Mappings to all 10 ASI risks: ASI01–ASI10.

Part of the AI IR Overlay™ framework. See CONTENT_MAP.md for the full repository map.

---

Crosswalk: AI IR Overlay ↔ OWASP Top 10 for Agentic Applications 2026

OWASP’s Agentic Top 10 (released December 2025 by the OWASP GenAI Security Project) is the most current ranking of risks specific to autonomous and agentic AI. The 10 risks (ASI01–ASI10) cover goal hijacking, tool misuse, identity abuse, supply chain, code execution, memory poisoning, inter-agent communication, cascading failures, human-agent trust, and rogue behavior.

The AI IR Overlay provides the operational machinery (inventory, staged containment, evidence preservation, controlled recovery) for responding to incidents in each ASI category. OWASP categorizes what can go wrong. The AI IR Overlay specifies how to detect, contain, prove, and recover when it does.

At a Glance

ASI Risk	Primary AI IR Overlay Controls	Most Relevant Artifacts
ASI01 Agent Goal Hijack	MVO-3 Evidence + Triage Q1	Prompt/response logs (A) · config snapshot (E)
ASI02 Tool Misuse & Exploitation	MVO-1 Inventory + MVO-2 Safe Modes (M3) + Triage Q1, Q5	Agent Privilege Matrix · tool-call ledger (B)
ASI03 Identity & Privilege Abuse	MVO-1 Inventory + Triage Q3	AI-BOM identity section · SaaS audit logs (F)
ASI04 Agentic Supply Chain Compromise	MVO-1 Inventory + MVO-3 Evidence	AI-BOM model + retrieval sections · config snapshot (E)
ASI05 Unexpected Code Execution	MVO-2 Safe Modes (M4) + Triage Q1, Q5	Tool-call ledger (B) · Kill-Switch M4
ASI06 Memory & Context Poisoning	MVO-1 Inventory + MVO-3 Evidence + Mental Model	Memory snapshot (D) · retrieval traces (C)
ASI07 Insecure Inter-Agent Communication	MVO-1 Inventory + MVO-3 Evidence	AI-BOM tools section · tool-call ledger (B)
ASI08 Cascading Agent Failures	MVO-2 Safe Modes (M3 + M4) + MVO-4 Controlled Re-Enable	Kill-Switch ladder · staged recovery sequence
ASI09 Human-Agent Trust Exploitation	Mental Model + Maturity Roadmap	Operating cadence · drill design
ASI10 Rogue Agents	MVO-2 Safe Modes (M4) + MVO-3 Evidence	Full A–F evidence set · Kill-Switch M4

Detailed Mappings

ASI01: Agent Goal Hijack

Threat: Prompt injection, indirect prompt injection, or context manipulation that causes the agent to pursue an attacker’s goal instead of the user’s.

AI IR Overlay response:

• MVO-3 Minimum Evidence Set, type A (Prompt/Response Record) is the primary forensic artifact. It captures the injected payload, the resulting plan, and the deviation from intended behavior.
• MVO-3, type E (Configuration Snapshot) captures the system prompt and guardrails in effect at the time of hijack. Essential to prove the agent’s intended scope.
• Six Triage Questions Q1 (“What tools can the agent call?”) scopes the blast radius of the hijacked plan before containment.

Operational priority: Preserve A and E before rotating the system prompt or retraining. The rush-to-fix often destroys the evidence needed to prove what the agent was instructed to do.

ASI02: Tool Misuse & Exploitation

Threat: The agent invokes legitimate tools in unintended ways (e.g., sending mass emails, deleting records, triggering financial actions) due to malicious instruction or buggy planning.

AI IR Overlay response:

• MVO-1 Inventory. The Agent Privilege Matrix (T0/T1/T2 tiering) is the pre-incident control. Every tool is pre-classified by risk so containment can be surgical, not binary.
• MVO-2 Safe Modes, Mode M3 (Tool Tiering). The operational mechanism. Disable T2 tools, keep T0/T1, business continues.
• MVO-3, type B (Tool-Call Ledger). Captures both attempted and successful calls. Denied calls are evidence of intent.
• Triage Q1 + Q5. First-hour discipline matches threat to least-disruptive safe mode.

Operational priority: Pre-tier tools (see the Agent Privilege Matrix and its README). Without this, M3 can’t execute under pressure. The pre-incident discipline is operationalized in Playbook 04: Tool Design Is Containment.

