← AI resource directoryai-safety-provenance-and-audit

ai-safety-provenance-and-audit · prepared

OWASP agentic AI security evidence checklist

Publisher-source guidance for turning OWASP agentic risk references into system-specific threat models, least-privilege controls, approval gates, adversarial tests, and monitored evidence rather than a security badge.

version 1.0.0freshness currentobserved 2026-08-26T15:38:00Z

resource.safety.owasp-agentic-security-evidence
sha256:f59520d39c8a6fcf5251406cf6b5f51890c9b2ab7446b6fa8d62fc3063f1c565

Open canonical machine JSON →

Evidence-backed facts

  1. OWASP describes its Top 10 for Agentic Applications 2026 as a starting point for reducing agentic risk; using the list is not itself a certification or proof that an Agent is secure. informative
  2. Agentic threat modelling should cover reasoning, memory, tools, identity, human oversight, and multi-Agent interactions rather than testing only the language model endpoint. informative
  3. OWASP states that prompt injection can be direct or indirect and has no known fool-proof prevention; mitigations include output validation, least privilege, human approval for high-risk actions, segregation of external content, and adversarial testing. informative
  4. An Agent security claim should identify the relevant threat, implemented control, test case, result, scope, and observation time; a checklist reference without system-specific evidence does not demonstrate control effectiveness. informative