Sources where this catalog comes from

Primary taxonomy of agentic threats T1–T17 plus named attack scenarios per threat.

What we use: Drives the threat IDs, names, definitions, and mitigation associations across this site.

Top-10 format on-ramp (ASI01–ASI10) over the T1–T17 catalog. Appendix A cross-walks every entry to LLM Top 10, T-numbers, and AIVSS core risks.

What we use: Drives the Top 10 grid on the Frameworks page and the "covered by" badges on threat detail pages.

Applies the Cloud Security Alliance MAESTRO framework to MAS scenarios and records extended threat scenarios.

What we use: Drives the seven-layer model, cross-layer band, agentic factors, and normalized MAS scenario entries on the Frameworks page.

LLM01–LLM10 covering injection, supply-chain, output handling, agency, system-prompt leakage, and unbounded consumption at the LLM application layer.

What we use: Per-threat cross-walk: each agentic threat detail page links the matching LLM01–LLM10 entries so practitioners can pivot between the agentic and the LLM-app frames.

Named control IDs (#AI PROGRAM, #SEC PROGRAM, #LEAST MODEL PRIVILEGE, #OVERSIGHT, #UNWANTED BIAS TESTING, …) that map to mitigation classes Helmwart recommends.

What we use: Mitigation pages cite the matching OWASP AI Exchange control ID so readers can pivot to the wider AI-application security taxonomy.

Seven tenets of Zero Trust; the PE / PA / PEP (Policy Engine / Policy Administrator / Policy Enforcement Point) model; non-perimeter access patterns.

What we use: Canonical reference for identity, privilege, and inter-agent-communication mitigations (m-spiffe, m-rbac-abac, m-message-signing, m-token-lifetime, m-time-bound-priv).

Govern / Map / Measure / Manage functions for AI risk; "stop-build authority"; third-party oversight.

What we use: Governance backbone for mitigations addressing policy enforcement, oversight, anomaly detection, and continuous validation.

Twelve GAI risk categories (Confabulation, Information Integrity, Information Security, Value Chain Integration, …), each with Govern/Map/Measure/Manage actions.

What we use: Standards-grounded cross-walk for hallucination, supply-chain, memory, and output-moderation controls.

Joint government guidance: five agentic-AI risk categories (Privilege, Design & Configuration, Behavioral, Structural, Accountability) with concrete deployment recommendations.

What we use: Cited on mitigation pages addressing privilege scoping, identity, observability, and cascading-failure containment.

Four practical Zero-Trust principles applied to agents: scoped identity + contextual authz, delegated token exchange (RFC 8693), continuous verification + audit, workload attestation.

What we use: Implementation-oriented citation for SPIFFE, message signing, MFA-on-high-priv, NHI lifecycle, and time-bound privilege mitigations.

Adversarial tactics & techniques against AI/ML systems (AML.TXXXX IDs). External to OWASP; not referenced by the Top 10 2026, only briefly cited in the T1–T17 catalog.

What we use: Per-threat external pivot: where a T-number has a concrete adversary technique catalogued in ATLAS, the technique ID surfaces on the threat card. T8 has no clean ATLAS match; T7/T10 use loose pivots noted on each page.