Mapping 10 agentic application risks to 20 SWT3 witness procedures. Independent evidence for every attack surface.
Who this is for: Security architects, AI platform engineers, red team operators, and compliance officers deploying agentic AI systems.
The OWASP Top 10 for Agentic Applications was published in December 2025 by the OWASP Foundation. It identifies the ten most critical security risks specific to autonomous AI agents, systems that plan, use tools, communicate with other agents, and take actions with limited human oversight.
This list is distinct from the earlier OWASP Top 10 for LLM Applications, which focused on risks at the model layer (prompt injection, training data poisoning, model denial of service). The Agentic Top 10 addresses risks that emerge when models are embedded in systems that act on the world: goal hijacking, tool misuse, privilege escalation, cascading failures across agent networks, and rogue agent behavior.
SWT3 does not prevent these attacks. It creates an independent, tamper-evident record that governance controls were applied and what the outcome was. When an incident occurs, the witness trail provides forensic evidence of every tool call, access decision, identity assertion, and agent-to-agent handoff, independent of the application's own logs.
Coverage summary: 20 SWT3 procedures map to the 10 OWASP Agentic risks. Every risk is covered by at least two procedures. Seven procedures appear in three or more risk mappings, reflecting the interconnected nature of agentic attack surfaces.
Each OWASP Agentic risk maps to the SWT3 procedures that produce relevant evidence. Primary procedures provide direct coverage. Supporting procedures provide context or corroborating evidence.
| OWASP ID | Risk Name | SWT3 Procedures |
|---|---|---|
| ASI01 | Agent Goal Hijacking | AI-ID.1, AI-TOOL.2, AI-GRD.1, AI-GRD.2, AI-GRD.3 |
| ASI02 | Tool Misuse | AI-ACC.1, AI-TOOL.1, AI-TOOL.2, AI-GRD.3 |
| ASI03 | Identity and Privilege Abuse | AI-ID.1, AI-ACC.1, AI-GRD.1, AI-GRD.2, AI-SEC.1 |
| ASI04 | Agentic Supply Chain Vulnerabilities | AI-TOOL.1, AI-SEC.1, AI-MDL.1, AI-MDL.5, AI-SKILL.1 |
| ASI05 | Unexpected Code Execution | AI-TOOL.1, AI-GRD.1, AI-GRD.3, AI-SEC.1 |
| ASI06 | Memory and Context Poisoning | AI-GRD.3, AI-RAG.1, AI-MULTI.1, AI-DATA.1, AI-A2A.1 |
| ASI07 | Insecure Inter-Agent Communication | AI-ID.1, AI-ACC.1, AI-TRUST.1, AI-TRUST.2, AI-MULTI.1, AI-A2A.1, AI-A2A.2 |
| ASI08 | Cascading Failures | AI-CHAIN.1, AI-MULTI.1 |
| ASI09 | Human-Agent Trust Exploitation | AI-TRUST.1, AI-CHAIN.1, AI-A2A.2 |
| ASI10 | Rogue Agents | AI-MDL.1, AI-SKILL.1, AI-RAG.1, AI-DRIFT.1, AI-DATA.1 |
Risk description: An attacker crafts inputs (prompts, tool responses, environment variables) that redirect the agent's planning toward an adversarial objective. The agent believes it is pursuing its original goal while actually executing the attacker's intent. This is distinct from prompt injection because it targets the agent's planning and reasoning layer, not just its immediate output.
SWT3 procedures:
AI-ID.1 - Agent Identity: Records the agent's identity assertion at each inference. If the agent's behavior changes, the identity trail shows when the deviation began.AI-TOOL.2 - Tool Permission: Records which tools the agent was authorized to use. Goal hijacking often manifests as the agent invoking tools outside its permitted scope.AI-GRD.1 - Guardrail Enforcement: Records whether guardrails were active and whether outputs passed or failed guardrail checks. A hijacked agent may trigger guardrail violations.AI-GRD.2 - Output Filtering: Records output filtering decisions. Hijacked goals often produce outputs that deviate from expected patterns.AI-GRD.3 - Input Validation: Records input validation results. Poisoned inputs that trigger goal hijacking should produce validation anchors showing what was accepted.Query AI-GRD.3 anchors for the time window around suspected hijacking. Compare the input validation results against AI-TOOL.2 permission records. If the agent invoked tools outside its permitted scope after accepting a specific input, the correlation between those two anchor streams is forensic evidence of a goal hijacking event.
