OWASP agentic Top 10 meets MITRE ATLAS: a threat model

OWASP’s Top 10 for Agentic Applications tells defenders what tends to go wrong with agents. MITRE ATLAS describes what attackers actually do to them. Read together, they make a serviceable threat model, provided you remember which one is the checklist and which is the field guide.

Two frameworks with different jobs

The OWASP Top 10 for Agentic Applications for 2026 was released on 9 December 2025 by the OWASP GenAI Security Project. It is a risk list in the familiar OWASP mould: ten categories, each with a description, examples and mitigations, written for the people who build and approve systems. It sits alongside OWASP’s older Top 10 for LLM applications and cross-references it; tool misuse, for instance, is explicitly related to LLM06 Excessive Agency.

MITRE ATLAS is the AI counterpart to ATT&CK: tactics, techniques, mitigations and case studies drawn from real attacks and red-team work. According to its changelog, version 2026.09, released on 14 September 2026, contains 16 tactics, 120 techniques, 88 sub-techniques, 40 mitigations and 73 case studies. It is updated roughly monthly, and the recent updates have been heavily about agents.

The practical difference is this. OWASP tells you what to look for in a design review. ATLAS tells your detection engineers and red team what the adversary’s steps look like, with identifiers you can put in a ticket.

The ten, briefly

The OWASP list, in its own wording, runs: ASI01 Agent Goal Hijack; ASI02 Tool Misuse and Exploitation; ASI03 Identity and Privilege Abuse; ASI04 Agentic Supply Chain Vulnerabilities; ASI05 Unexpected Code Execution (RCE); ASI06 Memory & Context Poisoning; ASI07 Insecure Inter-Agent Communication; ASI08 Cascading Failures; ASI09 Human-Agent Trust Exploitation; and ASI10 Rogue Agents.

Some of its mitigations are pleasingly short. The ASI05 entry includes “Ban eval in production agents” and “Never run as root”. If those two lines were universally observed, several of this month’s agent framework advisories would have been much harder to exploit.

A working map between them

Neither project publishes an official crosswalk at the level below, so treat this as our working mapping rather than gospel. It links each OWASP risk to the ATLAS entries a defender would most likely reach for.

OWASP risk	Closest ATLAS entries
ASI01 Agent Goal Hijack	AML.T0051 LLM Prompt Injection
ASI02 Tool Misuse and Exploitation	AML.T0053 AI Agent Tool Invocation; AML.T0086 Exfiltration via AI Agent Tool Invocation
ASI03 Identity and Privilege Abuse	AML.T0083 Credentials from AI Agent Configuration; AML.T0098 AI Agent Tool Credential Harvesting
ASI04 Agentic Supply Chain Vulnerabilities	AML.T0010 AI Supply Chain Compromise; AML.T0110 AI Agent Tool Poisoning
ASI05 Unexpected Code Execution	AML.T0050 Command and Scripting Interpreter; AML.T0102 Generate Malicious Commands
ASI06 Memory & Context Poisoning	AML.T0080 AI Agent Context Poisoning
ASI07 Insecure Inter-Agent Communication	AML.T0118 Autonomous AI Agent Communication
ASI08 Cascading Failures	No direct equivalent; partly AML.T0034.002 Cost Harvesting: Agentic Resource Consumption
ASI09 Human-Agent Trust Exploitation	AML.T0067 LLM Trusted Output Components Manipulation
ASI10 Rogue Agents	Mitigation side: AML.M0038 AI Agent Scope Drift Detection

Cyber-Threat.net working mapping, 22 October 2026, based on OWASP’s published list and ATLAS v2026.09 data.

The gaps are informative. ASI08 and ASI10 describe systemic or emergent failure rather than a discrete attacker step, which is exactly the kind of thing a technique catalogue struggles to express. That is not a flaw in either framework. It is a reminder that some agent risk is about engineering, not adversaries.

What ATLAS added in August and September

The 2026.08 release of 31 August added two mitigations that read like a summary of every post-incident review of the year. AML.M0037 AI Agent Authority Expansion Controls says such controls “should be implemented outside the AI agent and should not rely solely on system prompts, model alignment, or the agent recognizing that an action is out of scope”. AML.M0038 AI Agent Scope Drift Detection asks defenders to keep checking that an agent’s planned actions still match its authorised objective.

The same release added case study AML.CS0070, based on Unit 42 research. In a recovered session dated 7 May 2026, a threat actor’s Hermes Agent, using DeepSeek as its reasoning engine, tried a public exploit for CVE-2026-33017 against Langflow, found the targets lacked the prerequisites, compared vulnerabilities across ten product families and switched to an n8n chain using CVE-2026-21858 and CVE-2025-68613. None of the autonomous attempts gained access. The visibility came about because the agent, asked to serve files, started an HTTP server in the operator’s home directory. Agents, it seems, are indiscreet for everybody.

The 2026.09 release leans into reconnaissance. New entries include AML.T0133 Discover AI Agent Runtime Capabilities, where an attacker simply asks a deployed agent what tools and permissions it has; AML.T0006.003 Probe AI Agent Trigger Channels, which covers sending crafted inputs to email addresses, webhooks or chat channels to find out which ones wake an agent; and AML.T0132 Misconfigured or Publicly Exposed AI Services. On the defensive side, AML.M0039 AI Honeypots recommends decoy agents and credentials, on the sound principle that nobody legitimate has any reason to talk to them.

Putting them to work

Design review: walk each agent through ASI01 to ASI10. For every “yes, that could happen”, record the control and whether it lives outside the model.
Detection backlog: turn the ATLAS techniques in the table into hunting hypotheses. Tool invocation and exfiltration via tools are the easiest to log; runtime capability discovery shows up as odd, probing conversations in agent transcripts.
Red team scope: cite ATLAS IDs in rules of engagement so findings map cleanly back to the framework, and include trigger-channel probing, which is cheap and frequently overlooked.
Revisit monthly. ATLAS changed substantially twice in a fortnight (31 August and 14 September). A threat model written in the spring is already out of date.

For the defender’s side, our series on AI in the hunt starts with Microsoft’s Project Perception and Codename MDASH. More is in AI Security.