OWASP Agentic Top 10

The OWASP Agentic Top 10, with evidence for each one.

Every risk from ASI01 to ASI10, the Proofable control that answers it, and the test result behind it. This maps tested behaviour to each control. It is not a certification, a conformance assessment or a compliance opinion.

All benchmarks Read the framework

Each risk, the control that answers it, and the test behind it.

ASI01
Agent Goal Hijack
Partial
Every tool call is checked against the owner’s permission, so a hijacked goal cannot act outside it
AgentDojo: injections that got through fell from 16.4% to 6.2%
ASI02
Tool Misuse and Exploitation
Evidence
Scoped permission per agent, checked before the tool runs
8 of 8 live permission tests; 0 of 6 data-theft attempts got out
ASI03
Identity and Privilege Abuse
Evidence
Each agent has an owner and its own permissions; revoked, expired and reused access is refused
5 of 5 out-of-permission, revoked, expired and reused cases stopped before they ran
ASI04
Agentic Supply Chain Vulnerabilities
Not covered
Not addressed by these tests
None published
ASI05
Unexpected Code Execution
Not covered
Not addressed by these tests
None published
ASI06
Memory and Context Poisoning
Partial
Memory knows who each fact belongs to and whether it is still current, so outdated and other people’s facts stay out
PrecisionMemBench 77 of 77
ASI07
Insecure Inter-Agent Communication
Evidence
Every handoff carries a tamper-proof receipt the next agent checks
150 of 150 forged records and 3 of 3 tampered handoffs caught
ASI08
Cascading Failures
Partial
One revoke stops the running job and refuses the next
Running job stopped 18 seconds after revoke
ASI09
Human-Agent Trust Exploitation
Partial
Actions that need a yes wait for one; a late yes is refused
2 of 2 approval cases held as set
ASI10
Rogue Agents
Evidence
Revoking access stops a running job, with the reason recorded
Revoked mid-job: stopped in 18 seconds, next dispatch refused

Control	What Proofable does	Tested result	Status
ASI01Agent Goal Hijack	Every tool call is checked against the owner’s permission, so a hijacked goal cannot act outside it	AgentDojo: injections that got through fell from 16.4% to 6.2%	Partial
ASI02Tool Misuse and Exploitation	Scoped permission per agent, checked before the tool runs	8 of 8 live permission tests; 0 of 6 data-theft attempts got out	Evidence
ASI03Identity and Privilege Abuse	Each agent has an owner and its own permissions; revoked, expired and reused access is refused	5 of 5 out-of-permission, revoked, expired and reused cases stopped before they ran	Evidence
ASI04Agentic Supply Chain Vulnerabilities	Not addressed by these tests	None published	Not covered
ASI05Unexpected Code Execution	Not addressed by these tests	None published	Not covered
ASI06Memory and Context Poisoning	Memory knows who each fact belongs to and whether it is still current, so outdated and other people’s facts stay out	PrecisionMemBench 77 of 77	Partial
ASI07Insecure Inter-Agent Communication	Every handoff carries a tamper-proof receipt the next agent checks	150 of 150 forged records and 3 of 3 tampered handoffs caught	Evidence
ASI08Cascading Failures	One revoke stops the running job and refuses the next	Running job stopped 18 seconds after revoke	Partial
ASI09Human-Agent Trust Exploitation	Actions that need a yes wait for one; a late yes is refused	2 of 2 approval cases held as set	Partial
ASI10Rogue Agents	Revoking access stops a running job, with the reason recorded	Revoked mid-job: stopped in 18 seconds, next dispatch refused	Evidence

Questions

Is Proofable OWASP certified?

No. OWASP does not certify products. This maps tested behaviour to each control. It is not a certification, a conformance assessment or a compliance opinion.

Which risks does Proofable not cover?

ASI04, agentic supply chain, and ASI05, unexpected code execution, are not addressed by these tests. Four more are partial and say why.

Can I check the evidence?

Yes. Every permission test left a receipt anyone can check offline, and the AgentGovBench, AgentDojo and forgery runs are public with their scripts.

Records an auditor can check.

Connect an agent. Every decision leaves a tamper-proof receipt you keep and anyone can check offline.

Start free