OWASP Top 10

Built for the OWASP Top 10s for AI agents.

AgentTrail governs what your agents do. Here's an item-by-item map to the OWASP Top 10 for Agentic Applications and the OWASP Top 10 for LLM Applications: where we stop the risk, where we only add visibility, where we don't help, and what's on our roadmap.

See the coverage matrix Read the deep dive

OWASP publishes two lists. The Top 10 for LLM Applications treats the model as a component: the risks of its prompts, outputs, training data, and supply chain. The Top 10 for Agentic Applications (finalized December 2025) treats the model as an actor. Once it can call tools, run commands, and carry memory, a new class of risks appears.

AgentTrail is an observability and action-governance layer, so it is strongest where a risk becomes an action: a command, an install, a secret read, a tool call. It stays candid about the risks that live inside the model or on the wire between agents. We would rather show you the gaps than oversell the coverage.

The coverage matrix

Three coverage levels today, plus what's on the roadmap: Direct enforcement, Partial control or visibility, Out of scope, and a Planned tag on risks our roadmapped inference-governance layer would move toward direct coverage.

Each risk is rated twice. AgentTrail OS is the platform: traces, the audit trail, cost tracking, and the policies your team turns on. AgentTrail Guard is the open-source local guard and its rule library, where each rule has a default action: blocked, held for approval, or flagged (allowed and recorded).

Top 10 for Agentic Applications

OWASP GenAI Security Project · 2026 edition (ASI01-ASI10)

OWASP source ↗

Agent Goal HijackASI01
AgentTrail OS
PartialPlanned
We govern the action a hijacked goal produces; the goal drift is visible in the trace. Detecting the hijack at the input is planned.
AgentTrail Guard
Planned
The rules never see the input that redirected the agent, so the guard does not address goal hijack. It can only stop an action the hijack leads to, and that action is judged like any other. The platform column covers what is visible in the trace.
Tool Misuse and ExploitationASI02
AgentTrail OS
Direct
Every tool and shell call is evaluated before it runs, then blocked, held for approval, or allowed.
AgentTrail Guard
Direct
Every command and file path is matched against the rule library before it runs, then blocked, held for approval or flagged according to each rule's default action.
Identity and Privilege AbuseASI03
AgentTrail OS
Partial
Secret access can be gated with a policy, and every action is attributed in the audit trail. Not an IAM.
AgentTrail Guard
Partial
Privilege escalation is held for approval by default: IAM grants, permission widening, privileged writes and persistence. Reading a credential file is held; most other secret reads are flagged, not held. Not an IAM.
Agentic Supply Chain VulnerabilitiesASI04
AgentTrail OS
Partial
With the starter policy, unreviewed dependency installs are held for approval; MCP and tool activity is visible. Not an SCA scanner.
AgentTrail Guard
Partial
A dependency install is flagged by default (allowed and recorded, not held). Installs from a URL or git reference, a redirected registry, and adding an MCP server are held. Not an SCA scanner.
Unexpected Code ExecutionASI05
AgentTrail OS
Direct
Command execution is gated before it runs, with the check living outside the model.
AgentTrail Guard
Direct
Pipe-to-shell is blocked, and dynamic evaluation and remote runners are held, before the command runs.
Memory and Context PoisoningASI06
AgentTrail OS
Planned
We govern actions, not the contents of the agent's memory store. Validating memory reads and writes is planned.
AgentTrail Guard
PartialPlanned
An edit to the agent's memory store or standing instructions (CLAUDE.md, AGENTS.md, rules files) is held for approval. File tools carry a path, not content, so the guard cannot see what was written. Validating memory contents is planned.
Insecure Inter-Agent CommunicationASI07
AgentTrail OS
Out of scope
Not a transport-security or mutual-auth layer for agent-to-agent traffic.
AgentTrail Guard
Out of scope
Starting another agent from the shell is held, but messages between agents are not inspected or authenticated.
Cascading FailuresASI08
AgentTrail OS
Partial
A held or blocked action is a circuit breaker; runaway consumption is tracked against budgets.
AgentTrail Guard
Out of scope
A rule sees one command at a time, so it cannot count, rate-limit or spot a runaway loop. The guard does not address cascading failures; the platform column covers consumption tracking and budgets.
Human-Agent Trust ExploitationASI09
AgentTrail OS
Partial
Evidence over vibes: DORA, repeat-rate, and backtests; the queue surfaces only flagged actions.
AgentTrail Guard
Partial
Terminal escape sequences that forge what a reviewer sees are flagged. The test-integrity rules cover the agent that turns CI green by deleting or weakening a test: deleting a test file or editing the test configuration is held; skip markers, coverage bypasses and blanket snapshot updates are flagged.
Rogue AgentsASI10
AgentTrail OS
Partial
Built agent-agnostic on OpenTelemetry (Claude Code and Cursor today, more agents on the roadmap), so out-of-bounds actions stay visible and governable.
AgentTrail Guard
Partial
Two packs apply. The agent-context guardrails hold an agent changing what it is: its standing instructions, skills, MCP servers, or another agent's approvals (all ask by default). The test-integrity guardrails hold deleting a test file or editing a test runner's configuration (ask) and flag skip markers, coverage bypasses and bulk suppression (warn). The guard keeps no fleet-wide record of what agents do.

