tool an agent exposes is inventoried and pinned by hash, separated into live and configured-but-disabled, with whether the tool requires end-user consent. A tool reachable today with no consent step is a different finding from one that is switched off.
ASI03 - Identity and Privilege Abuse
Each agent is enrolled as a non-human identity with a directory identity and an accountable owner across business, technical, data and security roles. Ownership completeness is measured, so "nobody is accountable" becomes a number rather than an impression.
ASI10 - Rogue Agents
Ranked by observed exposure: autonomy tier, live tool reach, tenant-wide sharing, absent ownership - each with a stated reason. In one connected tenant this surfaced two agents at the highest autonomy tier, holding live administrative tool access, with nobody accountable for either.
Coverage is a property of what the connected platforms expose, and improves as more sources are connected. Status shown here reflects the current product against Microsoft Copilot Studio and Power Platform; scores and matrices shown in product materials are labelled Sample / Illustrative. Govern360 is designed to decide and compile policy for planes you already own - it does not proxy your traffic or hold standing write credentials.
Questions
What is the OWASP Top 10 for Agentic Applications?
It is a risk framework covering the ten most significant security risks specific to autonomous AI agents - agents that hold credentials, call tools and take actions - as distinct from the earlier OWASP Top 10 for LLM Applications, which addresses prompt and model risks.
How much of the Agentic Top 10 does Govern360 cover?
Three risks are covered with direct measurement, four are partial where the configured path is visible but runtime behaviour is not, and three are not observed because they require signals a management API does not expose. Each not-observed risk is published with the reason and what would be required to see it.
Why does Govern360 publish gaps instead of claiming full coverage?
Because a control that reports healthy without a signal behind it is not a control - it is a false assurance that a risk committee will act on and an auditor will test. Govern360 shows Verified only where a platform read-back confirms live state.
Which agentic risks can no management-API product detect?
Unexpected code execution, memory and context poisoning, and cascading failures. These need runtime instrumentation of the execution environment, access to internal memory and embedding stores, and correlated execution traces across platforms respectively.