Risk description: The agent uses its tools in unintended ways: calling a database query tool to exfiltrate data, using a file write tool to overwrite configuration, or chaining tool calls to achieve an effect that no single tool was designed to permit. Tool misuse can be intentional (via hijacking) or emergent (the agent discovers tool combinations that bypass constraints).
SWT3 procedures:
AI-ACC.1 - Access Control: Records every access decision. Tool misuse often requires accessing resources beyond the agent's authorized scope.AI-TOOL.1 - Tool Witnessing: Records every tool invocation with arguments hash and result hash. The complete tool call history reveals misuse patterns.AI-TOOL.2 - Tool Permission: Records the permission boundary. Misuse is defined relative to what was authorized.AI-GRD.3 - Input Validation: Records validation of inputs passed to tools. Malformed or unexpected arguments should trigger validation findings.Compare the AI-TOOL.1 invocation history against the AI-TOOL.2 permission manifest. Any tool call that falls outside the defined permission scope is a finding. Pay special attention to tool call chains where individual calls are within scope but the combined effect exceeds authorization.
Risk description: The agent operates with credentials or permissions that exceed what its current task requires. An attacker exploits these excessive privileges to access sensitive resources, modify configurations, or impersonate the agent to downstream systems. In multi-agent architectures, one agent may inherit or assume the identity of another without proper delegation.
SWT3 procedures:
AI-ID.1 - Agent Identity: Records the agent's identity at each inference. Identity changes or impersonation attempts are visible in the anchor trail.AI-ACC.1 - Access Control: Records access decisions with the identity context. Privilege escalation produces access anchors showing expanded scope.AI-GRD.1 - Guardrail Enforcement: Records guardrail status. Privilege abuse may bypass guardrails or trigger guardrail failures.AI-GRD.2 - Output Filtering: Records output filtering tied to identity context. Different privilege levels should produce different filtering behavior.AI-SEC.1 - Security Controls: Records the security posture of the agent's environment. Misconfigurations that enable privilege escalation are visible.Cross-reference AI-ID.1 identity anchors with AI-ACC.1 access decisions. If an agent's access scope expands without a corresponding identity change or authorization event, that gap is a finding. For multi-agent systems, verify that AI-ID.1 anchors exist for every agent in the communication chain.
Risk description: Agents depend on external components: model weights from registries, tools from MCP servers, plugins from marketplaces, and frameworks from package managers. Each dependency is a trust boundary. A compromised tool server, backdoored model, or malicious plugin can turn the agent into an attack vector without any change to the agent's own code.
SWT3 procedures:
AI-TOOL.1 - Tool Witnessing: Records tool invocations including the tool source. Compromised tools produce anchors that can be correlated with incident timelines.AI-SEC.1 - Security Controls: Records the security posture of the agent's dependencies and environment.AI-MDL.1 - Model Card: Records model metadata, version, and provenance. A changed model in the supply chain produces a hash mismatch.AI-MDL.5 - Model Weights: Records cryptographic hashes of model weight files. Any modification to weights between deployments is detectable.AI-SKILL.1 - Skill Manifest: Records the agent's declared capabilities. Supply chain attacks that add or modify capabilities are visible as manifest changes.Request AI-MDL.5 weight hashes from two consecutive assessments. Any delta requires explanation. For tool supply chain risks, verify that AI-TOOL.1 anchors include tool source identifiers and that the organization maintains a known-good tool registry for comparison.
Risk description: The agent generates or retrieves code and executes it, whether through a code interpreter tool, a sandboxed environment, or a direct system call. If the sandbox boundary fails or the agent bypasses execution constraints, arbitrary code runs with the agent's privileges. This risk is amplified when the agent has access to production credentials or network resources.
