OWASP Agentic AI Top 10 (2025-2026) — Attestix coverage

The OWASP Top 10 for Agentic Applications 2026 was published by the OWASP GenAI Security Project on 9 December 2025. It names the ten most critical security risks facing autonomous AI agents: ASI01 through ASI10. This page shows how Attestix maps each risk to a concrete, signed evidence shape that an auditor, regulator, or insurer can verify offline.

Why this matters

Plenty of frameworks claim "10/10 coverage" of OWASP lists. Attestix's claim is narrower and (we think) more useful: for every ASI risk, we point at a specific signed artefact — a W3C Verifiable Credential, a hash-chained audit event, or an on-chain anchor — that constitutes evidence relevant to that risk. We do not replace runtime guardrails (NeMo Guardrails, llm-guard, Guardrails AI, promptfoo). We are the forensic substrate that records what those guardrails decided and produces evidence a third party can verify without trusting our infrastructure.

The honest coverage table

OWASP source for every quoted description above: OWASP Top 10 for Agentic Applications 2026.

Tally

• full: 1 (ASI03)
• strong-partial: 6 (ASI01, ASI04, ASI06, ASI07, ASI09, ASI10)
• partial: 1 (ASI02)
• record-only: 2 (ASI05, ASI08)
• out-of-scope: 0

We do not claim "10/10 mitigated". We claim 10/10 mapped to a concrete signed evidence shape. The difference matters — see What we don't do below.

Important caveat — security_check_id ships in v0.5.0. As of Attestix v0.4.0 (May 2026) the underlying events listed above are emitted today, but they are NOT yet tagged with the namespaced security_check_id discriminator. The v0.5.0 release adds the field, the SecurityCheckCredential sidecar VC, and the attestix audit --security-check owasp.asi.ASI<NN> CLI filter. Until then you can already query the underlying events by action and reconstruct the same coverage manually.

What we don't do

The following are intentional non-goals. The most honest section of any security framework is the gap statement.

• No runtime prompt-injection detection. ASI01 (Goal Hijack) is mitigated after the fact by delegation-scope bounding and forensic replay; we do not analyse prompts in real time. Pair Attestix with NeMo Guardrails, Guardrails AI, llm-guard, or promptfoo for the runtime layer and let Attestix sign the evidence those tools produce.
• No code sandbox. ASI05 (Code Execution) is record-only because executing code safely is the host runtime's job (Docker, gVisor, Firecracker, language-level sandboxes). We record what was executed, by whom, and when — so post-incident forensics can attribute responsibility — but we do not block the call.
• No real-time cascade detection. ASI08 (Cascading Failures) is observability (Datadog, Honeycomb, OpenTelemetry traces); cascade evidence is compliance (us). Operators detect cascades via their existing monitoring; Attestix produces the bundle export that reconstructs which agent touched what in what order.
• No hallucination detector. We do not score the truthfulness of LLM output. We sign what the agent did; downstream forensics catches drift against the declared intended_purpose.
• No assertion-to-verification promotion. Per the v0.5 anti-compliance-theater design: when a human asserts "yes, the residual risk is acceptable" or "yes, accuracy metrics are documented", the result transitions to the terminal state assertion_recorded (rendered as a blue chip), NOT to passed=true (rendered green). Attestix never claims to have verified the substance of a human assertion.

How to verify our coverage yourself

Python / CLI

# List every audit event tagged with an OWASP ASI risk (v0.5.0+)
attestix audit list --security-check owasp.asi.ASI08

# Verify the chain integrity for an agent's audit log
attestix verify-chain <agent-did>

# Export a bundle including SecurityCheckCredentials (v0.5.0+)
attestix bundle export --include-security-credentials --out my-agent.atxbundle

JavaScript / browser

npm install @vibetensor/attestix

import { verifyCredential } from "@vibetensor/attestix";

const result = await verifyCredential(securityCheckCredentialJson);
// result.valid === true if the Ed25519 signature over the JCS-canonical body
// matches the issuer DID's public key. No network calls; the DID is self-resolving
// (did:key) or fetched once and cached (did:web).

The NPM package is Apache-2.0 licensed, runs in Node 18+ and modern browsers, depends only on @noble/curves, and ships with TypeScript types. A regulator with no Attestix install can verify any Attestix-issued credential by npm install-ing a 68.9 KB package.

On-chain anchor (Base L2 Sepolia testnet)

Tamper-evidence for the chain-of-evidence itself. See the Base L2 testnet anchor walkthrough.

attestix anchor audit-batch --agent <did> --network base-sepolia

Mainnet schema registration is planned; testnet is the default target today.

Comparable disclosure

How other tools position themselves on agentic-AI security. We name approaches we found through public documentation; we do not disparage and we welcome corrections.

See also

• EU AI Act compliance guide — how Attestix evidences high-risk system obligations.
• Offline verification walkthrough — verify any Attestix VC without network access.
• Base L2 testnet anchor walkthrough — pin evidence to a public chain.
• The internal mapping spec (proposal for v0.5.0) at attestix-cloud-plan/22-OWASP-AGENTIC-TOP10-MAPPING.md — engineering-grade detail on the security_check_id field, SecurityCheckCredential shape, and per-row PR plan.