OWASP Agentic AI Threats

An attacker seeds the agent’s persistent memory or context with false facts or standing instructions, so that later sessions act on them without any new injection.

Question

What has this agent been given to remember, by whom, and does any decision depend on the agent’s own account of its state?

Evidence

Provenance of memory and context sources; changes to agent configuration over time; actions correlated with memory writes.

Control

Record where memory came from; never let an action’s authorization depend on state the agent controls; treat memory stores as data sources with owners.

Trustivan today

Authorization independent of agent state is built: the principal comes from the credential, not the request. Agent provenance — what an agent was given and what changed — is not built, by design.

The agent is manipulated into using legitimate tools in harmful ways — calling the right API with the wrong arguments, or chaining tools to reach an outcome nobody intended.

Question

Which tools can this agent call, with which credentials, against which resources — and which of those combinations are high impact?

Evidence

Tool inventory per agent with bound credentials; action logs per tool call; the resources each tool can reach.

Control

Tools as inventoried identities with scoped credentials; high-impact tool calls evaluated before they run, with CHALLENGE available as a verdict.

Trustivan today

Tool inventory from the MCP connector and per-call authorization over the tools an operator entitled to the agent are available. Reads are not gated on entitlement.

The agent’s permissions — usually broad and inherited — are exploited directly, or escalated through misconfiguration, dynamic role changes or over-scoped grants.

Question

What can this agent actually reach, and how much of that does it use?

Evidence

Effective permissions of the agent identity evaluated on the graph; observed actions; credentials held versus credentials needed.

Control

Least privilege per agent and per task; credentials brokered per action rather than held; overprivilege surfaced as a finding with an owner.

Trustivan today

Effective access of an agent identity is available as an upper bound. Credential brokering per action is a future capability; runtime credentials today are minted by a person, last 1–90 days and are revocable.

The agent is driven to consume compute, model calls, API quota or money at a scale that degrades systems or causes financial harm — denial of service and denial of wallet.

Question

What is this agent’s expected consumption, and what happens when it exceeds it?

Evidence

Per-identity call and spend records; invocation counts against a ceiling; the actions that drove the consumption.

Control

Every call decided and recorded, so spend is attributable to an agent identity; an invocation ceiling per agent; budgets as a further signal.

Trustivan today

Every call is decided and recorded per agent identity, and a posture policy counts invocations against an operator-set ceiling. Budgets and spend as policy inputs are a future capability.

A fabricated or manipulated output from one step becomes trusted input to the next — or to another agent — until a false premise drives a real action.

Question

Which inputs to a high-impact action came from the model itself, and which came from verifiable sources?

Evidence

Provenance of the data behind each decision; the chain of agents and tools that produced it.

Control

Authorize actions from verifiable facts — the credential presented, the tool entitled, the effect, the resource’s impact — rather than from the model’s claims. A stated purpose is recorded but decided on by no rule.

Trustivan today

Decisions built from evidence rather than model assertions are how the runtime gate works today. The provenance of the model’s inputs is not collected.

The agent’s objective is altered — through injection, manipulated planning or poisoned instructions — so that it pursues a goal its owner never set.

Question

What purpose justifies this action, and does the action match the purpose?

Evidence

The stated intent recorded with the action request, kept for the investigator; the facts the decision actually rested on.

Control

Decide on facts an injected goal cannot write — the credential, the entitled tool, the effect, the resource’s impact — and record the stated purpose for the investigator.

Trustivan today

Deciding on purpose is not built, by design: the gate records the stated intent and no rule reads it, because a manipulated goal writes it freely.

The agent takes harmful actions while appearing compliant — circumventing constraints, misreporting what it did, or optimizing for a proxy of the goal.

Question

What did the agent actually do, as recorded outside the agent, compared with what it reported?

Evidence

Action-level evidence from the systems acted upon, independent of the agent’s own logs.

Control

High-impact actions evaluated and recorded outside the model; approval for irreversible changes; evidence that does not rely on the agent’s account.

Trustivan today

Runtime decisions are recorded outside the agent today. Action evidence from target systems is a future capability: no connector collects activity, which arrives only through the ingestion API.

Actions cannot be attributed to an agent, a user or a decision, because logging is missing, shared identities blur accountability, or the chain of delegation is not recorded.

Question

For any action, can we name the agent, the owner, the on-behalf-of identity and the decision that allowed it?