SWT3 procedures:
AI-TOOL.1 - Tool Witnessing: Records every tool invocation, including code execution tools. The arguments hash captures what code was submitted for execution.AI-GRD.1 - Guardrail Enforcement: Records whether execution guardrails (sandboxing, code review gates) were active and their verdict.AI-GRD.3 - Input Validation: Records validation of code inputs before execution. Malicious code payloads should trigger validation findings.AI-SEC.1 - Security Controls: Records the security boundary configuration, including sandbox status and isolation enforcement.For agents with code execution capability, verify that AI-TOOL.1 anchors exist for every execution event. Cross-reference with AI-GRD.1 to confirm guardrails were active during each execution. Any execution event without a corresponding guardrail anchor is a finding that indicates the sandbox boundary may not have been enforced.
Risk description: Agents that use persistent memory, retrieval-augmented generation (RAG), or shared context stores are vulnerable to poisoning. An attacker injects malicious content into the memory or retrieval corpus, causing the agent to incorporate that content into future reasoning. Unlike prompt injection, memory poisoning persists across sessions and can affect multiple agents that share the same context store.
SWT3 procedures:
AI-GRD.3 - Input Validation: Records validation of inputs retrieved from memory or context stores before they are used in reasoning.AI-RAG.1 - RAG Provenance: Records the provenance of retrieved documents, including source, relevance score, and retrieval timestamp. Poisoned documents are traceable.AI-MULTI.1 - Multi-Agent: Records shared context exchanges between agents. Poisoning that propagates through shared memory is visible in the exchange trail.AI-DATA.1 - Data Provenance: Records the lineage of data used in agent decisions. Poisoned data sources are identifiable through provenance records.AI-A2A.1 - Agent-to-Agent Auth: Records authentication events for inter-agent context sharing. Unauthorized writes to shared memory produce auth findings.Query AI-RAG.1 anchors for retrieval events that preceded anomalous agent behavior. If a poisoned document was retrieved, the provenance anchor identifies the source and timestamp. For shared memory architectures, verify AI-A2A.1 anchors exist for every write to the shared context store.
Risk description: Multi-agent systems rely on inter-agent communication for task delegation, result sharing, and coordination. Without authentication and integrity checks, an attacker can spoof messages from one agent to another, replay previous communications to trigger repeated actions, or inject instructions into the communication channel. The receiving agent treats these messages as legitimate because it has no mechanism to verify the sender.
SWT3 procedures:
AI-ID.1 - Agent Identity: Records identity assertions for each agent in the communication. Spoofed identities are detectable when the identity trail breaks.AI-ACC.1 - Access Control: Records whether the sending agent was authorized to communicate with the receiving agent.AI-TRUST.1 - Trust Verification: Records trust verification events between agents. Unauthenticated communications produce missing trust anchors.AI-TRUST.2 - Credential Presentation: Records credential exchanges between agents. Replayed or expired credentials are visible in the anchor trail.AI-MULTI.1 - Multi-Agent: Records the full multi-agent communication graph, including message direction, sequence, and content hashes.AI-A2A.1 - Agent-to-Agent Auth: Records authentication for every inter-agent interaction. Missing auth anchors indicate unauthenticated communication.AI-A2A.2 - Agent Delegation: Records delegation events where one agent transfers authority to another. Unauthorized delegations are visible as delegation anchors without corresponding authorization.For multi-agent deployments, verify that every inter-agent message has a corresponding AI-A2A.1 auth anchor and AI-TRUST.1 verification anchor. Missing anchors indicate communication without authentication. Compare AI-TRUST.2 credential timestamps against message timestamps to detect replay attacks.
Risk description: In multi-agent systems, a failure in one agent can cascade to others through shared dependencies, communication channels, or task delegation chains. A compromised agent that produces malicious output feeds that output to downstream agents, which treat it as legitimate input. The blast radius expands with each hop. Without lifecycle tracing, identifying the origin point and the propagation path requires manual reconstruction.
