OWASP Top 10 for Agentic Applications: ASI01 to ASI10 mapped

	The risk, in short	How Ares addresses it	Coverage
ASI01 Agent Goal Hijack	Hidden instructions in content turn the agent toward another goal.	Content is inspected on the way in. Whatever the agent now wants, it can only do what the badge allows; the rest is refused at the door and written down.	Partial
ASI02 Tool Misuse and Exploitation	The agent uses a legitimate tool in a harmful way.	Every tool call passes the door. Tools and actions outside the badge for this job are refused.	Yes
ASI03 Identity and Privilege Abuse	Agents inherit, borrow or escalate privileges they should not hold.	Each agent has its own identity. The badge narrows at every handoff, so no agent holds more than the one that called it.	Yes
ASI04 Agentic Supply Chain Vulnerabilities	Third-party agents, tools or cards are compromised or change under you.	Third-party agents pass the same door as yours, under a badge you set. Alerts when a listed agent widens what it asks for are planned.	Partial
ASI05 Unexpected Code Execution	The agent writes or runs code it should not.	Outside Ares. Sandboxing what an agent executes is the agent runtime’s job. Ares governs what the agent may call, not what runs inside it.	Outside Ares
ASI06 Memory and Context Poisoning	Bad data planted in memory or context steers later steps.	The session holds which contexts are valid for this job, so a third party cannot inject one. What the agent keeps in its own memory is outside Ares.	Partial
ASI07 Insecure Inter-Agent Communication	Messages between agents are spoofed, read or tampered with.	Every agent-to-agent call carries a badge the receiving side checks at its door, with inspection both ways. This holds across organisations.	Yes
ASI08 Cascading Failures	One faulty agent’s output spreads through the chain.	Each hop is checked on its own, and the door fails closed. The record shows where a chain went wrong. Retries and resilience in your agents stay yours.	Partial
ASI09 Human-Agent Trust Exploitation	The agent misleads a person into approving something harmful.	Steps over a limit wait for a person, and the request they see is on the record next to their decision. Training the people is yours.	Partial
ASI10 Rogue Agents	An agent acts outside its intended role.	An agent outside its badge is refused at the door. Revoke its badges and it stops; the refusals and the revocation are on the record.	Yes

The risk, in short

How Ares addresses it

Coverage

ASI01 Agent Goal Hijack

Hidden instructions in content turn the agent toward another goal.

Content is inspected on the way in. Whatever the agent now wants, it can only do what the badge allows; the rest is refused at the door and written down.

Partial

ASI02 Tool Misuse and Exploitation

The agent uses a legitimate tool in a harmful way.

Every tool call passes the door. Tools and actions outside the badge for this job are refused.

ASI03 Identity and Privilege Abuse

Agents inherit, borrow or escalate privileges they should not hold.

Each agent has its own identity. The badge narrows at every handoff, so no agent holds more than the one that called it.

ASI04 Agentic Supply Chain Vulnerabilities

Third-party agents, tools or cards are compromised or change under you.

Third-party agents pass the same door as yours, under a badge you set. Alerts when a listed agent widens what it asks for are planned.

Partial

ASI05 Unexpected Code Execution

The agent writes or runs code it should not.

Outside Ares. Sandboxing what an agent executes is the agent runtime’s job. Ares governs what the agent may call, not what runs inside it.

Outside Ares

ASI06 Memory and Context Poisoning

Bad data planted in memory or context steers later steps.

The session holds which contexts are valid for this job, so a third party cannot inject one. What the agent keeps in its own memory is outside Ares.

Partial

ASI07 Insecure Inter-Agent Communication

Messages between agents are spoofed, read or tampered with.

Every agent-to-agent call carries a badge the receiving side checks at its door, with inspection both ways. This holds across organisations.

ASI08 Cascading Failures

One faulty agent’s output spreads through the chain.

Each hop is checked on its own, and the door fails closed. The record shows where a chain went wrong. Retries and resilience in your agents stay yours.

Partial

ASI09 Human-Agent Trust Exploitation

The agent misleads a person into approving something harmful.

Steps over a limit wait for a person, and the request they see is on the record next to their decision. Training the people is yours.

Partial

ASI10 Rogue Agents

An agent acts outside its intended role.

An agent outside its badge is refused at the door. Revoke its badges and it stops; the refusals and the revocation are on the record.

Why some rows say partly

Ares sits at the door between agents, tools and organisations. That makes it strong on privilege, delegation and inter-agent traffic, and the record is the evidence for all of it. It does not sit inside your model or your agent’s runtime, so risks that start and end there need controls there too. In market terms Ares is a policy enforcement point with an audit trail, not a model guardrail.

The ten agentic risks, and which ones we address.

ASI01 to ASI10.

Why some rows say partly

Take the mapping into your threat model.