ASI03: Identity & Privilege Abuse

Threat: The agent’s service account, delegated OAuth grant, or impersonation token has more privilege than its task requires, and that excess is exploited.

AI IR Overlay response:

• MVO-1 Inventory. AI-BOM’s identity section is the authoritative record: principal, scopes, rotation cadence. Reviewed in PAM cadence per the Mental Model clause “if it can act, govern it as a privileged identity.”
• Triage Q3 (“What identity does it run as?”) immediately scopes downstream audit trails and accountability.
• MVO-3, type F (Identity and SaaS Audit-Log Correlation). The downstream evidence proving what the identity touched, with which target systems.

Operational priority: AI-BOM identity section must include scopes and rotation cadence. Otherwise audit becomes guesswork.

ASI04: Agentic Supply Chain Compromise

Threat: Compromised models, retrieval corpora, tool definitions, or middleware libraries inject malicious behavior upstream of any individual agent.

AI IR Overlay response:

• MVO-1 Inventory. AI-BOM’s model (provider, model ID, version pinning, fallback) and retrieval (corpora, URIs, sensitivities, refresh cadences) sections are the supply-chain manifest.
• MVO-3, type E (Configuration Snapshot). Captures tool definitions and retriever settings at incident time, enabling supply-chain forensics.
• Mental Model clause 3 (“if it can retrieve, protect it as a production system”): corpora updates are change-control events, tracked in CMDB.

Coverage qualification (v0.33.0): ASI04 framing in this crosswalk covers compromised models, retrieval corpora, tool definitions, and middleware libraries injected upstream of an agent. It does NOT yet cover model extraction / weight exfiltration (an outbound supply-chain failure where the adopter’s own model weights or fine-tunes are stolen from the deployment). Model-IP-exfiltration is a distinct response surface from upstream-injection ASI04 and is a v1.1 candidate (see CHANGELOG.md [Unreleased] v1.1 backlog).

Operational priority: Pin model versions in AI-BOM and treat corpus refreshes as production deployments.

ASI05: Unexpected Code Execution

Threat: The agent triggers execution of arbitrary code via tools like code interpreters, shell tools, or sandboxes, beyond what the user or operator intended.

AI IR Overlay response:

• MVO-2 Safe Modes, Mode M4 (Full Disable). When code execution is the harm vector, M4 is appropriate. The cost of staged containment exceeds the cost of stopping execution.
• MVO-3, type B (Tool-Call Ledger). Must capture every code-execution invocation with parameters and results, with retention long enough for forensics.
• Triage Q1 + Q5. Q1 lists the code-execution tools, Q5 confirms M4 is the right response.

Operational priority: Code-execution tools are Tier-T2 by default in the Privilege Matrix. Require approvals (M2) at minimum, disable on suspicion.

ASI06: Memory & Context Poisoning

Threat: Adversarial content persisted in agent memory (per-user or shared) or injected into retrieved context causes downstream actions to be poisoned across sessions.

AI IR Overlay response:

• MVO-1 Inventory. AI-BOM’s memory section (scope: off / per-user / shared, retention, classification) and retrieval section are the inventory artifacts.
• Mental Model clause 2 (“if it can remember, treat it as a data store”): memory falls under SOC 2, HIPAA, GDPR, and PCI assessments.
• MVO-3, type D (Memory Snapshot). Captures persistent context at incident time. Without it, you can’t prove cross-session bleed.
• MVO-3, type C (Retrieval Traces). Captures what the agent retrieved, from which corpus, at which version, with what scores. Without this, the input vector is unprovable.

Operational priority: If memory is scope: shared, treat memory bleed across users as its own incident class. Capture D before cleaning or rotating memory.

ASI07: Insecure Inter-Agent Communication

Threat: Agents communicating via standardized protocols (e.g., MCP) trust each other’s outputs without verification, propagating attacks across an agent mesh.

AI IR Overlay response:

• MVO-1 Inventory. AI-BOM’s tools section must capture inter-agent connectors and the agents on the other end (treat them as external systems). The agent-dependency graph specified in Playbook 08 lives here.
• MVO-3, type B (Tool-Call Ledger). Captures messages exchanged across agents, with parameters and results. Each cross-agent message carries a trace ID per Playbook 08.
• Mental Model clause 4 (“if it can change, manage it as software”): inter-agent protocols are infrastructure, so deployment requires review.

