OWASP Top 10 for Agentic Applications 2026 — mapping
OWASP published the Top 10 for Agentic Applications 2026 on 9 December 2025. Each ASI control below maps to Ujex primitives and to the MAESTRO threat model layer.
| ASI | Control | Ujex mitigations | MAESTRO layer |
|---|---|---|---|
| ASI-01 | Goal Hijack | Approvals default-deny on destructive verbs; Rule of Two tagging | L7 |
| ASI-02 | Tool Misuse | Server-side tool policy, server-injected credentials, Budgets inline caps; signed-manifest verifier exists | L4, L5 |
| ASI-03 | Identity & Privilege Abuse | Per-agent device keys; inbox-scoped keys; Cross App Access | L3 |
| ASI-04 | Supply Chain | Package provenance; OSS audit; signed-manifest enforcement planned after compatibility migration | L1, L4 |
| ASI-05 | Unexpected Code Execution | Server-side dispatch, Budgets kill switch, recursion guard; sandboxed MCP dispatch is not default yet | L2 |
| ASI-06 | Memory / Context Poisoning | Memory-write provenance tags; PI score on memory.write; hash-chained audit | L5, L7 |
| ASI-07 | Insecure Inter-Agent Comms | Audit row on every delegation; signed delegation tokens (delegate callable) | L3, L6 |
| ASI-08 | Cascading Failures | Recursion guard (maxSteps); Budgets kill switch; double-text dedup | L2, L6 |
| ASI-09 | Human-Agent Trust Exploitation | PI scoring on inbound mail; lethal-trifecta tag → mandatory Approval | L7 |
| ASI-10 | Rogue Agents | disabled flag + immediate token revoke; chain-recorded disablement | L3 |
Per-control details
ASI-01 Goal Hijack
Approvals subsystem ships a default-deny policy DSL. Verbs declared destructive (drop_*, delete_*, transfer_funds, publish, send_to_new_recipient, escape_to_host) pause the call until a human decides. Session tagging implements Willison's "Agents Rule of Two": if untrusted_input AND sensitive_access AND external_egress are all true, every tool call requires approval regardless of verb.
ASI-02 Tool Misuse
Tool invocation is server-side: signed-manifest registration, policy, Budgets preflight, credential injection, and audit run before dispatch. Legacy broker-token callables fail closed for launch; governed MCP and HTTP calls go through invokeTool.
ASI-06 Memory / Context Poisoning
Every memory.write row carries a trust_level set by the writer. PI scoring runs on inbound mail before the body reaches an agent; mail with pi_score > 0.5 flips the session untrusted_input tag. Read paths can filter by trust_level.
ASI-09 Human-Agent Trust Exploitation
EchoLeak (CVE-2025-32711) is the canonical example. Ujex's inbound-mail pipeline scores the body for prompt injection before any agent reads it. Outbound to a new recipient AND any external-source content read in the same turn flips the lethal-trifecta tag → mandatory Approval.
ASI-10 Rogue Agents
agent.disabled = true instantly fails every callable; the SDK refreshes the auth claim within 60s. The disablement itself is an audit row, providing chain-of-custody evidence.