An attacker manipulates an agent's objective, task selection, or decision pathway (via injected prompts, deceptive tool outputs, forged peer messages, or poisoned retrieval data) so that the agent pursues the attacker's goal rather than the operator's.
09 · FRAMEWORKS & STANDARDS
Frameworks & standards the source publications Helmwart interprets
6 core threat taxonomies and 3 governance standards (ISO/IEC 42001, SOC 2, ISO/IEC 27001) are explained here. OWASP Threats & Mitigations v1.1 owns T1–T17; Helmwart normalizes the MAS Guide's scenario-scoped extensions into stable internal navigation entries and retains the renumbered RPA source IDs as labels. Supporting NIST, CISA, and other control references are catalogued on the Sources page.
04A OWASP Agentic AI: Threats & Mitigations
Agentic AI: Threats and Mitigations v1.1 (Dec 2025) owns T1–T17. The older MAS Threat Modelling Guide v1.0 (Apr 2025) publishes scenario-specific extended threats and reuses some identifiers across its worked systems. Helmwart presents stable entries as T18–T49 and displays the RPA guide entries originally numbered T16/T17 as T48/T49. This merged numbering is Helmwart's normalization, not an OWASP-issued master catalog.
51 threats grouped by the v1.1 Decision Path. Each step lists base T1–T17 threats and the MAS Guide extensions that build on them, plus T50–T51, which are Helmwart's own rather than OWASP's, in their own section. Cards carry MAESTRO layer, agentic factor, ATLAS technique, and mitigation chips.
04B OWASP Top 10 for Agentic Applications 2026
A separate OWASP publication ("ASI Top 10", v2026, December 2025) that surfaces ten agentic risks in the standard OWASP Top 10 format. Its Appendix A links into OWASP threat material; Helmwart additionally shows related normalized MAS scenarios as editorial cross-references. Use it as a fast on-ramp; use the T-catalog when you need detail.
An agent applies authorised tools in ways their operator did not intend, driven by prompt injection, misaligned reasoning, or manipulated tool outputs.
OWASP LLM Top 10:
LLM03:2026
When an agent acts on a user's behalf it inherits that user's credentials and permissions for the duration of the task.
Third-party components that agents depend on (models, MCP servers, plug-ins, datasets, peer-agent descriptors, and update channels) may be malicious, compromised post-approval, or tampered with in transit.
OWASP LLM Top 10:
LLM04:2026
In an agentic system, code generation and code execution happen in the same turn: the model emits an instruction and a tool runs it, with no human review step between.
An adversary writes malicious or misleading data into an agent's persistent memory or shared vector store, so that every future session, and every peer agent reading from the same store, operates on corrupted context.
Agents in a multi-agent system pass instructions, results, and context to one another across APIs, message buses, and shared state.
A single low-severity fault (a hallucinated value, a corrupted tool output, a poisoned memory entry) propagates across a network of agents that each build on the last agent's output, compounding into system-wide harm that is disproportionate to the original defect.
Adversaries exploit the tendency of humans to trust fluent, authoritative-sounding agents: an agent presents plausible justification for a harmful action, the human approves it, and the resulting audit trail reads as deliberate human authorisation.
A rogue agent is one whose behavioural objective has drifted from its authorised purpose, yet its identity still checks out, its actions remain inside its permissions, and its logs look clean.
Source: OWASP Top 10 for Agentic Applications 2026 → · Side-by-side explainer: DeepTeam framework summary →
04C OWASP LLM Top 10 for LLM Applications 2026
The OWASP LLM Top 10 (2026) ranks the highest-impact risks for LLM-based applications. It predates agentic systems but stays load-bearing: every agent runs on an LLM, so every LLM Top 10 risk surfaces in the agent loop with a different blast radius. Each card links to the Helmwart "in agentic systems" page, where the OWASP definition is preserved and the agentic delta is added.
Input from a user, retrieved content, tool output, or memory alters model behaviour in ways the developer did not intend.
The system exposes confidential, regulated, or proprietary data through a channel nobody authorised.
Excess functionality, permissions, or autonomy turns an unexpected or manipulated model output into a damaging action.
Third-party training data, models, adapters, conversion pipelines, or deployment platforms arrive tampered with.
Related ASI Top 10:
ASI04
Data or model artifacts are manipulated to embed harmful behaviour, bias, or exploitable weaknesses.
Uncontrolled inference lets attackers disrupt availability, inflict runaway cost, or clone the model.
Output that is incorrect or misleading, but credible enough to drive a human decision or an agent action.
Non-user-facing context (system prompt, policy text, tool and function schemas) is extracted, inferred, or reconstructed.
Attacks on embedding geometry and similarity search change what the retrieval layer puts in front of the model.
Related ASI Top 10:
ASI06
Model output passes downstream to other components without validation or sanitisation.
Source: OWASP LLM Top 10 for LLM Applications 2026 →
04D MAESTRO: seven layers + cross-layer
MAESTRO (Cloud Security Alliance, v1.0 Apr 2025) decomposes an agentic system into seven architectural layers (L1–L7) plus a Cross-Layer category for emergent multi-agent failures. Each card shows the layer's scope, how many catalog threats touch it, and example T-numbers. Open a card for the full layer prose.