Operational priority: Each inter-agent connector counts as a distinct tool in the Privilege Matrix and must be tier-classified. The full operational response (structured handoff contracts, bounded delegation at 2 hops, orchestrator-first containment, cascade-isolation gates) is specified in Playbook 08: Multi-Agent Systems Multiply Blast Radius.

ASI08: Cascading Agent Failures

Threat: One failing or compromised agent triggers a cascade of failures across other agents that depend on its outputs, magnifying the blast radius.

AI IR Overlay response:

• MVO-2 Safe Modes, Modes M3 + M4 plus orchestrator-first containment. Playbook 08 specifies the orchestrator-first sequence: stop the orchestrator before the originating agent to halt further delegation system-wide. Cascade propagation typically runs 5 to 30 seconds, so the framework’s containment latency requirement is sub-60-second automation per Playbook 11.
• MVO-4 Controlled Re-Enable. Staged recovery is mandatory to prevent re-triggering the cascade during restoration. The dependency-graph re-enablement order specified in Playbook 08 re-enables agents from the leaves of the dependency graph inward; the orchestrator is the last component re-enabled.
• Maturity Roadmap Level 4 (Resilient). Quarterly tabletops should include a cross-agent failure scenario.

Operational priority: Inventory must capture inter-agent dependencies (which agents depend on which). Playbook 08 specifies the dependency graph as a load-bearing artifact in the AI-BOM.

ASI09: Human-Agent Trust Exploitation

Threat: Humans develop excessive trust in agent outputs and act on bad recommendations (e.g., a finance copilot recommends an urgent payment based on a poisoned invoice).

AI IR Overlay response:

• Mental Model. The four-clause discipline is the operator-level countermeasure. Every agent output is a recommendation, not an order. Human review remains the control of last resort for high-impact actions.
• MVO-2 Safe Modes, Mode M2 (Approvals Required). Pre-positioned two-person rule for high-impact actions (financial, external-facing).
• Maturity Roadmap Level 4 (Resilient). Quarterly tabletops should include a trust-exploitation scenario where the agent’s recommendation is subtly wrong.

Operational priority: Drills should include both agent is wrong and user trusts incorrect output scenarios. Without operator training, the technical controls have a human-shaped hole.

ASI10: Rogue Agents

Threat: An agent’s behavior drifts from its intended function due to reward hacking, goal drift, or collusion with other agents. The drift goes undetected until material harm occurs.

AI IR Overlay response:

• MVO-2 Safe Modes, Mode M4 (Full Disable). Once rogue behavior is confirmed, full disable preserves the state for forensics.
• MVO-3 Minimum Evidence Set (full A–F). Rogue-agent investigations are often complex and benefit from the entire evidence set, not just one type.
• Maturity Roadmap Level 3 (Provable). The ability to export the full A–F set within 60 minutes is the precondition for proving what a rogue agent did.

Operational priority: Define drift detection criteria pre-incident. A “rogue” determination is a category jump that requires CISO/IC approval, not a Tier-1 SOC call.

How to Use This Crosswalk

When responding to a threat report, security researcher disclosure, or auditor question framed in OWASP ASI terms, this crosswalk provides direct evidence of AI IR Overlay readiness.

Example: “Walk us through how your organization would detect, contain, and recover from an ASI06 Memory & Context Poisoning incident.”

Answer: “Our AI-BOM documents memory scope (per-user vs shared), retention, and sensitivity classification for every agent. Detection sources include Type-A prompt logs and Type-C retrieval traces. Containment uses M3 (Tool Tiering) if a single tool is the carrier, M4 (Full Disable) if memory bleed is confirmed. Pre-containment, we capture Type-D (Memory Snapshot) and Type-C (Retrieval Traces) to preserve the input vector. Recovery follows M5 with corpus version verification before re-enabling memory. Our quarterly tabletops include a memory-poisoning scenario per Level 4 (Resilient) maturity. For the full ASI06 response procedure, see Playbook 03: RAG / Knowledge-Base Forensics.”

Relationship to OWASP Top 10 for LLM Applications

OWASP’s earlier Top 10 for LLM Applications (current version 2025.1) covers single-model risks: prompt injection, training data poisoning, model denial of service, and so on. The Agentic Top 10 is additive. It covers risks that emerge only when LLMs are wired into multi-step plans with tools, memory, and inter-agent protocols.

The AI IR Overlay focuses on agent-class incidents (the Agentic Top 10 territory). For LLM-only incidents in non-agentic systems, traditional application IR plus 800-61 r3 is usually sufficient.