Risk	AgentTrail OS	AgentTrail Guard
Agent Goal Hijack ASI01	PartialPlanned We govern the action a hijacked goal produces; the goal drift is visible in the trace. Detecting the hijack at the input is planned.	Planned The rules never see the input that redirected the agent, so the guard does not address goal hijack. It can only stop an action the hijack leads to, and that action is judged like any other. The platform column covers what is visible in the trace.
Tool Misuse and Exploitation ASI02	Direct Every tool and shell call is evaluated before it runs, then blocked, held for approval, or allowed.	Direct Every command and file path is matched against the rule library before it runs, then blocked, held for approval or flagged according to each rule's default action.
Identity and Privilege Abuse ASI03	Partial Secret access can be gated with a policy, and every action is attributed in the audit trail. Not an IAM.	Partial Privilege escalation is held for approval by default: IAM grants, permission widening, privileged writes and persistence. Reading a credential file is held; most other secret reads are flagged, not held. Not an IAM.
Agentic Supply Chain Vulnerabilities ASI04	Partial With the starter policy, unreviewed dependency installs are held for approval; MCP and tool activity is visible. Not an SCA scanner.	Partial A dependency install is flagged by default (allowed and recorded, not held). Installs from a URL or git reference, a redirected registry, and adding an MCP server are held. Not an SCA scanner.
Unexpected Code Execution ASI05	Direct Command execution is gated before it runs, with the check living outside the model.	Direct Pipe-to-shell is blocked, and dynamic evaluation and remote runners are held, before the command runs.
Memory and Context Poisoning ASI06	Planned We govern actions, not the contents of the agent's memory store. Validating memory reads and writes is planned.	PartialPlanned An edit to the agent's memory store or standing instructions (CLAUDE.md, AGENTS.md, rules files) is held for approval. File tools carry a path, not content, so the guard cannot see what was written. Validating memory contents is planned.
Insecure Inter-Agent Communication ASI07	Out of scope Not a transport-security or mutual-auth layer for agent-to-agent traffic.	Out of scope Starting another agent from the shell is held, but messages between agents are not inspected or authenticated.
Cascading Failures ASI08	Partial A held or blocked action is a circuit breaker; runaway consumption is tracked against budgets.	Out of scope A rule sees one command at a time, so it cannot count, rate-limit or spot a runaway loop. The guard does not address cascading failures; the platform column covers consumption tracking and budgets.
Human-Agent Trust Exploitation ASI09	Partial Evidence over vibes: DORA, repeat-rate, and backtests; the queue surfaces only flagged actions.	Partial Terminal escape sequences that forge what a reviewer sees are flagged. The test-integrity rules cover the agent that turns CI green by deleting or weakening a test: deleting a test file or editing the test configuration is held; skip markers, coverage bypasses and blanket snapshot updates are flagged.
Rogue Agents ASI10	Partial Built agent-agnostic on OpenTelemetry (Claude Code and Cursor today, more agents on the roadmap), so out-of-bounds actions stay visible and governable.	Partial Two packs apply. The agent-context guardrails hold an agent changing what it is: its standing instructions, skills, MCP servers, or another agent's approvals (all ask by default). The test-integrity guardrails hold deleting a test file or editing a test runner's configuration (ask) and flag skip markers, coverage bypasses and bulk suppression (warn). The guard keeps no fleet-wide record of what agents do.

