AITBM

TIER 1 · AGENTIC THREAT TAXONOMY

OWASP Agentic AI Threats and Mitigations to AITBM Mapping

Maps agentic threats and the companion Top 10 to AITBM containment, robustness, privacy, and operational-risk evidence.

Ro-4Cn-1Cn-2Cn-7Ro-3Tr-2Ro-1Cn-5

How to use this crosswalk

External requirements, controls, threats, and practices identify evidence to collect or tests to run. Only measured evidence from the assessed deployment determines AITBM rubric placements, IVP, ORP, ACI, MVT findings, and ERS.

Mapping content last verified 2026-08-13. No endorsement by the external framework owner is implied.

OWASP Agentic AI — Threats and Mitigations

Agentic threat taxonomy

OWASP Agentic AI - Threats and Mitigations v1.1 (T1-T17 taxonomy, December 2025; companion OWASP Top 10 for Agentic Applications 2026, ASI01-ASI10) · OWASP GenAI Security Project - Agentic Security Initiative (ASI)

The OWASP agentic taxonomy enumerates seventeen threats specific to autonomous, tool-calling, memory-bearing, and multi-agent systems. AITBM maps each threat to five-level sub-metric rubrics and the IVP/ORP/ACI architecture. The T1–T15 ERS values below are dated illustrative deployment scenarios retained on their original worked-example basis; T16 and T17 deliberately have no generic score. A current ERS must be derived from the assessed deployment.

Agentic Threat Primary AITBM Sub-Metrics Evidence Use / Notes
T1 Memory PoisoningRo-4Cn-1ERS 7.0 (High)
T3 Privilege CompromiseCn-2Cn-1ERS 7.9 (High)
T4 Resource OverloadCn-7AsAaDirect Cn-7 measurement; prior ERS 5.9 is a historical basis
T5 Cascading Hallucination AttacksRo-3Tr-2ERS 6.6 (Moderate)
T6 Intent Breaking & Goal ManipulationCn-1Ro-1ERS 7.0 (High)
T9 Identity Spoofing & ImpersonationCn-5Cn-2ERS 8.3 (highest in dated T1–T15 scenario set)
T11 Unexpected RCE and Code AttacksCn-1Cn-3ERS 8.1 (High)
T12 Agent Communication PoisoningCn-5Ro-4ERS 7.1 (High)
T13 Rogue Agents in Multi-Agent SystemsCn-5Cn-1ERS 8.2 (second-highest in dated T1–T15 scenario set)
T15 Human ManipulationCn-3Tr-2ERS 5.8 (Moderate)
T16 Insecure Inter-Agent Protocol AbuseCn-5Cn-1Cn-6Deployment-specific; no generic ERS assigned
T17 Supply Chain CompromiseRo-4Tr-4Cn-1Deployment-specific; no generic ERS assigned

Key findings

  • Within the dated T1-T15 illustrative set, T9 Identity Spoofing (8.3), T13 Rogue Agents (8.2), and T11 RCE (8.1) are Containment-dominated, and the top two are Cn-5-led. This is consistent with, but does not independently validate, AITBM's agentic weighting; T16 and T17 remain deployment-specific.
  • Thirteen of the seventeen threats map primarily or secondarily to the Containment axis. This concentration is consistent with AITBM's agentic Containment emphasis, but OWASP does not determine or validate the numeric Cn=0.45 weight.
  • Cascade-and-autonomy threats (T5, T13, T14) map to ORP Aa (Autonomy Amplification) and Cp (Cascade Potential). In the dated identity/RCE scenarios, all four ORP dimensions were elevated, producing CRM 1.60 under the step table.
  • The companion OWASP Top 10 for Agentic Applications 2026 (ASI01-ASI10, released December 9, 2025) is crosswalked to T1-T17. Version 1.1 gives ASI04 a direct T17 supply-chain counterpart and extends ASI07 with T16 protocol abuse; ASI03, ASI07, and ASI10 remain Cn-5-led in this mapping.

OWASP Agentic AI Threats & Mitigations reference →