Status

• Mapping completeness: all 10 ASI categories have substantive playbook coverage.
  • ASI01 Agent Goal Hijack: Playbook 01 (general response) and Playbook 06 (workflow-injection variant, the dominant 2026 manifestation).
  • ASI02 Tool Misuse & Exploitation and ASI05 Unexpected Code Execution: Playbook 04 (prevention-side via tool tiering T0/T1/T2). Response-side composition for active code-execution events: Playbook 01 (privileged-identity response) plus M4 Full Disable (active-harm containment) plus Playbook 09 for the output distribution map (Type F evidence for any data exfiltrated by the executed code). A dedicated PB25 response variant for sandbox-escape and RCE-via-tool incidents is a v1.1 candidate.
  • ASI03 Identity & Privilege Abuse: Playbook 07 (credential discipline) and Playbook 21 (discovery boundary that closes the inventory-gap precondition: shadow agents operate with credentials that ASI03 detection cannot evaluate if the agent is not in the inventory).
  • ASI04 Agentic Supply Chain Compromise: Playbook 07 (vendor credential discipline), Playbook 10 (the framework’s dedicated vendor-copilot response playbook), Playbook 19 (the procurement-time discipline that closes the precondition gap by selecting platforms that can support ASI04 response in the first place), and Playbook 21 (vendor-hosted shadow agents are an ASI04 surface that the discovery boundary addresses before they cause an incident).
  • ASI06 Memory & Context Poisoning: Primary response: Playbook 03 (RAG forensics), Playbook 06 (workflow-injection vector), Playbook 11 (detection), and Playbook 22 (change-event forensics when memory or retrieval configuration changes accumulate as drift). Secondary coverage: Playbook 09 (output-side response when memory carries leaked content forward) and Playbook 23 (memory snapshots as payload-class evidence; the redaction-and-tokenization discipline applies).
  • ASI07 Insecure Inter-Agent Communication and ASI08 Cascading Agent Failures: Playbook 08.
  • ASI09 Human-Agent Trust Exploitation: Playbook 24 (governance-side trust posture), Playbook 17 (incident-time trust-preservation discipline: when AI trust is broken by an incident, the 30-minute first-update SLA, the Three-Status Taxonomy, the Stakeholder Communication Matrix, the Template Library, and the Responsible Reframing discipline are the trust-rebuilding machinery that runs alongside the framework’s technical response), Playbook 16 (the operator-training discipline that makes the Mental Model’s accountability framing and the framework’s response disciplines executable under pressure: the 30-Minute Micro-Drill, the Four Core Moves, the two permanent roles, the Curriculum-of-Six, and the monthly cadence with measurable training targets), and Playbook 05 (the executive-decision-making discipline that operationalizes accountable decisions under uncertainty when AI trust is broken: the Executive Decision Packet AI Edition with five sections including the Agent Capability Profile and Provenance Summary, the CIA+T impact framing that elevates Trust to peer status, the 4-hour cadence, the 4/24/72-hour planning horizons, and the Approval Receipt discipline that prevents human approval from degrading into rubber-stamping). Coverage qualification: the framework’s ASI09 coverage is governance-side, response-side, and training-side rather than detection-side. Detection of trust miscalibration (user overreliance on incorrect AI output) and trust-calibration drills are v1.1 candidates.
  • ASI10 Rogue Agents: Playbook 11 (detection signals), Playbook 12 (response and investigation; the matched detection-response pair completing the rogue-agent coverage arc), and Playbook 22 (change-event forensics for the dominant 2026 form of rogue-agent emergence: unintentional drift accumulation through model upgrades, prompt edits, policy tunes, retriever changes, and index rebuilds rather than reward hacking or goal collusion).
• Coverage status: complete through v0.24.0 (content gate complete; all 24 playbooks shipped). The framework’s evolution from v0.10.x baseline to v0.24.0 closure of ASI coverage broke into the following closures (organized by playbook contribution):
  • The two largest ASI gaps from the v0.10.x baseline closed first: ASI04 supply-chain response by Playbook 10 in v0.13.0, and ASI10 rogue-agent response by Playbook 12 in v0.11.0.
  • OWASP Top 10 for LLM Applications 2025.1 LLM02 (Sensitive Information Disclosure) operationalized by Playbook 09: Leakage Without a Breach in v0.15.0 on the output side; Playbook 23: AI Logging and Privacy in a Multi-Stakeholder World in v0.20.0 extends LLM02 coverage to the evidence side (the Three-Layer Logging Model, the redaction-and-tokenization discipline, the multi-stakeholder governance discipline are the operational artifacts).