Read the agentic walkthrough

Top 10 for LLM Applications

OWASP GenAI Security Project · 2026 edition (LLM01-LLM10)

OWASP source ↗

Prompt InjectionLLM01
AgentTrail OS
Planned
Not an input firewall today; we gate the action the injection produces, downstream. Prompt-injection detection is planned.
AgentTrail Guard
Planned
The guard does not inspect prompts. It only acts on what an injection makes the agent do next.
Sensitive Information DisclosureLLM02
AgentTrail OS
PartialPlanned
Secret and credential reads can be gated with a policy and are audited. Scanning model output for leaked data is planned.
AgentTrail Guard
PartialPlanned
Hardcoded secrets are blocked, and reading a credential file or sending a secret off the machine is held. Reading a .env file, a secret manager or an environment variable is flagged by default, not held.
Excessive AgencyLLM03
AgentTrail OS
Direct
Constraining agency is the product: warn, hold, or block every consequential action.
AgentTrail Guard
Direct
Every command and file path is checked against the rules, and each rule warns, holds or blocks. Switching another agent's approval step off is held.
Supply ChainLLM04
AgentTrail OS
Partial
With the starter policy, unreviewed installs are held; tool and MCP activity is visible. Not SCA or model provenance.
AgentTrail Guard
Partial
A dependency install is flagged by default (allowed and recorded, not held). Installs from a URL or git reference are held. Not SCA or model provenance.
Data and Model PoisoningLLM05
AgentTrail OS
Out of scope
A training- and retrieval-pipeline problem, upstream of anything we observe.
AgentTrail Guard
Out of scope
No rule addresses training or retrieval data.
Unbounded ConsumptionLLM06
AgentTrail OS
Direct
Per-session cost and token tracking with budgets; denial-of-wallet is visible and cappable.
AgentTrail Guard
Out of scope
A rule sees one command at a time, so it cannot count tokens, rate-limit or cap spend, and the guard has no cost or budget limits. Cost tracking and budgets are in the platform column.
MisinformationLLM07
AgentTrail OS
PartialPlanned
With the starter policy, a hallucinated ('slopsquatted') package install is held as a new dependency. Fact-checking output more broadly is planned.
AgentTrail Guard
PartialPlanned
A package install is flagged by default (allowed and recorded, not held), so a hallucinated name such as a misspelled package is surfaced. Only installs from a URL or git reference are held.
Hidden Context ExposureLLM08
AgentTrail OS
Planned
A model- and app-boundary concern; only used credentials are audited. Detecting context leakage is planned.
AgentTrail Guard
Planned
No rule addresses context leakage at the model boundary.
Vector and Embedding WeaknessesLLM09
AgentTrail OS
Out of scope
Vector-store infrastructure we sit beside, not on top of.
AgentTrail Guard
Out of scope
No rule addresses vector stores or embeddings.
Improper Output HandlingLLM10
AgentTrail OS
Direct
Agent-generated shell and SQL are evaluated against policy before execution.
AgentTrail Guard
Direct
Agent-generated shell is matched before it runs. SQL coverage is destructive DDL only: DROP and TRUNCATE are blocked, but DELETE or UPDATE without a WHERE clause is not matched. Forged terminal output is flagged.