SWT3 procedures:
AI-CHAIN.1 - Lifecycle Chain: Links every action in a multi-step sequence by shared cycle ID. When a cascade occurs, querying any anchor in the chain resolves the full propagation path from origin to impact.AI-MULTI.1 - Multi-Agent: Records inter-agent interactions. The multi-agent communication graph shows which agents received output from the compromised source and in what order.Request the AI-CHAIN.1 lifecycle chain for any anchor associated with the failure. The chain resolves the complete sequence, showing the originating agent, every downstream agent that processed the output, and the timestamp at each hop. This is the primary evidence for blast radius assessment during incident response.
Risk description: AI agents communicate with authority and confidence, regardless of whether their output is accurate. An attacker exploits this by causing the agent to present false information, misleading recommendations, or fabricated urgency to human operators. The human trusts the agent because it has historically been reliable, and the agent's authoritative tone obscures the manipulation. This risk is amplified when agents have access to sensitive business context that makes their social engineering more convincing.
SWT3 procedures:
AI-TRUST.1 - Trust Verification: Records trust verification events. If the agent's trust status has been verified before interaction, the human can reference the verification anchor to confirm legitimacy.AI-CHAIN.1 - Lifecycle Chain: Records the chain of actions leading to the agent's output. Human operators can trace the reasoning chain to verify whether the agent's recommendation aligns with its actual input data.AI-A2A.2 - Agent Delegation: Records delegation events. If an agent claims it was delegated authority by another agent or system, the delegation anchor either confirms or refutes that claim.For high-stakes agent interactions, verify that AI-TRUST.1 anchors exist and are current. If the agent presents information that leads to a consequential decision, query the AI-CHAIN.1 lifecycle chain to verify the reasoning path. The chain should show a logical progression from input data to recommendation. Gaps in the chain indicate the recommendation may not be grounded in the agent's actual context.
Risk description: An agent that has been compromised, has drifted from its intended behavior, or has developed misaligned objectives continues to operate within the system. Without continuous monitoring, the rogue agent may function normally for extended periods while gradually exfiltrating data, corrupting outputs, or positioning itself for a larger attack. Detection requires comparing current behavior against a known-good baseline.
SWT3 procedures:
AI-MDL.1 - Model Card: Records model metadata and version. A rogue agent using a different model version than expected produces a metadata mismatch.AI-SKILL.1 - Skill Manifest: Records the agent's declared capabilities. Rogue agents that acquire new capabilities produce manifest changes detectable through comparison.AI-RAG.1 - RAG Provenance: Records retrieval patterns. A rogue agent accessing unusual data sources produces anomalous retrieval anchors.AI-DRIFT.1 - Output Drift: Records drift measurements over time. Gradual behavioral changes that indicate misalignment are captured as drift data points, enabling trend analysis.AI-DATA.1 - Data Provenance: Records data lineage. A rogue agent accessing or modifying data outside its scope produces provenance anchors that deviate from the baseline pattern.Request AI-DRIFT.1 trend data for the assessment period. Any sustained directional change in output metrics warrants investigation. Compare the current AI-SKILL.1 manifest against the approved baseline. New or modified capabilities that were not authorized through change management are a finding. For long-running agents, verify that AI-MDL.1 model metadata has not changed since the last approved deployment.
The following matrix shows which SWT3 procedures provide evidence for each OWASP Agentic risk. This view helps assessors identify procedures that cover multiple risks and risks that depend on a single procedure.