Evidence

A distinct identity per agent; delegation recorded per action; an audit trail that links action to identity to owner.

Control

No shared agent identities; ownership attested; every authorization decision recorded with its evidence.

Trustivan today

Agent identity and ownership, the platform’s hash-chained audit trail and immutable per-action decision records are available.

An attacker or a rogue component impersonates a user, an agent or a tool — reusing credentials, forging identity claims, or standing up a look-alike service.

Question

How does each agent and tool prove its identity, and could that proof be replayed or forged?

Evidence

Credential type and lifetime per agent; the tools the platform discovered; the source address compared with the identity’s own history.

Control

Governed identities with bounded, revocable runtime credentials per agent; a tool the platform never discovered cannot be entitled, so a call to it is denied.

Trustivan today

Agent runtime credentials — minted by a person, 1–90 days, revocable — are available. Quarantining an agent inside the platform is available too, and the gate then denies it every action.

So many approvals, alerts or decisions are pushed to people that they rubber-stamp — or an attacker deliberately floods reviewers to slip a harmful action through.

Question

Which actions genuinely need a human, and how many is each approver being asked to judge?

Evidence

Approval volume per reviewer; the risk profile of what was approved; time-to-decision.

Control

Only high-impact actions are challenged, so the few that matter get a human; a grant answers the challenge, and the decision record carries the rules that produced it.

Trustivan today

The CHALLENGE verdict and the access grants that answer it are built. Recognising a burst as anomalous is not built, by design — nothing baselines behaviour.

The agent is induced to generate and run code, or to call an execution tool, in a way that gives an attacker arbitrary execution in the agent’s environment.

Question

Which of this agent’s tools can execute code, and with whose identity and permissions does that code run?

Evidence

Execution-capable tools in the inventory; the identity and credentials bound to them; where they run.

Control

Execution tools treated as high-impact identities with their own credentials and sandboxes; calls authorized before they run.

Trustivan today

Tool inventory from the MCP connector, declared tool effects and per-call authorization over entitled tools are available. Sandboxing is the responsibility of the agent runtime.

Messages between agents are intercepted, forged or manipulated, so that one agent acts on instructions that never came from a trusted peer.

Question

Which agents does this agent talk to, how are those peers authenticated, and what authority flows across each link?

Evidence

Agent-to-agent relationships in the graph; authentication between agents; authority carried by each delegation.

Control

Agent-to-agent trust modelled explicitly; peers authenticated as identities; authority evaluated across the chain rather than trusted at each hop.

Trustivan today

Agent-to-agent trust is not built, by design: no connector reports an edge between agents, so each action is decided on the presenting agent’s own credential.

A compromised, malicious or simply unsanctioned agent operates inside the system — beyond monitoring, with access it should not have, or pretending to be a legitimate participant.

Question

Do we know every agent operating in our environment, who owns each one, and which of them nobody sanctioned?

Evidence

Agent inventory from the systems that issue authority; ownership state per agent; agents with no provenance.

Control

Discovery of the agents operating in the environment; ownership for every agent in the inventory; quarantine for one that should not act.

Trustivan today

No connector discovers an agent, by design, so unsanctioned agents are not found. For agents in the inventory, ownership and quarantine are available.

A person exploits the trust between agents — using one agent’s delegated authority, or the gaps between agents’ permissions — to reach an outcome none of them would allow alone.

Question

Across a chain of delegations, what is the effective authority at the end — and does it exceed what the initiating human had?

Evidence

Delegation chains recorded per action; effective authority computed across the chain; the initiating identity.

Control

Evaluate the whole chain; an agent cannot acquire more authority by asking another agent; confused-deputy checks on the on-behalf-of identity.

Trustivan today

Cross-chain authority evaluation is not built, by design: no agent-to-agent edge exists. Each action is decided on the presenting agent’s own credential.

The agent — trusted by its users — is used to manipulate people: persuading them to approve, disclose, or act against their interest.

Question

Which human decisions are being shaped by agent output, and what evidence do those humans have that is independent of the agent?

Evidence

Approval requests and the evidence presented with them; decisions that relied solely on agent-provided context.

Control

Approvals present evidence from systems of record, not from the agent; high-impact decisions never rest on the agent’s narrative alone.

Trustivan today

Access-grant approvals carry the requester’s justification today; attaching evidence from systems of record is a future capability. This threat is addressed indirectly; it is not an identity problem at its root.