Risk	AgentTrail OS	AgentTrail Guard
Prompt Injection LLM01	Planned Not an input firewall today; we gate the action the injection produces, downstream. Prompt-injection detection is planned.	Planned The guard does not inspect prompts. It only acts on what an injection makes the agent do next.
Sensitive Information Disclosure LLM02	PartialPlanned Secret and credential reads can be gated with a policy and are audited. Scanning model output for leaked data is planned.	PartialPlanned Hardcoded secrets are blocked, and reading a credential file or sending a secret off the machine is held. Reading a .env file, a secret manager or an environment variable is flagged by default, not held.
Excessive Agency LLM03	Direct Constraining agency is the product: warn, hold, or block every consequential action.	Direct Every command and file path is checked against the rules, and each rule warns, holds or blocks. Switching another agent's approval step off is held.
Supply Chain LLM04	Partial With the starter policy, unreviewed installs are held; tool and MCP activity is visible. Not SCA or model provenance.	Partial A dependency install is flagged by default (allowed and recorded, not held). Installs from a URL or git reference are held. Not SCA or model provenance.
Data and Model Poisoning LLM05	Out of scope A training- and retrieval-pipeline problem, upstream of anything we observe.	Out of scope No rule addresses training or retrieval data.
Unbounded Consumption LLM06	Direct Per-session cost and token tracking with budgets; denial-of-wallet is visible and cappable.	Out of scope A rule sees one command at a time, so it cannot count tokens, rate-limit or cap spend, and the guard has no cost or budget limits. Cost tracking and budgets are in the platform column.
Misinformation LLM07	PartialPlanned With the starter policy, a hallucinated ('slopsquatted') package install is held as a new dependency. Fact-checking output more broadly is planned.	PartialPlanned A package install is flagged by default (allowed and recorded, not held), so a hallucinated name such as a misspelled package is surfaced. Only installs from a URL or git reference are held.
Hidden Context Exposure LLM08	Planned A model- and app-boundary concern; only used credentials are audited. Detecting context leakage is planned.	Planned No rule addresses context leakage at the model boundary.
Vector and Embedding Weaknesses LLM09	Out of scope Vector-store infrastructure we sit beside, not on top of.	Out of scope No rule addresses vector stores or embeddings.
Improper Output Handling LLM10	Direct Agent-generated shell and SQL are evaluated against policy before execution.	Direct Agent-generated shell is matched before it runs. SQL coverage is destructive DDL only: DROP and TRUNCATE are blocked, but DELETE or UPDATE without a WHERE clause is not matched. Forged terminal output is flagged.

Read the LLM walkthrough

A Planned tag marks a risk not covered today that the inference-governance layer on our roadmap is designed to address; where a risk already has partial coverage, that level is shown alongside. Risk names reflect the current 2026 OWASP editions and are used for reference; AgentTrail is an independent project and is not affiliated with or endorsed by OWASP.

How the coverage actually works

The direct-coverage items all run through the same loop: observe every action, learn the repeats, govern the risky ones, and prove it worked.

Observe

Capture every agent session as a trace: the actions, tool calls, timing, tokens, and cost. Nothing an agent does happens off the record.

Learn

Auto-detect the failures that repeat across developers and agents, so the risks you enforce come from your own history, not a blank page.

Govern

Turn a pattern into a policy that warns, holds for approval, or blocks the risky action in real time, enforced outside the model.

Measure

Backtest a rule on 30 days of history before enforcing, then watch the repeat rate fall and the avoided risk add up.

Straight answers

Does AgentTrail stop prompt injection?

No, AgentTrail is not an input firewall and does not inspect prompts for injection. It governs the actions an agent takes as a result, so an injected instruction that tries to run a destructive command is blocked or held at the action layer. An unreviewed dependency install or a secret read is flagged by default (allowed and recorded) and can be held for approval with a policy such as the AgentTrail starter policies. Pair it with a dedicated prompt-injection control.

Which OWASP risks does AgentTrail address directly?

Directly: tool misuse and unexpected code execution (ASI02, ASI05), excessive agency (LLM03), and improper output handling of agent-generated code (LLM10). Unbounded consumption (LLM06) is direct on the AgentTrail OS platform, through cost tracking and budgets; AgentTrail Guard does not cover it, because a rule sees one command at a time and cannot cap spend. Rogue-agent visibility across a fleet (ASI10) is partial but strong.

Is AgentTrail tied to one agent vendor?

By design, no: AgentTrail is built on the open OpenTelemetry GenAI standard, so it isn't locked to one vendor. Claude Code and Cursor are both supported today — each with its own setup, and enforcement on Cursor from version 3.21.16 — and others such as Codex are on the roadmap. Governance and the audit trail are built to span your whole agent fleet as that coverage grows.

AgentTrail OS

Govern what your agents do

Walk through this coverage map with the people building AgentTrail, against the agents your team actually runs.

Every tool and shell call checked before it runs
Risky actions blocked or held for approval
Each rule backtested on your history first

AgentTrail OS · For teams

Bring your team. We'll bring the demo.

A walkthrough for engineering teams rolling out AI agents: shared guardrails, approvals, and one record of every session your team runs.

Just you? Skip the call. Install AgentTrail Guard in two commands.