  • Inventory-gap precondition (made ASI03 Identity & Privilege Abuse and ASI04 Agentic Supply Chain Compromise harder to detect against shadow agents) closed by Playbook 21: Shadow AI in v0.16.0.
  • Procurement-time precondition (determines whether a platform can support ASI04 response at all) closed by Playbook 19: Build vs Buy for Agent Controls in v0.17.0.
  • Change-event precondition (determines whether ASI06 and ASI10 manifestations can be traced to specific deployment events rather than misdiagnosed as external attacks or dismissed as routine variation) closed by Playbook 22: Model and Policy Drift in v0.18.0 (Post-Change Configuration Snapshot, change-pipeline event ledger, Drift Canary pack, layered rollback sequence).
  • Proof-discipline precondition (determines whether the response to any ASI category can be defended in a regulator/legal/board review weeks or months later) closed by Playbook 15: Records, Retention, and Proving What Happened in v0.19.0. PB15 is structurally cross-cutting across all 10 ASI categories: without defensible evidence retention, response disciplines for ASI01 through ASI10 produce findings that cannot survive the review window. PB15 contributes the Two-Tier Retention Standard, the incident-triggered legal-hold mechanism, the chain-of-custody discipline, the tamper-evidence anchor, and the quarterly Reconstructability Test.
  • Privacy-discipline precondition (determines whether the framework’s evidence-capture posture is defensible by all four stakeholder groups: Security, Privacy, Legal, Engineering) closed by Playbook 23: AI Logging and Privacy in a Multi-Stakeholder World in v0.20.0. PB23 is also structurally cross-cutting: without multi-stakeholder governance discipline, the framework’s evidence claims for any ASI category produce either overcollection findings (data-minimization regulations) or undercollection findings (the framework’s own Reconstructability Test). PB23 contributes the Multi-Stakeholder Governance Matrix, the Three-Layer Logging Model, the Forensically Useful standard, and the redaction-and-tokenization discipline.
  • Communication-discipline precondition (determines whether the customer’s response to any ASI category can preserve stakeholder trust through the response window) closed by Playbook 17: Communication Techniques for AI-Involved IR in v0.21.0. PB17 is structurally cross-cutting: without disciplined communication, the framework’s technical response for any ASI category can produce poor stakeholder outcomes regardless of containment performance. PB17 contributes the 30-minute first-update SLA, the Three-Status Taxonomy, the Four-Element Update Standard, the Stakeholder Communication Matrix, the Template Library, and the Responsible Reframing discipline.
  • Training-discipline precondition (determines whether the framework’s response disciplines are executable under operational pressure across all 10 ASI categories) closed by Playbook 16: Training Your Team for AI Incidents in v0.22.0. PB16 is structurally cross-cutting: without trained execution, the framework’s documented disciplines for any ASI category produce poor outcomes regardless of technical soundness. PB16 contributes the 30-Minute Micro-Drill, the Four Core Moves, the two permanent operating roles (Safe Mode Owner and Evidence Owner), the Curriculum-of-Six, the monthly cadence, and the measurable training targets.
  • Executive-decision-making discipline precondition (determines whether the customer’s executive layer can make defensible decisions under uncertainty across all 10 ASI categories) closed by Playbook 05: Executive Decision-Making With AI in the Loop in v0.24.0. PB05 is the content-gate-completing playbook; all 24 playbooks (PB01 through PB24) are now shipped. PB05 contributes the Executive Decision Packet (AI Edition), the CIA+T impact framing, the 4/24/72-hour planning horizons, the Approval Receipt discipline, and the Three Executive Routine Additions.
  • Future framework releases focus on governance maturation (Steering Committee announcement, public-interface freeze, v1.0.0 cut) rather than additional playbook content.
• Validation: unreviewed by OWASP. This is the maintainer’s interpretation, offered in good faith.

Source

• OWASP Top 10 for Agentic Applications 2026 (Agentic Security Initiative), OWASP GenAI Security Project, December 2025. Available at genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/.
• OWASP Top 10 for LLM Applications (2025.1), OWASP Foundation. Available at owasp.org/www-project-top-10-for-large-language-model-applications/.

---

Last revised: 2026-06-29 · Maintainer interpretation, not an OWASP publication.

Source: AI IR Overlay newsletter and framework synthesis, by Jacob Ideji. https://www.linkedin.com/in/jacobideji/