| Procedure | ASI01 | ASI02 | ASI03 | ASI04 | ASI05 | ASI06 | ASI07 | ASI08 | ASI09 | ASI10 |
|---|---|---|---|---|---|---|---|---|---|---|
AI-ID.1 |
✓ | ✓ | ✓ | |||||||
AI-ACC.1 |
✓ | ✓ | ✓ | |||||||
AI-TOOL.1 |
✓ | ✓ | ✓ | |||||||
AI-TOOL.2 |
✓ | ✓ | ||||||||
AI-GRD.1 |
✓ | ✓ | ✓ | |||||||
AI-GRD.2 |
✓ | ✓ | ||||||||
AI-GRD.3 |
✓ | ✓ | ✓ | ✓ | ||||||
AI-SEC.1 |
✓ | ✓ | ✓ | |||||||
AI-MDL.1 |
✓ | ✓ | ||||||||
AI-MDL.5 |
✓ | |||||||||
AI-SKILL.1 |
✓ | ✓ | ||||||||
AI-RAG.1 |
✓ | ✓ | ||||||||
AI-TRUST.1 |
✓ | ✓ | ||||||||
AI-TRUST.2 |
✓ | |||||||||
AI-CHAIN.1 |
✓ | ✓ | ||||||||
AI-MULTI.1 |
✓ | ✓ | ✓ | |||||||
AI-DRIFT.1 |
✓ | |||||||||
AI-DATA.1 |
✓ | ✓ | ||||||||
AI-A2A.1 |
✓ | ✓ | ||||||||
AI-A2A.2 |
✓ | ✓ |
Key observations:
| Question | Evidence |
|---|---|
| Has the agent's goal been tampered with? | Query AI-GRD.3 input validation anchors and AI-GRD.1 guardrail anchors for the time window. Correlation between a suspicious input acceptance and subsequent guardrail violations indicates goal hijacking. |
| Is the agent using tools within its authorized scope? | Compare AI-TOOL.1 invocation history against AI-TOOL.2 permission manifest. Any tool call outside the manifest is a finding. |
| Has the agent's identity been spoofed? | Verify AI-ID.1 identity anchors form a continuous chain. Gaps or identity changes without corresponding authorization events indicate spoofing. |
| Are the agent's dependencies trustworthy? | Compare AI-MDL.5 weight hashes and AI-SKILL.1 skill manifests against approved baselines. Any delta is a supply chain finding. |
| Is the agent executing code safely? | Verify AI-TOOL.1 execution anchors have corresponding AI-GRD.1 guardrail anchors. Execution without guardrails is a sandbox boundary failure. |
| Has the agent's memory been poisoned? | Query AI-RAG.1 provenance anchors for retrievals that preceded anomalous behavior. Cross-reference with AI-DATA.1 to trace the data lineage. |
| Are inter-agent messages authenticated? | Verify AI-A2A.1 auth anchors and AI-TRUST.1 verification anchors exist for every inter-agent interaction. Missing anchors indicate unauthenticated communication. |
| What is the blast radius of an agent failure? | Query AI-CHAIN.1 lifecycle chain from any affected anchor. The chain resolves the full propagation path. AI-MULTI.1 shows the agent communication graph. |
| Is the agent being used for social engineering? | Verify AI-TRUST.1 trust status is current. Trace AI-CHAIN.1 lifecycle chain to confirm the agent's recommendation is grounded in actual input data. |
| Has the agent gone rogue? | Query AI-DRIFT.1 trend data for sustained directional change. Compare current AI-SKILL.1 manifest against approved baseline. Review AI-RAG.1 for anomalous retrieval patterns. |
pip install swt3-aifrom swt3_ai import Witness
witness = Witness(
api_key="your-api-key",
agent_id="customer-support-agent-v2"
)
# Wrap your AI client to witness every inference
client = witness.wrap(openai.OpenAI())
# Witness tool calls (ASI02, ASI04, ASI05)
result = witness.wrap_tool(
tool_name="database_query",
tool_input={"query": "SELECT * FROM orders WHERE id = 42"},
tool_output={"rows": 1, "status": "ok"}
)
# Witness access decisions (ASI02, ASI03, ASI07)
witness.wrap_access(
resource="customer_database",
action="read",
decision="allow"
)
# Flush anchors to the witness endpoint
witness.flush()npm install @tenova/swt3-aiimport { Witness } from '@tenova/swt3-ai';
const witness = new Witness({
apiKey: 'your-api-key',
agentId: 'customer-support-agent-v2',
});
// Wrap your AI client to witness every inference
const client = witness.wrap(new OpenAI());
// Witness tool calls (ASI02, ASI04, ASI05)
await witness.wrapTool({
toolName: 'database_query',
toolInput: { query: 'SELECT * FROM orders WHERE id = 42' },
toolOutput: { rows: 1, status: 'ok' },
});
// Witness access decisions (ASI02, ASI03, ASI07)
await witness.wrapAccess({
resource: 'customer_database',
action: 'read',
decision: 'allow',
});
// Flush anchors to the witness endpoint
await witness.flush();