The LLMs themselves: weights, training data, alignment.
touches
T1T7T17
+2
Vector stores, RAG corpora, training pipelines, ingest.
touches
T1T12T17
+5
Orchestration, planning, reflection, tool routing.
touches
T2T5T6
+14
Sandboxes, runtimes, network egress, secrets.
touches
T3T4T11
+7
Logs, traces, evals, post-hoc audit.
touches
T8T10T23
+2
Identity, policy, regulated-data boundaries, HITL.
touches
T3T7T24
+4
A2A protocol, MCP, peer agents, third-party tools.
touches
T9T13T14
+7
Emergent failures that only exist between layers, not modellable inside any one.
touches
T1T2T3
+11
Full MAESTRO reference: seven-layer overview with per-layer prose →
04E MAS Threat Modelling Guide
The OWASP MAS Guide v1.0 (Apr 2025) is the older companion publication containing multi-agent scenario threats that Helmwart normalizes as T18–T49. Because the source guide reuses some IDs between worked systems, this site provides stable navigation entries rather than claiming a one-to-one OWASP catalog. The renumbered RPA source entries T16 and T17 are displayed as Helmwart T48 and T49 with their source IDs alongside them.
Layer-grouped browse of the MAS Guide threats, each linking to its detail page with the base v1.1 threat it extends. Use this when you want layer-first reading rather than Decision-Path-first.
04F MITRE ATLAS
ATLAS is MITRE's adversary-techniques knowledge base for AI systems. Helmwart surfaces ATLAS IDs on threat cards where a clean mapping exists, so detection engineers can move from a Helmwart finding to TTP-level indicators. It is not part of the OWASP source material; the MAESTRO guide briefly discusses how the two compose. As of the 2026 LLM Top 10, OWASP also publishes its own mapping into ATLAS; that crosswalk is the second card below.
AML.T#### technique IDs across reconnaissance, initial access, model evasion, exfiltration, and impact. Helmwart maps a threat → ATLAS only where the upstream document or our editorial review supports the link; uncertain cases are left empty rather than fabricated.
Appendix A is OWASP's own mapping from the LLM Top 10 into ATLAS, published and version-pinned by the project that maintains the Top 10. That matters for a crosswalk: when the two sides disagree, there is one publisher to correct rather than a fork to reconcile.
The ATLAS side is pinned to content v2026.06 (format-version 6.0.0). The pin is what makes the mapping reproducible: ATLAS publishes a new content release most months, so a crosswalk that names no release cannot be re-derived or diffed later. Each cell carries a strength mark, defined in the appendix's own legend:
● primary (a central line of defense or description of the risk) · ○ supporting (contributes but is not the center of gravity) · — no applicable mapping. OWASP Top 10 for LLM Applications 2026 · Appendix A, page 58
Read a row as one LLM risk against the ATLAS tactics an attack traverses, “where primary tactics carry the core adversary objective and supporting tactics the enabling steps” (page 68). The table is not reproduced here; open it at the source. Helmwart's threat → ATLAS chips remain separate editorial work over the T-catalog and are not derived from Appendix A.
04G ISO/IEC 42001:2023
ISO/IEC 42001 is the international standard for an AI management system (AIMS) — the governance an organization puts around the AI it builds or operates. Unlike the taxonomies above it does not enumerate threats; it asks whether you run a system that would catch and manage them. Helmwart summarizes its Annex A reference controls as an interpretive coverage map, honestly separating the controls a design-time model can bear on from the organizational process it cannot. A coverage map, never certification.
The nine Annex A control objectives (A.2–A.10), plus the eight reference controls under them that a design-time model can actually speak to — A.6.2.4, A.6.2.6, A.6.2.8, A.7.4, A.7.5, A.8.2, A.9.4 and A.10.3, touching five of the nine objectives. Not the full Annex A: most of its reference controls are organizational (policy, roles, resources, impact assessment) and nothing in a system diagram evidences them. Each is summarized in Helmwart's own words, and the mappable ones link to the agentic threats they bear on; the live Compliance view scores those against a modelled system.
04H SOC 2
SOC 2 is the AICPA's attestation framework for service organizations — an independent auditor's report against the Trust Services Criteria, not a certification. Helmwart summarizes its criteria as an interpretive coverage map, honestly separating the CC6/CC7/CC8/CC9.2 criteria a design-time model can bear on from the organizational process it cannot. A coverage map, never an attestation opinion.
The 9 Common Criteria (CC1–CC9) plus the four scope-dependent categories (Availability, Confidentiality, Processing Integrity, Privacy), each summarized in Helmwart's own words and tagged design-time-mappable or organizational. The mappable criteria link to the agentic threats they bear on; the live Compliance view scores them against a modelled system.
04I ISO/IEC 27001:2022
ISO/IEC 27001 is the international standard for an information security management system (ISMS) — the governance an organization puts around protecting information. Helmwart summarizes its Annex A:2022 reference controls as an interpretive coverage map, honestly separating the controls a design-time model can bear on (mostly the A.8 technological theme) from the organizational process it cannot. A coverage map, never certification.
The four Annex A:2022 themes (A.5 organizational, A.6 people, A.7 physical, A.8 technological) and their 93 reference controls, each summarized in Helmwart's own words and tagged design-time-mappable or organizational. The mappable controls link to the agentic threats they bear on; the live Compliance view scores them against a modelled system.